{ "analysis_id": "bf107971-6797-4f93-9ffc-1301c6363bd9", "session_id": "7df59b46-baa9-4b80-b1af-df8f693d38a3", "status": "completed", "filename": "2018-11-07-traffic-analysis-exercise.pcap", "source_sha256": "79f9a39e2cb38303a7f2e8363d984f727347537a87473679d9c081e79cde527f", "source_size_bytes": 7737362, "schema_version": "pcap-analysis-v1", "semantic_sha256": "57ac59ede6c21b271cff5569fb1729d405a4dfed64df8fb1626b4bf8d9d493e2", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 10231 packets across 43 IP endpoints and 251 transport flows. Observed 172 DNS events, 143 HTTP requests, 79 TLS ClientHello events, and 106 recovered file/message object(s). Deterministic rules produced 33 finding(s): 0 high, 29 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2018-11-07-traffic-analysis-exercise.pcap\nCapture SHA-256: `79f9a39e2cb38303a7f2e8363d984f727347537a87473679d9c081e79cde527f`\nSemantic result SHA-256: `57ac59ede6c21b271cff5569fb1729d405a4dfed64df8fb1626b4bf8d9d493e2`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 10231 packets across 43 IP endpoints and 251 transport flows. Observed 172 DNS events, 143 HTTP requests, 79 TLS ClientHello events, and 106 recovered file/message object(s). Deterministic rules produced 33 finding(s): 0 high, 29 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 10231\n- Duration: 2476.61435 seconds\n- Captured bytes: 7573642\n- Endpoints: 43\n- Flows: 251\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 2555 / TCP stream 70, frame 2557 / TCP stream 70.\n\nMetrics: `{\"content_type\":\"text/html; charset=iso-8859-1\",\"declared_body_bytes\":248,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"62.149.140.59\",\"uri\":\"/img/client.rar\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 2564 / TCP stream 71, frame 2566 / TCP stream 71.\n\nMetrics: `{\"content_type\":\"application/x-rar-compressed\",\"declared_body_bytes\":773,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"62.149.140.59\",\"uri\":\"/img/client.rar\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4668 / TCP stream 107, frame 4951 / TCP stream 107.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":44652,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/Javascript%20Library/jquery-1.11.3.min.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4676 / TCP stream 105, frame 5074 / TCP stream 105.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":88948,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4710 / TCP stream 103, frame 4786 / TCP stream 103.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":12658,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/Style%20Library/bootstrap334/js/bootstrap.min.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4749 / TCP stream 106, frame 4932 / TCP stream 106.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":61030,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/Javascript%20Library/angular.min.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4768 / TCP stream 108, frame 4869 / TCP stream 108.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":10705,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/Javascript%20Library/angular-animate.min.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4788 / TCP stream 103, frame 4886 / TCP stream 103.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":6953,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/Javascript%20Library/jquery.jcarousel.min.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4794 / TCP stream 104, frame 4897 / TCP stream 104.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":6926,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/Javascript%20Library/responsive/jsBaseResponsive.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4871 / TCP stream 108, frame 4957 / TCP stream 108.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":715,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/Javascript%20Library/UCDJS.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4899 / TCP stream 104, frame 4987 / TCP stream 104.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":120,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/blank.js?rev=QGOYAJlouiWgFRlhHVlMKA%3D%3D\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4947 / TCP stream 106, frame 5045 / TCP stream 106.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":41125,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/1033/init.js?rev=wgiyW1GQqDQZTITaawvYoA%3D%3D\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 5123 / TCP stream 104, frame 5139 / TCP stream 104.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":882,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/carousel.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 5129 / TCP stream 103, frame 5156 / TCP stream 103.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":18021,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-search-ng.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 5160 / TCP stream 104, frame 5166 / TCP stream 104.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":1099,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/data.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 5284 / TCP stream 109, frame 5363 / TCP stream 109.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":17168,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"216.58.192.46\",\"uri\":\"/ga.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6577 / TCP stream 104, frame 6896 / TCP stream 104.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":82322,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/1033/core.js?rev=Emb5hNX1RZMNXk9oS82yvA%3D%3D\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6579 / TCP stream 103, frame 6593 / TCP stream 103.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":4100,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/sp.core.js?rev=7ByNlH%2BvcgRJg%2BRCctdC0w%3D%3D\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6583 / TCP stream 105, frame 6779 / TCP stream 105.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":95566,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/cui.js?rev=OOyJv78CADNBeet%2FvTvniQ%3D%3D\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6601 / TCP stream 108, frame 6740 / TCP stream 108.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":10284,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/sp.ui.dialog.js?rev=Tpcmo1%2FSu6R0yewHowDl5g%3D%3D\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6742 / TCP stream 108, frame 6796 / TCP stream 108.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":18804,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/sp.runtime.js?rev=IGffcZfunndj0247nOxKVg%3D%3D\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6798 / TCP stream 108, frame 6884 / TCP stream 108.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":71060,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/sp.js?rev=%2B4ZEyA892P3T0504qi0paw%3D%3D\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6903 / TCP stream 104, frame 6912 / TCP stream 104.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":5739,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/mediaplayer.js?rev=Q6vfD9BNL%2B9PvwgrVEcc%2FA%3D%3D\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6905 / TCP stream 105, frame 6928 / TCP stream 105.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":14231,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/inplview.js?rev=WB6Gy8a027aeNCq7koVCUg%3D%3D\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6930 / TCP stream 105, frame 6985 / TCP stream 105.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":55449,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/sp.ribbon.js?rev=F%2BUEJ66rbXzSvpf7nN69wQ%3D%3D\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 8178 / TCP stream 106, frame 8234 / TCP stream 106.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":416,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/programs/undergraduate/Documents/Styles_Scripts/local.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 8182 / TCP stream 103, frame 8238 / TCP stream 103.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":2349,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/kwizcom.sharepoint.foundation/kwizcom_jsutility.js?v=13.4.81&source=kwizcomsharepointutilities\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 8188 / TCP stream 104, frame 8558 / TCP stream 104.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":0,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/kwizcom.sharepoint.foundation/jquery.js?v=13.4.81&source=kwizcomsharepointutilities\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 8190 / TCP stream 107, frame 8264 / TCP stream 107.\n\nMetrics: `{\"content_type\":\"application/x-javascript\",\"declared_body_bytes\":1702,\"destination\":\"10.22.15.119\",\"response_count\":1,\"source\":\"132.194.7.45\",\"uri\":\"/_layouts/kwizcom_aggregator/kwizcom_listaggregator.js?v=12.1.12&source=kwizcomsharepointutilities\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 61 / TCP stream 1, frame 63 / TCP stream 1, frame 65 / TCP stream 1, frame 67 / TCP stream 1, frame 265 / TCP stream 1.\n\nMetrics: `{\"destination\":\"10.22.15.2\",\"event_count\":12,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.22.15.119\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 147 / TCP stream 11, frame 164 / TCP stream 11, frame 167 / TCP stream 11, frame 169 / TCP stream 11, frame 183 / TCP stream 11.\n\nMetrics: `{\"destination\":\"10.22.15.2\",\"event_count\":41,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.22.15.119\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 62 / TCP stream 1, frame 64 / TCP stream 1, frame 66 / TCP stream 1, frame 68 / TCP stream 1, frame 266 / TCP stream 1.\n\nMetrics: `{\"destination\":\"10.22.15.119\",\"event_count\":12,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.22.15.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 149 / TCP stream 11, frame 166 / TCP stream 11, frame 168 / TCP stream 11, frame 170 / TCP stream 11, frame 186 / TCP stream 11.\n\nMetrics: `{\"destination\":\"10.22.15.119\",\"event_count\":33,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.22.15.2\"}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `carlos.danger`; client IPs: 10.22.15.119; frames: 530, 538, 540, 552, 571\n- account: `danger-win-pc$`; client IPs: 10.22.15.119; frames: 28, 36, 38, 50, 79\n- hostname: `Danger-Win-PC`; client IPs: 10.22.15.119; frames: 404, 1702, 2250, 1, 221\n- netbios-group: `GEEOGRAPHIC`; client IPs: unbound subject; frames: 2, 254, 307, 398\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `222.222.67.208.in-addr.arpa`; roles: dns-query\n- domain: `8895986.fls.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `accounts.google.com`; roles: dns-query, tls-sni\n- domain: `adservice.google.com`; roles: dns-query, tls-sni\n- domain: `api.bing.com`; roles: dns-query\n- domain: `apis.google.com`; roles: dns-query, tls-sni\n- domain: `bcp.crwdcntrl.net`; roles: dns-query, tls-sni\n- domain: `clas.ucdenver.edu`; roles: dns-query, tls-sni\n- domain: `clients.l.google.com`; roles: dns-cname\n- domain: `clients1.google.com`; roles: dns-query, tls-sni\n- domain: `clients4.google.com`; roles: dns-query, tls-sni\n- domain: `clientservices.googleapis.com`; roles: dns-query, tls-sni\n- domain: `cm.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `cyanteread.com`; roles: dns-query\n- domain: `d.turn.com`; roles: dns-query, tls-sni\n- domain: `d.turn.com.akadns.net`; roles: dns-cname\n- domain: `danger-win-pc.geeographic.com`; roles: dns-query\n- domain: `dart.l.doubleclick.net`; roles: dns-cname\n- domain: `dhsiwyqdlskwsqo.com`; roles: dns-query, http-host\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `dpm.demdex.net`; roles: dns-query, tls-sni\n- domain: `dsum-sec.casalemedia.com`; roles: dns-query, tls-sni\n- domain: `edbmwhcwe.geeographic.com`; roles: dns-query\n- domain: `edbmwhcwe.localdomain`; roles: dns-query\n- domain: `encrypted-tbn0.gstatic.com`; roles: dns-query, tls-sni\n- domain: `fast.fonts.net`; roles: dns-query, tls-sni\n- domain: `ferranorga.net`; roles: dns-query, http-host\n- domain: `fonts.gstatic.com`; roles: dns-query, tls-sni\n- domain: `geeographic-dc.geeographic.com`; roles: dns-query\n- domain: `geeographic.com`; roles: dns-query\n- domain: `gstaticadssl.l.google.com`; roles: dns-cname\n- domain: `id.google.com`; roles: dns-query, tls-sni\n- domain: `id.l.google.com`; roles: dns-cname\n- domain: `imap.aol.com`; roles: dns-query, tls-sni\n- domain: `insight-760077375.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `insight.adsrvr.org`; roles: dns-query, tls-sni\n- domain: `internal-aol.imap.mail.g03.yahoodns.net`; roles: dns-cname\n- domain: `isatap.geeographic.com`; roles: dns-query\n- domain: `isatap.localdomain`; roles: dns-query\n- domain: `ivtqfoqdro.geeographic.com`; roles: dns-query\n- domain: `ivtqfoqdro.localdomain`; roles: dns-query\n- domain: `link.sandwseafood.net`; roles: dns-query, tls-sni\n- domain: `loadm.exelator.com`; roles: dns-query, tls-sni\n- domain: `match-975362022.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `match.adsrvr.org`; roles: dns-query, tls-sni\n- domain: `myip.opendns.com`; roles: dns-query\n- domain: `myip.opendns.com.geeographic.com`; roles: dns-query\n- domain: `pagead.l.doubleclick.net`; roles: dns-cname\n- domain: `pagead46.l.doubleclick.net`; roles: dns-cname\n- domain: `pixel-a.basis.net`; roles: dns-query, tls-sni\n- domain: `pixel.sitescout.com`; roles: dns-query, tls-sni\n- domain: `pixel.tapad.com`; roles: dns-query, tls-sni\n- domain: `plus.l.google.com`; roles: dns-cname\n- domain: `qigpzlvhnkqxpl.geeographic.com`; roles: dns-query\n- domain: `qigpzlvhnkqxpl.localdomain`; roles: dns-query\n- domain: `qwpvlqamqfnzxfk.geeographic.com`; roles: dns-query\n- domain: `qwpvlqamqfnzxfk.localdomain`; roles: dns-query\n- domain: `resolver1.opendns.com`; roles: dns-query\n- domain: `rtelyse.geeographic.com`; roles: dns-query\n- domain: `rtelyse.localdomain`; roles: dns-query\n- domain: `shumbildac.com`; roles: dns-query, http-host\n- domain: `smtp.aol.com`; roles: dns-query, tls-sni\n- domain: `ssl.gstatic.com`; roles: dns-query, tls-sni\n- domain: `stats.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `stats.l.doubleclick.net`; roles: dns-cname\n- domain: `sync.teads.tv`; roles: dns-query, tls-sni\n- domain: `tmencedfur.com`; roles: dns-query, tls-sni\n- domain: `translate.googleapis.com`; roles: dns-query, tls-sni\n- domain: `wpad.geeographic.com`; roles: dns-query\n- domain: `www-google-analytics.l.google.com`; roles: dns-cname\n- domain: `www.bing.com`; roles: dns-query\n- domain: `www.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `www.ferranorga.net`; roles: dns-query, http-host\n- domain: `www.google-analytics.com`; roles: dns-query, http-host, tls-sni\n- domain: `www.google.com`; roles: dns-query, tls-sni\n- domain: `www.gstatic.com`; roles: dns-query, tls-sni\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- domain: `www.ucdenver.edu`; roles: dns-query, http-host\n- domain: `zotwyog.geeographic.com`; roles: dns-query\n- domain: `zotwyog.localdomain`; roles: dns-query\n- ipv4: `10.22.15.119`; roles: dns-answer, network-endpoint\n- ipv4: `10.22.15.2`; roles: dns-answer, network-endpoint\n- ipv4: `10.22.15.255`; roles: network-endpoint\n- ipv4: `107.178.246.49`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer\n- ipv4: `13.107.5.80`; roles: dns-answer\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `132.194.39.10`; roles: dns-answer, network-endpoint\n- ipv4: `132.194.7.45`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.15.194`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.193.154`; roles: dns-answer\n- ipv4: `172.217.193.155`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.193.156`; roles: dns-answer\n- ipv4: `172.217.193.157`; roles: dns-answer\n- ipv4: `172.217.2.68`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.3.66`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.3.67`; roles: dns-answer, network-endpoint\n- ipv4: `192.162.244.171`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer\n- ipv4: `208.67.222.222`; roles: dns-answer, network-endpoint\n- ipv4: `209.15.36.22`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.192.35`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.192.38`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.192.42`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.192.45`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.192.46`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.192.67`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.56.194.57`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `34.192.39.141`; roles: dns-answer, network-endpoint\n- ipv4: `34.192.90.231`; roles: dns-answer\n- ipv4: `34.198.191.149`; roles: dns-answer\n- ipv4: `34.198.228.49`; roles: dns-answer\n- ipv4: `34.199.147.194`; roles: dns-answer\n- ipv4: `34.202.147.29`; roles: dns-answer\n- ipv4: `34.203.74.207`; roles: dns-answer\n- ipv4: `34.204.248.161`; roles: dns-answer\n- ipv4: `34.205.99.3`; roles: dns-answer\n- ipv4: `34.224.172.188`; roles: dns-answer\n- ipv4: `34.227.43.215`; roles: dns-answer, network-endpoint\n- ipv4: `34.236.63.37`; roles: dns-answer\n- ipv4: `34.237.159.145`; roles: dns-answer\n- ipv4: `34.239.206.211`; roles: dns-answer\n- ipv4: `35.168.218.13`; roles: dns-answer\n- ipv4: `35.168.53.247`; roles: dns-answer\n- ipv4: `35.168.67.88`; roles: dns-answer\n- ipv4: `35.171.180.138`; roles: dns-answer\n- ipv4: `46.229.214.92`; roles: dns-answer, network-endpoint\n- ipv4: `46.29.160.132`; roles: dns-answer, network-endpoint\n- ipv4: `50.116.194.23`; roles: dns-answer, network-endpoint\n- ipv4: `52.0.244.217`; roles: dns-answer\n- ipv4: `52.20.145.225`; roles: dns-answer\n- ipv4: `52.204.152.189`; roles: dns-answer\n- ipv4: `52.207.122.163`; roles: dns-answer, network-endpoint\n- ipv4: `52.208.135.160`; roles: dns-answer\n- ipv4: `52.210.213.208`; roles: dns-answer\n- ipv4: `52.210.34.59`; roles: dns-answer\n- ipv4: `52.213.58.51`; roles: dns-answer\n- ipv4: `52.214.151.124`; roles: dns-answer, network-endpoint\n- ipv4: `52.30.113.91`; roles: dns-answer\n- ipv4: `52.31.219.56`; roles: dns-answer\n- ipv4: `52.4.55.137`; roles: dns-answer\n- ipv4: `52.7.21.186`; roles: dns-answer\n- ipv4: `52.72.190.60`; roles: dns-answer\n- ipv4: `54.194.108.5`; roles: dns-answer\n- ipv4: `54.236.245.79`; roles: dns-answer\n- ipv4: `54.81.75.176`; roles: dns-answer\n- ipv4: `54.85.197.245`; roles: dns-answer\n- ipv4: `54.85.233.91`; roles: dns-answer\n- ipv4: `54.85.96.132`; roles: dns-answer\n- ipv4: `54.86.197.0`; roles: dns-answer, network-endpoint\n- ipv4: `62.149.140.59`; roles: dns-answer, network-endpoint\n- ipv4: `63.251.240.12`; roles: dns-answer, network-endpoint\n- ipv4: `66.218.86.51`; roles: dns-answer\n- ipv4: `72.246.64.147`; roles: dns-answer, network-endpoint\n- ipv4: `72.246.64.187`; roles: dns-answer, network-endpoint\n- ipv4: `72.246.64.227`; roles: dns-answer\n- ipv4: `72.246.64.48`; roles: dns-answer\n- ipv4: `72.45.33.49`; roles: dns-answer\n- ipv4: `74.6.141.28`; roles: dns-answer, network-endpoint\n- ipv4: `74.6.141.50`; roles: dns-answer, network-endpoint\n- ipv4: `93.184.216.182`; roles: dns-answer, network-endpoint\n- ipv4: `95.181.198.115`; roles: dns-answer, network-endpoint\n- ipv4: `95.181.198.116`; roles: network-endpoint\n- ipv6: `fd3e:4f5a:5b81::1`; roles: dns-answer\n- ja3: `14eff09463c9d6dc6e14e954eba239c2`; roles: tls-client-fingerprint\n- ja3: `1d095e68489d3c535297cd8dffb06cb9`; roles: tls-client-fingerprint\n- ja3: `4d7a28d6f2263ed61de88ca66eb011e3`; roles: tls-client-fingerprint\n- ja3: `656854b0e07f676ae44f8d559744be60`; roles: tls-client-fingerprint\n- ja3: `bd05542435b3f44f31461cdd7ddc94b8`; roles: tls-client-fingerprint\n- ja3: `e25044a54b6fbc8ba81f95563dd201c3`; roles: tls-client-fingerprint\n- sha256: `009d4cdb69f30688198c7a19b25ef0667c5f7b172d65b2273ed2274bc8eb5425`; roles: exported-object\n- sha256: `022d0a09ef989821ccf3e8bd48be89355052024fc688fe3c4c84c3da00a6e082`; roles: exported-object\n- sha256: `02717a94a92b22f6715c10f1483a4b252f61bd705675ae250af5411ff01de437`; roles: exported-object\n- sha256: `05d5af0ab07517396f53c3e161f0ebc23c09242eae0c2372d7da26dd5786953e`; roles: exported-object\n- sha256: `0ba2f6756001669bdf934f9d79e8fd1ccf2028130c33a0510279581ec9dfd73a`; roles: exported-object\n- sha256: `0c6da6b5d4f5db2accb9c1847cd2686c683d0875750b069f14339c5f75c93029`; roles: exported-object\n- sha256: `10570ac15a02224c4743309c48c8b8eefeaa931d9f1db7238edd7b3fa6cd2ff7`; roles: exported-object\n- sha256: `11065daca98f9840f58be03dd0fa78c710b9509ad517857acacf715c491de6d6`; roles: exported-object\n- sha256: `1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f`; roles: exported-object\n- sha256: `1519c5e27fa45f1ceb90ae78923c474e3f5597d45e6a8c61ad73367a432333b8`; roles: exported-object\n- sha256: `158494850d445b90585ee2d25e2969b3218808ccb0897c79ca240f7c3556d92b`; roles: exported-object\n- sha256: `185f2b901d68c7451a492d90ed38aa2c1de840061735a06836c2587f958ed31c`; roles: exported-object\n- sha256: `190a90d96675f28bb6ab1bab072f3b61ec321af3a8c3843a70248d9bb71bcdfe`; roles: exported-object\n- sha256: `198f44920d0d51bc49281f580acc760fd88a96e2422c8784114df6dab93ecc09`; roles: exported-object\n- sha256: `19fda88c2df63d85b7762799904408d0703f7efe7d6956d70c776458075747f3`; roles: exported-object\n- sha256: `20f3807f724bf5bb6c8a2cf7f62bc8003717104ef480c7dfd1b8dab767144bbc`; roles: exported-object\n- sha256: `2453e31f9c5e0dbee528d11f97a85edf897ed93406954ce8e475f0244abf249a`; roles: exported-object\n- sha256: `24e819821e2f9afcfed4ad0e8490935378abfb0df723850078e731cfd9ef6edd`; roles: exported-object\n- sha256: `25d7dc2c15716821face8630fbf2c166969dc0852e19c822e07982ea512da981`; roles: exported-object\n- sha256: `2976d80beac91eed779d1f204cb2e1be813c53bb2e1dfe03334f2c30b4f995be`; roles: exported-object\n- sha256: `2e2e544728c5e5f5cfdc9ad2faf6063af99088e1c3edc32e5074e7ad541c18a0`; roles: exported-object\n- sha256: `36d8e52a141bc54658ed41dde1654343bbd008af29f889f6e0a2f41441457ba6`; roles: exported-object\n- sha256: `37e9250c18e218e58fb1818a608e9ad463a4b4743ebf3c08ca738001cc8970e0`; roles: exported-object\n- sha256: `398cea3dc83051c117a65a9897bd17c84dace5d700ecd01943d1e47af57b5490`; roles: exported-object\n- sha256: `3c19c9d085f085252c974a1ae0637fa809cf09d3c461c64cbae6a011f7d0b78a`; roles: exported-object\n- sha256: `3cd1a2527c206665892f1e9837f4e7cff960d7e5fa9df017c7b49e84845c0097`; roles: exported-object\n- sha256: `4004293f081201ead3df6f86daa9d3974bde048ae8187cda602dffb256324124`; roles: exported-object\n- sha256: `46868c166bdd75230bd20064033f281d2d6ca30a512eee717871dac9da416955`; roles: exported-object\n- sha256: `4935fdc24e4a4873c078817732e45651c05091b946eff4fb774476a31d52e769`; roles: exported-object\n- sha256: `4e3d1cd476ae289fb9a9f4ce26b781659410914c81d11b4befc7735f4c71b2b1`; roles: exported-object\n- sha256: `517319eb8ff3d0b11dc60d148babdc714087e386977101e1d76428cdbff6b9c7`; roles: exported-object\n- sha256: `550ceb9559bb4237527909ff21e719804f6b9df337f741f756821c0c9963392b`; roles: exported-object\n- sha256: `561ffc13ce19398e938a84992b3791d95e9d6f7b904e3f79c9728dc0c23a8297`; roles: exported-object\n- sha256: `56bbf5dbefa7919f0b8666d9cfc272b0ddbc9e920a373c1ab701d960dc09ce3a`; roles: exported-object\n- sha256: `58c778f59b121390544d07cc4ff6948eb35045eafe376247ef285d4f72cfe167`; roles: exported-object\n- sha256: `5b107e17113a4c5a547d98a30bcd47aa3ad52317856828c762a67fda9f34baa0`; roles: exported-object\n- sha256: `5c9486d0aa62b50180e77e62b15f9977b3b0fd3f7d9b1f797de4c41b7da02b7d`; roles: exported-object\n- sha256: `5fedc714f715123098edf3d8ceffcc6f6c1d503513e3dee6077c0fb3a6fcdbec`; roles: exported-object\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- sha256: `61f39b4c6a88443103c0260f69dfc9484012f6bddad680b567c3ababcf416b4e`; roles: exported-object\n- sha256: `65f5df3cd45f3b8bf27731651a76b32bdef821fdb79451fa160ee55ff30467e2`; roles: exported-object\n- sha256: `6cba436e9e5adbe296a382ece4309eb469ec3a0d37d3b14058800f9fd57338ab`; roles: exported-object\n- sha256: `6f7307aed5e6e60222ef7d66e258362e1df71eabd5f7af0f33afa0fc6b8f65dd`; roles: exported-object\n- sha256: `71ea89144415bcb2ea2585d7a5ca95b27ab2a10d7f826647bee8c9e78922c5a5`; roles: exported-object\n- sha256: `72c3d8a0ee2408bcb595f51ec68806252c9b60a6be25b091f1d0a88655517f12`; roles: exported-object\n- sha256: `7796b5c1eb8d9c8a896b17db41ae969690f2924a8690439ac4d5511935b236c3`; roles: exported-object\n- sha256: `79ff1591234ea9434d7f96516781130625b1880ba4fa8eb965b278337e11f8ae`; roles: exported-object\n- sha256: `7bacd1e07f7de2e51fcd1eafbcd9ec0aaad5c16ac4c4d846a86a5654a00506b4`; roles: exported-object\n- sha256: `7df7e6f7c22f1938c2313beb743eb60040f607f2a703a5134c8842ce7e7946ab`; roles: exported-object\n- sha256: `7e0baff43a753a2dce0e85dbbd562a503c9f558f846784f3626c0b5d31c9d6d3`; roles: exported-object\n- sha256: `80bad0ee862dd92912bbecb161c17ce3d072b22aef1d48c3ab4c90f55939acae`; roles: exported-object\n- sha256: `8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015`; roles: exported-object\n- sha256: `833aae2efa9e7eb97334c8596c07bd22c09ffa2e771dc64fadcfa66d2ed2330e`; roles: exported-object\n- sha256: `86a4c543d749c972e930c08df70d17f81c7eae19ea9854476eda897fd33fbfc5`; roles: exported-object\n- sha256: `8768d73b262d33c7dceaedcbf83576d31129c8bef0d03be58e92a57a65bd81c2`; roles: exported-object\n- sha256: `8b6eb285d3afcd5e4d485846c70b442f4b6df4a636533493a6b45ff4808c8364`; roles: exported-object\n- sha256: `8ba51e69c99c8a2fee83d5cd85f86d044a51c9979f845ca6abf75901ad83f84c`; roles: exported-object\n- sha256: `9145ac411c9596c70f7a57d91ddf00f4888aae4d852209ed6efdf99afad1f904`; roles: exported-object\n- sha256: `9557385d62733e77c3bb5b473d9bb2fa29bd51f8b010d221cbefe8297a454291`; roles: exported-object\n- sha256: `97f149f146b0ec63c32abff204ae27638f0310536172b0f718f1a91a5672fe71`; roles: exported-object\n- sha256: `9a4e9990d71244aaa68b4bff6d5910665e7df9051cd4ee030e61b8e7f16180c1`; roles: exported-object\n- sha256: `9be5b65b630c074027b64f5544e24575e36aba498ee43b12167e82b40872e01f`; roles: exported-object\n- sha256: `9c086d962c942cff645dbd48b700191e96e3371b3d006e4eb3c7ac3c842057c9`; roles: exported-object\n- sha256: `9c16b72304e8dbf5ddce0e0614934eac07d641ef12c654398eda8df088f3c296`; roles: exported-object\n- sha256: `9d7c79b24ac12a185212ccab8741f4acdbd7ab160099e719bedd682806886ac9`; roles: exported-object\n- sha256: `a417a78e9d645ffa38f11bbcd1e4bdd0295bb71e5a7dfd692b3495dac2ef4107`; roles: exported-object\n- sha256: `a630dac9b5b0fbea3974ad09401522aeda12f11bbe5344508829d575c03cd644`; roles: exported-object\n- sha256: `aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c`; roles: exported-object\n- sha256: `ac508fa266db568a28c4e52d7dd1fcc85dbfdc38f97e39892e60f94d904e11d5`; roles: exported-object\n- sha256: `b24190e46072d124308b908776b21a50d4cefa396934bf5fb788bf26c2e67c33`; roles: exported-object\n- sha256: `b2aba18ac53e4abc1a631c98959e5411fc64efe761dbe216e1f559b1e2d7aef2`; roles: exported-object\n- sha256: `b43e75f48fa68b71ee6e66751c0c3822314ca6dc592fce9309495baada78de54`; roles: exported-object\n- sha256: `b5fcfa087b1cc0b1f61c17437c0a533c027dd68bb1e42898682bad189bacdf67`; roles: exported-object\n- sha256: `b729bb6d682bc3df8fb04c7a940b3da0140284811d168a92929cfec7232237be`; roles: exported-object\n- sha256: `b74056eea98bad621835b90b80499dad886c07ef70b5213bcde0408e63908c6f`; roles: exported-object\n- sha256: `b943dd2830226be743c9bfcb5ffa4eec591e55d09a736ffecdfd3d8b6581da31`; roles: exported-object\n- sha256: `bd9ea8a38face9cb05cb209900b16b09b3bda1c247ddd7d2e2c95a82a3615cd3`; roles: exported-object\n- sha256: `bfedb831c9a4afb407a127b04080c8f649d2134e713d4a1f810d9f670295cf7d`; roles: exported-object\n- sha256: `c4d8dbe77feb63e5a61bee0bead4e5f66e8fa6a927599bd1b74aced52467273c`; roles: exported-object\n- sha256: `c4e63117b5fac36c75799cae97f4f0464bd9d6978b442fe6cf28078d0be7ac31`; roles: exported-object\n- sha256: `c8e9a8b2cf530cc873941944744e8d053a34d2759194dae198e579c9e17399a2`; roles: exported-object\n- sha256: `ca0405f6832d0b1aaf7e5c00aa3241cccf19859dc47ca15ab3a90a9ffcbdf150`; roles: exported-object\n- sha256: `cbf768030ad75e8aec0263d9d2286c2b0106cf7ac4daa17396129b172a93d1a9`; roles: exported-object\n- sha256: `d2e3bd61e7e0d4f908192813267d98927cc31043d84387b1a941e3b5b15f9134`; roles: exported-object\n- sha256: `d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8`; roles: exported-object\n- sha256: `d60aea1fe282db3ac579713c98d24d46850375db28ccfec0793d10f275b860a5`; roles: exported-object\n- sha256: `d78b0583ff00e0b8e6caac5c236fdf795fd447208cfea7f23abd528a26a57674`; roles: exported-object\n- sha256: `d7db23ac49a03eb060bc6a928b5a9044218bed6c7add87406b8867f95938aef5`; roles: exported-object\n- sha256: `d9f5dfcc2555a6e6c530c190b3c6f1cac2a0af97b3689547713dc28bece0e7cd`; roles: exported-object\n- sha256: `da725c97aae07686110485c776b5ebb1733fb26674466d07417aa2ee3c0e09a9`; roles: exported-object\n- sha256: `e1f409fdaac72c188fa638ac4be1958322f1dfe8b2b7b076c4ff95f026f47a4f`; roles: exported-object\n- sha256: `e2f4ebe008e4e29b0695a4cf033f5bc45d5ab70ca43bf0873580a7c4fd500b96`; roles: exported-object\n- sha256: `e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a`; roles: exported-object\n- sha256: `ea34443271cb87b667af587dc8b344c211458dc0616abdf48a49b14c4fde9b1a`; roles: exported-object\n- sha256: `ea99682af1f2ca9bb54887a9cc1ced7c09b2f6d7feb277f2c3d6f3b57af25fc1`; roles: exported-object\n- sha256: `eac280b1fd4d84b2b386d93b51f9193c42f10fe9c3cb0dd1e67ebff66fd31952`; roles: exported-object\n- sha256: `ec8202663864f3744450858c1e5a51826427b7b7b082b5d182d7be0dc47f2c4e`; roles: exported-object\n- sha256: `ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8`; roles: exported-object\n- sha256: `f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5`; roles: exported-object\n- sha256: `f099877e9778681f5ca0c77b7f18b5aa675caa6d5cd50abc28dfe6136ac3b8ac`; roles: exported-object\n- sha256: `f4fbf7d12ec5db69f6a21a8323602fe7e8aa8c4f59baea6115fe1323c3e1358f`; roles: exported-object\n- sha256: `f9985bf8754e921e90a0c63e3458daf79c492f25bbaf3cf13bb14d18ca27fd5a`; roles: exported-object\n- sha256: `fb229f5700cae4392b42fe23e328ba5e697a7c84f4678670791a22ead70a9d09`; roles: exported-object\n- sha256: `fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c`; roles: exported-object\n- sha256: `ff7d32dd7321a2b3c5597c69caae82409019ac22e11ecc4530188d4e3b144302`; roles: exported-object\n- sha256: `ff8619dad2bbbf61330224649844a7ff7665785c3f174913729961d77ba5facc`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://dhsiwyqdlskwsqo.com/favicon.ico`; roles: http-request\n- url: `http://dhsiwyqdlskwsqo.com/images/oHxu3OjFB6DuXsB336/xwuexjnHY/P5VoU9fs1NStyMFZ_2FZ/6s8umkBGsQOSsZgZiqQ/Jnp65UJ_2B9Qq9qo_2BCxl/LpqyFXF9TVVz_/2BLffdp3/TW_2B64CmxBQ7r03un00c1o/B2mvu2ig9G/7GcZJn_2FNTO8/6Kwy7mw.avi`; roles: http-request\n- url: `http://dhsiwyqdlskwsqo.com/images/Owsg6NXtcG4F/aQTGTFRGYCk/mwdnmTGg8q5u_2/B23I8WXH1qhcd_2BC7kNQ/SplwlVD2F3jUMRCB/dTSK84tk3PapDt7/wErikpmrkQw2_2Bhba/FTtz6Avew/ty3DREXbyq083JlIg3zM/TEYrA_2BNXjAICO93pa/QGJ.avi`; roles: http-request\n- url: `http://dhsiwyqdlskwsqo.com/images/UIL_2BVxj_2FFv/cAgM9ZivBfYRBhzmpmqE8/gTexqC1Lh_2F0iW2/AATDXP0c4G4qcxV/_2FXAAoF8eHHNZ8c43/RrSntOi0N/4VTdgqIWbPwlUsd3uIxL/BZP_2Bzh085fEx639Yq/B1kvRr_2FOEM0k57tlZ1QS/8lw2Htym.avi`; roles: http-request\n- url: `http://ferranorga.net/img/client.rar`; roles: http-request\n- url: `http://shumbildac.com/WES/fatog.php?l=ngul5.xap`; roles: http-request\n- url: `http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab`; roles: http-request\n- url: `http://www.ferranorga.net/img/client.rar`; roles: http-request\n- url: `http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=2&utmn=1279953315&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Degrees%20%26%20Programs)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624866037&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~`; roles: http-request\n- url: `http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=3&utmn=1832691277&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Bachelor%270s%20Degrees)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624887589&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~`; roles: http-request\n- url: `http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=4&utmn=1892096743&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x446&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Bachelor%27s%20degrees%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=326256236&utmr=0&utmp=%2Fprograms%2Fundergraduate%2FPages%2Fdefault.aspx&utmht=1541624894067&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~`; roles: http-request\n- url: `http://www.google-analytics.com/ga.js`; roles: http-request\n- url: `http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=362717400&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624860490&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=408037419&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAQE~`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/1033/core.js?rev=Emb5hNX1RZMNXk9oS82yvA%3D%3D`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/1033/init.js?rev=wgiyW1GQqDQZTITaawvYoA%3D%3D`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/blank.js?rev=QGOYAJlouiWgFRlhHVlMKA%3D%3D`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/cui.js?rev=OOyJv78CADNBeet%2FvTvniQ%3D%3D`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/images/bgximg.png`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/images/fgimg.png`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/inplview.js?rev=WB6Gy8a027aeNCq7koVCUg%3D%3D`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/kwizcom.sharepoint.foundation/jquery.js?v=13.4.81&source=kwizcomsharepointutilities`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/kwizcom.sharepoint.foundation/kwizcom_jsutility.js?v=13.4.81&source=kwizcomsharepointutilities`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/kwizcom_aggregator/kwizcom_listaggregator.js?v=12.1.12&source=kwizcomsharepointutilities`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/KWizCom_Aggregator/loading.gif`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/mediaplayer.js?rev=Q6vfD9BNL%2B9PvwgrVEcc%2FA%3D%3D`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/ScriptResx.ashx?culture=en%2Dus&name=SP%2ERes&rev=b6%2FcRx1a6orhAQ%2FcF%2B0ytQ%3D%3D`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/sp.core.js?rev=7ByNlH%2BvcgRJg%2BRCctdC0w%3D%3D`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/sp.js?rev=%2B4ZEyA892P3T0504qi0paw%3D%3D`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/sp.ribbon.js?rev=F%2BUEJ66rbXzSvpf7nN69wQ%3D%3D`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/sp.runtime.js?rev=IGffcZfunndj0247nOxKVg%3D%3D`; roles: http-request\n- url: `http://www.ucdenver.edu/_layouts/sp.ui.dialog.js?rev=Tpcmo1%2FSu6R0yewHowDl5g%3D%3D`; roles: http-request\n- url: `http://www.ucdenver.edu/_vti_bin/sites.asmx`; roles: http-request\n- url: `http://www.ucdenver.edu/academics/colleges/CLAS/Departments/english/Programs/BachelorOfArts/BAEnglish/Pages/CreativeWriting.aspx`; roles: http-request\n- url: `http://www.ucdenver.edu/academics/degrees/_vti_bin/client.svc/ProcessQuery`; roles: http-request\n- url: `http://www.ucdenver.edu/Documents/WebParts2015Redesign/06InfoGraphic/image/factBack3.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/carousel.js`; roles: http-request\n- url: `http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/data.js`; roles: http-request\n- url: `http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-app.css`; roles: http-request\n- url: `http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-search-ng.js`; roles: http-request\n- url: `http://www.ucdenver.edu/Documents/WebParts2015Redesign/16HeroImage/images/ResearchRoundupHero.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/favicon.ico`; roles: http-request\n- url: `http://www.ucdenver.edu/Javascript%20Library/angular-animate.min.js`; roles: http-request\n- url: `http://www.ucdenver.edu/Javascript%20Library/angular.min.js`; roles: http-request\n- url: `http://www.ucdenver.edu/Javascript%20Library/jquery-1.11.3.min.js`; roles: http-request\n- url: `http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.css`; roles: http-request\n- url: `http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.js`; roles: http-request\n- url: `http://www.ucdenver.edu/Javascript%20Library/jquery.jcarousel.min.js`; roles: http-request\n- url: `http://www.ucdenver.edu/Javascript%20Library/responsive/jsBaseResponsive.js`; roles: http-request\n- url: `http://www.ucdenver.edu/Javascript%20Library/UCDJS.js`; roles: http-request\n- url: `http://www.ucdenver.edu/pages/ucdwelcomepage.aspx`; roles: http-request\n- url: `http://www.ucdenver.edu/programs/undergraduate`; roles: http-request\n- url: `http://www.ucdenver.edu/programs/undergraduate/Documents/Styles_Scripts/local.js`; roles: http-request\n- url: `http://www.ucdenver.edu/programs/undergraduate/Pages/_layouts/images/minus.gif`; roles: http-request\n- url: `http://www.ucdenver.edu/programs/undergraduate/Pages/default.aspx`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply_small.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_appStatus_small.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_calendar_small.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog_small.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_requestInfo.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit_small.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUAnschutz.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUDenver.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUSouth.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/Hero/48_hero.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/Testimonial/48_testimonial_kliese.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/CriticalPath/Testimonial/48_testimonial_klimper.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/cta-triple-buttons/cta2.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/balancedbudget.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/StCajetans-ig.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/ThreeGuys.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/whitepines.jpg`; roles: http-request\n- url: `http://www.ucdenver.edu/PublishingImages/UCDLayoutImages/searchButton.png`; roles: http-request\n- url: `http://www.ucdenver.edu/ScriptResource.axd?d=1QDyKS9h_RiM240HMbYjM6ODCJOKhzpWzUoeDZ16t3d487fp531Bj79wvRUTrpe40Sb2WC34BUqekTySkaN5JfKY-KmMcnh1StfQCVLNGKh9bApp04C1q9RX01pYhWwBp5cQe9b_UUDsH1MpnrV6Qpz6c1ILT-tGnGCdfhY6NJVDQZ2p0&t=2e2045e2`; roles: http-request\n- url: `http://www.ucdenver.edu/ScriptResource.axd?d=9di2kcBnRer6u7CuZUM7AfDDbzWMOK7upyNjbmE5Pdu3o5BHVtGXRC91MpdMm5XnQKxQdUdYrD0lcXagGlKdOSu2-gvQh1sQkr9VBx5eiph2ui3XCKHywHXzD91UpgfJQscXyag6PMfkkSUAwV5oTxM-pRGaKbplVIquRmAvCsECm7UwxgbHqr5oRifTbuwyorCrDIb3SKMarpQyLWAcwc1HYq01&t=3cb8783c`; roles: http-request\n- url: `http://www.ucdenver.edu/ScriptResource.axd?d=kbtxWN87DQ1VIylVprHAWnyKaGLTA4pXlXTHlCuJIMsMYgKaYAHacVcYWnfHdzexemLANVUTb9RCqYHuFVYEeMMivsq9U8GpgkkDFsA3RU3W-vDHMWw2gDPk5jSrhT-rAV4PHKkL432QiTzOJMscy2b0-_w-jLBdS2fQZi5KQMX9r-i8Y6ucvvNoN81ML1rcIiQZneq5Y7wGC-UMWsKoXE1IejlZ1LpGQdWma9ut0iUIFPwY0&t=3cb8783c`; roles: http-request\n- url: `http://www.ucdenver.edu/ScriptResource.axd?d=nDIPXhUC97iGOuHV1bSa3g9PgqtW-xIy12fJV_T8vVy7js2xrAy8ccqwmnXPgF-xNQgkyT7tmsbDKVfT8ifdxCFRXJAu8n8jnliYraK21_he0x3K2sbtAORIu3mC-DFdoxOp3B5OGN3NzbzrPG28T1haK-w1&t=2e2045e2`; roles: http-request\n- url: `http://www.ucdenver.edu/SiteCollectionImages/Logos/CUDenver_cuitc-300.png`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap-theme.min.css`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap.min.css`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/bootstrap334/fonts/glyphicons-halflings-regular.woff2`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/bootstrap334/js/bootstrap.min.js`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/corev4Anonymous.css`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/DDCthemes/BetaUCDenverTheme.css`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/DDCthemes/DDCthemeMain.css`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/facebook.png`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/googleplus.png`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/instagram.png`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/linkedin.png`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/QLtab.png`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/searchButton.png`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/twitter.png`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/youtube.png`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/leftChevron.gif`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/rightChevron.gif`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/fonts/fontawesome-fontfacekit/fontawesome-webfont.woff2?v=4.3.0`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-bold-webfont.woff2`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-light-webfont.woff2`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-regular-webfont.woff2`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/responsive/print.css`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/responsive/responsiveBase.css`; roles: http-request\n- url: `http://www.ucdenver.edu/Style%20Library/UCDenverTheme.css`; roles: http-request\n- url: `http://www.ucdenver.edu/WebResource.axd?d=nK66gdmZPDA-w-JjHyggjO_q5ZVRp7ooiUATeOMUtTMCTlfkvxq8mxRHybfWnA0Swfdbv1YBCieMhY76WgB3McU0Erit7tpi9kGXDOtvazCF8h1BLSyM9r_pT9xkzGtAoB6i_bw2w0dM46xzuwSmUZ9Il-pR8sIBMDjV6n64EKHYbfoJqQA9doUWhsRbzsGCzJ1g7D2-gJrdDaKQJ1H6GipIFEoKwv_UCr3VeSqOsCEXfpiHtt2ZR-Y3UW4oyGmrVOioeA2&t=635701215589701395`; roles: http-request\n- url: `http://www.ucdenver.edu/WebResource.axd?d=Rr8OZckqtIG1LFJTmW4ygCZ8tMHeGI9-qww7ZH6tsHUf-5ACqmhwY6jnlnidSHBrgMkq7on6x9smildQ9krSVOW4yk41&t=636271455501517547`; roles: http-request\n- user_agent: `Google Chrome/67.0.3396.99 Windows`; roles: http-client\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/6.1`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko`; roles: http-client\n- exported object `fatog.php%3fl=ngul5.xap`; SHA-256 `97f149f146b0ec63c32abff204ae27638f0310536172b0f718f1a91a5672fe71`; size 439808 bytes\n SHA-1: `069089c8c5d61b646f1cdb8ecb26b28b2a181dd4`; MD5: `0d7a18ff70d35c8ae1806363ccd862d9`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1247,\"response_frame\":1690,\"server_ip\":\"46.29.160.132\",\"status_code\":\"200\",\"tcp_stream\":51,\"url\":\"http://shumbildac.com/WES/fatog.php?l=ngul5.xap\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `ScriptResource.axd%3fd=kbtxWN87DQ1VIylVprHAWnyKaGLTA4pXlXTHlCuJIMsMYgKaYAHacVcYWnfHdzexemLANVUTb9RCqYHuFVYEeMMivsq9U8GpgkkDFsA3RU3W-vDHMWw2gDPk5jSrhT-rAV4PHKkL432QiTzOJMscy2b0-_w-jLBdS2fQZi5KQMX9r-i8Y6ucvvNoN81ML1rcIiQZneq5Y7wGC-UMWsKoXE1IejlZ1LpGQdWma9ut`; SHA-256 `d9f5dfcc2555a6e6c530c190b3c6f1cac2a0af97b3689547713dc28bece0e7cd`; size 395537 bytes\n SHA-1: `43059e8a73310bccc741da1bdc8cbae7a3784e5c`; MD5: `ee0077f443c296f57b4f87714ab8e5bd`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8235,\"response_frame\":8488,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.ucdenver.edu/ScriptResource.axd?d=kbtxWN87DQ1VIylVprHAWnyKaGLTA4pXlXTHlCuJIMsMYgKaYAHacVcYWnfHdzexemLANVUTb9RCqYHuFVYEeMMivsq9U8GpgkkDFsA3RU3W-vDHMWw2gDPk5jSrhT-rAV4PHKkL432QiTzOJMscy2b0-_w-jLBdS2fQZi5KQMX9r-i8Y6ucvvNoN81ML1rcIiQZneq5Y7wGC-UMWsKoXE1IejlZ1LpGQdWma9ut0iUIFPwY0&t=3cb8783c\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":6988}],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `cui.js%3frev=OOyJv78CADNBeet%2FvTvniQ%3D%3D`; SHA-256 `b74056eea98bad621835b90b80499dad886c07ef70b5213bcde0408e63908c6f`; size 352107 bytes\n SHA-1: `7e7046e27f4293826af66ad614821318619bec1c`; MD5: `38ec89bfbf0200334179eb7fbd3be789`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6583,\"response_frame\":6779,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/_layouts/cui.js?rev=OOyJv78CADNBeet%2FvTvniQ%3D%3D\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":6393}],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `core.js%3frev=Emb5hNX1RZMNXk9oS82yvA%3D%3D`; SHA-256 `5b107e17113a4c5a547d98a30bcd47aa3ad52317856828c762a67fda9f34baa0`; size 239740 bytes\n SHA-1: `1e685f7667344b7a062a0d0a78c427b5571f32cf`; MD5: `1266f984d5f545930d5e4f684bcdb2bc`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6577,\"response_frame\":6896,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/_layouts/1033/core.js?rev=Emb5hNX1RZMNXk9oS82yvA%3D%3D\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":49984}],\"inspected_bytes\":239740,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":239740,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `sp.ribbon.js%3frev=F%2BUEJ66rbXzSvpf7nN69wQ%3D%3D`; SHA-256 `cbf768030ad75e8aec0263d9d2286c2b0106cf7ac4daa17396129b172a93d1a9`; size 212665 bytes\n SHA-1: `f763b752439699f99c18b63ed9b41e86f87f7720`; MD5: `17e50427aeab6d7cd2be97fb9cdebdc1`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6930,\"response_frame\":6985,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/_layouts/sp.ribbon.js?rev=F%2BUEJ66rbXzSvpf7nN69wQ%3D%3D\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":19039}],\"inspected_bytes\":212665,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":212665,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `angular.min.js`; SHA-256 `79ff1591234ea9434d7f96516781130625b1880ba4fa8eb965b278337e11f8ae`; size 125496 bytes\n SHA-1: `979143a6b10532413aefba462844d59df29fb2c1`; MD5: `b1137641dbb512a60e83d673f7e2d98f`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4749,\"response_frame\":4932,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.ucdenver.edu/Javascript%20Library/angular.min.js\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":59828}],\"inspected_bytes\":125496,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":125496,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `init.js%3frev=wgiyW1GQqDQZTITaawvYoA%3D%3D`; SHA-256 `3c19c9d085f085252c974a1ae0637fa809cf09d3c461c64cbae6a011f7d0b78a`; size 118049 bytes\n SHA-1: `922108175799fd47cc5fe1a2ca38be4f9e7087a8`; MD5: `c208b25b5190a834194c84da6b0bd8a0`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4947,\"response_frame\":5045,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.ucdenver.edu/_layouts/1033/init.js?rev=wgiyW1GQqDQZTITaawvYoA%3D%3D\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":1560}],\"inspected_bytes\":118049,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":118049,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ucdwelcomepage.aspx`; SHA-256 `65f5df3cd45f3b8bf27731651a76b32bdef821fdb79451fa160ee55ff30467e2`; size 100612 bytes\n SHA-1: `166c78fb3f2613db7638ddf89cacbd0680851004`; MD5: `2eb6bcc2c4ba5640b3ff52ec7b4bc754`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4552,\"response_frame\":4634,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/pages/ucdwelcomepage.aspx\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":91238}],\"inspected_bytes\":100612,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":100612,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ScriptResource.axd%3fd=nDIPXhUC97iGOuHV1bSa3g9PgqtW-xIy12fJV_T8vVy7js2xrAy8ccqwmnXPgF-xNQgkyT7tmsbDKVfT8ifdxCFRXJAu8n8jnliYraK21_he0x3K2sbtAORIu3mC-DFdoxOp3B5OGN3NzbzrPG28T1haK-w1&t=2e2045e2`; SHA-256 `20f3807f724bf5bb6c8a2cf7f62bc8003717104ef480c7dfd1b8dab767144bbc`; size 99507 bytes\n SHA-1: `489529fbd74b8446b3dddfc9ae3cd0d3667f8247`; MD5: `194f1c9a31ff997e04633db4b1915ea7`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4958,\"response_frame\":5137,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":107,\"url\":\"http://www.ucdenver.edu/ScriptResource.axd?d=nDIPXhUC97iGOuHV1bSa3g9PgqtW-xIy12fJV_T8vVy7js2xrAy8ccqwmnXPgF-xNQgkyT7tmsbDKVfT8ifdxCFRXJAu8n8jnliYraK21_he0x3K2sbtAORIu3mC-DFdoxOp3B5OGN3NzbzrPG28T1haK-w1&t=2e2045e2\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":19484}],\"inspected_bytes\":99507,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":99507,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `sp.runtime.js%3frev=IGffcZfunndj0247nOxKVg%3D%3D`; SHA-256 `185f2b901d68c7451a492d90ed38aa2c1de840061735a06836c2587f958ed31c`; size 68791 bytes\n SHA-1: `31b4432149e18697d245b9bf725f98266a9a2487`; MD5: `2067df7197ee9e7763d36e3b9cec4a56`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6742,\"response_frame\":6796,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/_layouts/sp.runtime.js?rev=IGffcZfunndj0247nOxKVg%3D%3D\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":35580}],\"inspected_bytes\":68791,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":68791,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `inplview.js%3frev=WB6Gy8a027aeNCq7koVCUg%3D%3D`; SHA-256 `b43e75f48fa68b71ee6e66751c0c3822314ca6dc592fce9309495baada78de54`; size 39575 bytes\n SHA-1: `e169cf57d95e184c7a2665bbdf50a60278fe4910`; MD5: `581e86cbc6b4dbb69e342abb92854252`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6905,\"response_frame\":6928,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/_layouts/inplview.js?rev=WB6Gy8a027aeNCq7koVCUg%3D%3D\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":3531}],\"inspected_bytes\":39575,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":39575,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ScriptResource.axd%3fd=1QDyKS9h_RiM240HMbYjM6ODCJOKhzpWzUoeDZ16t3d487fp531Bj79wvRUTrpe40Sb2WC34BUqekTySkaN5JfKY-KmMcnh1StfQCVLNGKh9bApp04C1q9RX01pYhWwBp5cQe9b_UUDsH1MpnrV6Qpz6c1ILT-tGnGCdfhY6NJVDQZ2p0&t=2e2045e2`; SHA-256 `0c6da6b5d4f5db2accb9c1847cd2686c683d0875750b069f14339c5f75c93029`; size 32257 bytes\n SHA-1: `842c122b22a28e3e548b7abdf3136bdfc115535d`; MD5: `8f8b70b1e74c8d1175669cd683908cce`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4975,\"response_frame\":5006,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/ScriptResource.axd?d=1QDyKS9h_RiM240HMbYjM6ODCJOKhzpWzUoeDZ16t3d487fp531Bj79wvRUTrpe40Sb2WC34BUqekTySkaN5JfKY-KmMcnh1StfQCVLNGKh9bApp04C1q9RX01pYhWwBp5cQe9b_UUDsH1MpnrV6Qpz6c1ILT-tGnGCdfhY6NJVDQZ2p0&t=2e2045e2\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":24025}],\"inspected_bytes\":32257,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":32257,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `kwizcom_listaggregator.js%3fv=12.1.12&source=kwizcomsharepointutilities`; SHA-256 `8768d73b262d33c7dceaedcbf83576d31129c8bef0d03be58e92a57a65bd81c2`; size 4286 bytes\n SHA-1: `39fc350d7882fa5ecbfaa2efbaa362bb79feb459`; MD5: `3821071717e97ef12ee581c3ade0bd0b`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8190,\"response_frame\":8264,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":107,\"url\":\"http://www.ucdenver.edu/_layouts/kwizcom_aggregator/kwizcom_listaggregator.js?v=12.1.12&source=kwizcomsharepointutilities\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":2442}],\"inspected_bytes\":4286,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":4286,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ProcessQuery(1)`; SHA-256 `ea34443271cb87b667af587dc8b344c211458dc0616abdf48a49b14c4fde9b1a`; size 1029395 bytes\n SHA-1: `b8b5065cde744e3ded6e3046f69d2c6c4a8f2051`; MD5: `578b5f38fa9421b75ccf3e389123fec8`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6900,\"response_frame\":8048,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/academics/degrees/_vti_bin/client.svc/ProcessQuery\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `sp.js%3frev=%2B4ZEyA892P3T0504qi0paw%3D%3D`; SHA-256 `009d4cdb69f30688198c7a19b25ef0667c5f7b172d65b2273ed2274bc8eb5425`; size 390757 bytes\n SHA-1: `cb31a3a636846eb98219eae2b139681b36f685de`; MD5: `fb8644c80f3dd8fdd3d39d38aa2d296b`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6798,\"response_frame\":6884,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/_layouts/sp.js?rev=%2B4ZEyA892P3T0504qi0paw%3D%3D\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `jquery.js%3fv=13.4.81&source=kwizcomsharepointutilities`; SHA-256 `e2f4ebe008e4e29b0695a4cf033f5bc45d5ab70ca43bf0873580a7c4fd500b96`; size 367729 bytes\n SHA-1: `af8a56df21aea636ec85909e897f667da0adc1d6`; MD5: `685f18142f2c3ebeea24931e52f65611`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8188,\"response_frame\":8558,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/_layouts/kwizcom.sharepoint.foundation/jquery.js?v=13.4.81&source=kwizcomsharepointutilities\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `default.aspx`; SHA-256 `c4e63117b5fac36c75799cae97f4f0464bd9d6978b442fe6cf28078d0be7ac31`; size 280766 bytes\n SHA-1: `a23b33289aa3fb5d524099dd6418953e6d9981f2`; MD5: `3b5dbf2790a764887324092e720da8db`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8111,\"response_frame\":8457,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/programs/undergraduate/Pages/default.aspx\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `6Kwy7mw.avi`; SHA-256 `6f7307aed5e6e60222ef7d66e258362e1df71eabd5f7af0f33afa0fc6b8f65dd`; size 271796 bytes\n SHA-1: `5b8ea12d5a17179398a73c4fee9c4c39c85e590a`; MD5: `cbf1955b2515491ea790263c051ee833`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1955,\"response_frame\":2224,\"server_ip\":\"192.162.244.171\",\"status_code\":\"200\",\"tcp_stream\":56,\"url\":\"http://dhsiwyqdlskwsqo.com/images/oHxu3OjFB6DuXsB336/xwuexjnHY/P5VoU9fs1NStyMFZ_2FZ/6s8umkBGsQOSsZgZiqQ/Jnp65UJ_2B9Qq9qo_2BCxl/LpqyFXF9TVVz_/2BLffdp3/TW_2B64CmxBQ7r03un00c1o/B2mvu2ig9G/7GcZJn_2FNTO8/6Kwy7mw.avi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `jquery-ui.min.js`; SHA-256 `c4d8dbe77feb63e5a61bee0bead4e5f66e8fa6a927599bd1b74aced52467273c`; size 240427 bytes\n SHA-1: `7f650ee30c6a4d3eea04032039b20ff72997559b`; MD5: `d935d506ae9c8dd9e0f96706fbb91f65`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4676,\"response_frame\":5074,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":240427,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `QGJ.avi`; SHA-256 `bd9ea8a38face9cb05cb209900b16b09b3bda1c247ddd7d2e2c95a82a3615cd3`; size 213772 bytes\n SHA-1: `e89e806ed86afd326360d344393e49b8f2d6a292`; MD5: `bbcb25743f038ae385e6784df64a92dd`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1734,\"response_frame\":1936,\"server_ip\":\"192.162.244.171\",\"status_code\":\"200\",\"tcp_stream\":53,\"url\":\"http://dhsiwyqdlskwsqo.com/images/Owsg6NXtcG4F/aQTGTFRGYCk/mwdnmTGg8q5u_2/B23I8WXH1qhcd_2BC7kNQ/SplwlVD2F3jUMRCB/dTSK84tk3PapDt7/wErikpmrkQw2_2Bhba/FTtz6Avew/ty3DREXbyq083JlIg3zM/TEYrA_2BNXjAICO93pa/QGJ.avi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":213772,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `corev4Anonymous.css`; SHA-256 `158494850d445b90585ee2d25e2969b3218808ccb0897c79ca240f7c3556d92b`; size 191641 bytes\n SHA-1: `4ec960b513f24005f682caea8cd860a2d010e284`; MD5: `941e520a7bfa69987b3a5dd2e4467c75`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4577,\"response_frame\":4746,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.ucdenver.edu/Style%20Library/corev4Anonymous.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":191641,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ResearchRoundupHero.jpg`; SHA-256 `5fedc714f715123098edf3d8ceffcc6f6c1d503513e3dee6077c0fb3a6fcdbec`; size 160555 bytes\n SHA-1: `f440922d300ca0cc6920f610cbdec7945868fd73`; MD5: `e182f3e055d8ece50cffe7949b99def3`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5333,\"response_frame\":5986,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":107,\"url\":\"http://www.ucdenver.edu/Documents/WebParts2015Redesign/16HeroImage/images/ResearchRoundupHero.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":160555,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `cta2.jpg`; SHA-256 `9c16b72304e8dbf5ddce0e0614934eac07d641ef12c654398eda8df088f3c296`; size 136688 bytes\n SHA-1: `06c7a45073c727f6cce113501a8c5c4a09a03bb1`; MD5: `c551699eb0b74235d61fdf3b0b894cea`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8645,\"response_frame\":8990,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/PublishingImages/cta-triple-buttons/cta2.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":136688,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `degree-search-ng.js`; SHA-256 `ff8619dad2bbbf61330224649844a7ff7665785c3f174913729961d77ba5facc`; size 134598 bytes\n SHA-1: `a24362d14498169bba661a640e205e24c18b652a`; MD5: `2178dd0b8e1e170216ca88fa2b392d6a`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5129,\"response_frame\":5156,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-search-ng.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":134598,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `48_hero.jpg`; SHA-256 `833aae2efa9e7eb97334c8596c07bd22c09ffa2e771dc64fadcfa66d2ed2330e`; size 118604 bytes\n SHA-1: `b9732a1ac524e256d1b47cd143f569a6974b6bf4`; MD5: `511141c05e0007a91f2d5c607a3dab40`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8621,\"response_frame\":8924,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/Hero/48_hero.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":118604,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `bootstrap.min.css`; SHA-256 `f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5`; size 117305 bytes\n SHA-1: `ed29315e0ffb3f14382431f2724235bf67f44eb3`; MD5: `eedf9ee80c2faa4e1b9ab9017cdfcb88`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4581,\"response_frame\":4756,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap.min.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":117305,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `factBack3.jpg`; SHA-256 `d78b0583ff00e0b8e6caac5c236fdf795fd447208cfea7f23abd528a26a57674`; size 111343 bytes\n SHA-1: `340eeb822811b2d3a55fe85ce1754f1c36885925`; MD5: `b569e44adb642079d0290bff71aa4dfc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6005,\"response_frame\":6396,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/Documents/WebParts2015Redesign/06InfoGraphic/image/factBack3.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":111343,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `DDCthemeMain.css`; SHA-256 `e1f409fdaac72c188fa638ac4be1958322f1dfe8b2b7b076c4ff95f026f47a4f`; size 103489 bytes\n SHA-1: `b98bb1668188a8b195b024656f7d3519b82eece0`; MD5: `f8b24fe0f24cbf5407d78ce2a2319bb6`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5158,\"response_frame\":5193,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/Style%20Library/DDCthemes/DDCthemeMain.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":103489,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `jquery-1.11.3.min.js`; SHA-256 `ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8`; size 95957 bytes\n SHA-1: `276c87ff3e1e3155679c318938e74e5c1b76d809`; MD5: `895323ed2f7258af4fae2c738c8aea49`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4668,\"response_frame\":4951,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":107,\"url\":\"http://www.ucdenver.edu/Javascript%20Library/jquery-1.11.3.min.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":95957,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `BetaUCDenverTheme.css`; SHA-256 `05d5af0ab07517396f53c3e161f0ebc23c09242eae0c2372d7da26dd5786953e`; size 87318 bytes\n SHA-1: `7f59cc9ecbbabd8138f83316b10233a5303f6d89`; MD5: `17101650557ebf72d18d9673bc66bd1b`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4615,\"response_frame\":4793,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/Style%20Library/UCDenverTheme.css\"},{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8152,\"response_frame\":8214,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/Style%20Library/DDCthemes/BetaUCDenverTheme.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":87318,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `StCajetans-ig.jpg`; SHA-256 `36d8e52a141bc54658ed41dde1654343bbd008af29f889f6e0a2f41441457ba6`; size 76601 bytes\n SHA-1: `c6cf7eb6d1e431a07d54ed57af5abc67b99fa9d8`; MD5: `167ad817553a45fc00b25ebbbabc74a0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5495,\"response_frame\":5882,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/StCajetans-ig.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":76601,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `cta_visit.jpg`; SHA-256 `d7db23ac49a03eb060bc6a928b5a9044218bed6c7add87406b8867f95938aef5`; size 75852 bytes\n SHA-1: `76aaa3f1af267083d287fa877868b59ef0411c22`; MD5: `2a81d3eb8b0f17453068a572284ba4d7`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5998,\"response_frame\":6326,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":75852,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `whitepines.jpg`; SHA-256 `b729bb6d682bc3df8fb04c7a940b3da0140284811d168a92929cfec7232237be`; size 67070 bytes\n SHA-1: `5bfa0670eb1daeec221d6634b26de09c807d62f5`; MD5: `3aa6eeb31d2c07b2128d8cc2b6a9a075`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5471,\"response_frame\":5836,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/whitepines.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":67070,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `fontawesome-webfont.woff2%3fv=4.3.0`; SHA-256 `aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c`; size 56780 bytes\n SHA-1: `1075231650f579955905bb2f6527148a8e2b4b16`; MD5: `97493d3f11c0a3bd5cbd959f5d19b699`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5262,\"response_frame\":5545,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/Style%20Library/fonts/fontawesome-fontfacekit/fontawesome-webfont.woff2?v=4.3.0\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":56780,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `authrootstl.cab`; SHA-256 `9c086d962c942cff645dbd48b700191e96e3371b3d006e4eb3c7ac3c842057c9`; size 55583 bytes\n SHA-1: `8c53968f786b3d343d375c4b77aeab85ee464a02`; MD5: `54e559cef8146fe9aa8b5ba30ca4f6aa`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2270,\"response_frame\":2325,\"server_ip\":\"72.246.64.147\",\"status_code\":\"200\",\"tcp_stream\":58,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":55583,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ThreeGuys.jpg`; SHA-256 `2976d80beac91eed779d1f204cb2e1be813c53bb2e1dfe03334f2c30b4f995be`; size 55028 bytes\n SHA-1: `42c07a3a0d13f7d3e56fb39de1c2daac833d7f53`; MD5: `fac48a4f4e9cd3a292e2f885897a423f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5385,\"response_frame\":5824,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/ThreeGuys.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":55028,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ScriptResource.axd%3fd=9di2kcBnRer6u7CuZUM7AfDDbzWMOK7upyNjbmE5Pdu3o5BHVtGXRC91MpdMm5XnQKxQdUdYrD0lcXagGlKdOSu2-gvQh1sQkr9VBx5eiph2ui3XCKHywHXzD91UpgfJQscXyag6PMfkkSUAwV5oTxM-pRGaKbplVIquRmAvCsECm7UwxgbHqr5oRifTbuwyorCrDIb3SKMarpQyLWAcwc1HYq01&t=3cb8783c`; SHA-256 `8b6eb285d3afcd5e4d485846c70b442f4b6df4a636533493a6b45ff4808c8364`; size 52214 bytes\n SHA-1: `a5f0dcf5d2cb6cf053f5f6462aa8021955f405e2`; MD5: `38f5de1aab7cfae54d81aecdc074979a`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8216,\"response_frame\":8286,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/ScriptResource.axd?d=9di2kcBnRer6u7CuZUM7AfDDbzWMOK7upyNjbmE5Pdu3o5BHVtGXRC91MpdMm5XnQKxQdUdYrD0lcXagGlKdOSu2-gvQh1sQkr9VBx5eiph2ui3XCKHywHXzD91UpgfJQscXyag6PMfkkSUAwV5oTxM-pRGaKbplVIquRmAvCsECm7UwxgbHqr5oRifTbuwyorCrDIb3SKMarpQyLWAcwc1HYq01&t=3cb8783c\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":52214,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ga.js`; SHA-256 `1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f`; size 46274 bytes\n SHA-1: `2c7d19d1af7d97085c977d1b69dcb8b84483d87c`; MD5: `e9372f0ebbcf71f851e3d321ef2a8e5a`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5284,\"response_frame\":5363,\"server_ip\":\"216.58.192.46\",\"status_code\":\"200\",\"tcp_stream\":109,\"url\":\"http://www.google-analytics.com/ga.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":46274,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `cta_requestInfo.jpg`; SHA-256 `7796b5c1eb8d9c8a896b17db41ae969690f2924a8690439ac4d5511935b236c3`; size 45067 bytes\n SHA-1: `0d97bcaf7e07f06220bfeeb4e290f0701490287e`; MD5: `5c43a2dd877fdf08938c39ebb562c062`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6000,\"response_frame\":6115,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_requestInfo.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":45067,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `cta_apply.jpg`; SHA-256 `71ea89144415bcb2ea2585d7a5ca95b27ab2a10d7f826647bee8c9e78922c5a5`; size 42810 bytes\n SHA-1: `f51fcbbd82b907bc1a75ca76f34b650c0f5e6510`; MD5: `e181fc183f2ea004fcfb3854a1a25677`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5996,\"response_frame\":6286,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":107,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":42810,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `responsiveBase.css`; SHA-256 `9145ac411c9596c70f7a57d91ddf00f4888aae4d852209ed6efdf99afad1f904`; size 42618 bytes\n SHA-1: `11080f312075fdfe71d0171c8f4fcff5c28f3002`; MD5: `bed523eb224f90a742576122ea869933`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4593,\"response_frame\":4666,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":107,\"url\":\"http://www.ucdenver.edu/Style%20Library/responsive/responsiveBase.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":42618,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `cta_catalog.jpg`; SHA-256 `80bad0ee862dd92912bbecb161c17ce3d072b22aef1d48c3ab4c90f55939acae`; size 36669 bytes\n SHA-1: `4a34a11c619191b9429c463b10599259856a9380`; MD5: `a4d69ca888d5bf713ae1cc32438d3846`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8673,\"response_frame\":8848,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":36669,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `bootstrap.min.js`; SHA-256 `d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8`; size 35951 bytes\n SHA-1: `253711c6d825de55a8360552573be950da180614`; MD5: `8c237312864d2e4c4f03544cd4f9b195`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4710,\"response_frame\":4786,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/Style%20Library/bootstrap334/js/bootstrap.min.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":35951,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `sp.ui.dialog.js%3frev=Tpcmo1%2FSu6R0yewHowDl5g%3D%3D`; SHA-256 `517319eb8ff3d0b11dc60d148babdc714087e386977101e1d76428cdbff6b9c7`; size 34270 bytes\n SHA-1: `bf01508864677f84ac2d0b2a3798e64c3200c7b6`; MD5: `4e9726a35fd2bba474c9ec07a300e5e6`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6601,\"response_frame\":6740,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/_layouts/sp.ui.dialog.js?rev=Tpcmo1%2FSu6R0yewHowDl5g%3D%3D\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":34270,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `jquery-ui.min.css`; SHA-256 `550ceb9559bb4237527909ff21e719804f6b9df337f741f756821c0c9963392b`; size 30163 bytes\n SHA-1: `69731223ffe4f669444e96f24c54811015e6a776`; MD5: `26812a28850395f8f865be4893fb20c7`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4589,\"response_frame\":4674,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":30163,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `balancedbudget.jpg`; SHA-256 `02717a94a92b22f6715c10f1483a4b252f61bd705675ae250af5411ff01de437`; size 30137 bytes\n SHA-1: `a4b053d1a463168dc9977c8868a274f9b67d2887`; MD5: `90bad03bf38180eae7bcb12ad3f1c38f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5412,\"response_frame\":5626,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/balancedbudget.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":30137,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `jsBaseResponsive.js`; SHA-256 `10570ac15a02224c4743309c48c8b8eefeaa931d9f1db7238edd7b3fa6cd2ff7`; size 24410 bytes\n SHA-1: `8ca82252af57d189dd7671707bb0d9c7260acebc`; MD5: `0ca32fe2b6de1f7955f35e19b5acd9d4`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4794,\"response_frame\":4897,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/Javascript%20Library/responsive/jsBaseResponsive.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":24410,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `sourcesanspro-regular-webfont.woff2`; SHA-256 `b24190e46072d124308b908776b21a50d4cefa396934bf5fb788bf26c2e67c33`; size 23752 bytes\n SHA-1: `8e70fdb2aa589220c406c24dc61607fc67bbe68e`; MD5: `28100116629515464ac5caa36fadb59a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5210,\"response_frame\":5326,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":107,\"url\":\"http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-regular-webfont.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":23752,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `sourcesanspro-light-webfont.woff2`; SHA-256 `ac508fa266db568a28c4e52d7dd1fcc85dbfdc38f97e39892e60f94d904e11d5`; size 23668 bytes\n SHA-1: `16a5d07663800b7908fcc91f31078b8670c77d24`; MD5: `574022706b4fdbe3be99831b512965ef`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5272,\"response_frame\":5397,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-light-webfont.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":23668,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `sourcesanspro-bold-webfont.woff2`; SHA-256 `3cd1a2527c206665892f1e9837f4e7cff960d7e5fa9df017c7b49e84845c0097`; size 23508 bytes\n SHA-1: `5b2836784a6506bf667bf96475d0b4cd1c933d90`; MD5: `7d3b66076a35890b4066b4ca0350afaa`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5247,\"response_frame\":5353,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-bold-webfont.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":23508,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `angular-animate.min.js`; SHA-256 `190a90d96675f28bb6ab1bab072f3b61ec321af3a8c3843a70248d9bb71bcdfe`; size 23337 bytes\n SHA-1: `595690ffdc79ccba093782cec93a3192659231fd`; MD5: `788cf11a27c39502bbcfbb7baaa04189`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4768,\"response_frame\":4869,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/Javascript%20Library/angular-animate.min.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":23337,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `WebResource.axd%3fd=Rr8OZckqtIG1LFJTmW4ygCZ8tMHeGI9-qww7ZH6tsHUf-5ACqmhwY6jnlnidSHBrgMkq7on6x9smildQ9krSVOW4yk41&t=636271455501517547`; SHA-256 `0ba2f6756001669bdf934f9d79e8fd1ccf2028130c33a0510279581ec9dfd73a`; size 20794 bytes\n SHA-1: `2987e7c40ce780293b3cdd39c4ad491f471bccee`; MD5: `eac91542a05209478107c4a3725ce29c`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4888,\"response_frame\":4992,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/WebResource.axd?d=Rr8OZckqtIG1LFJTmW4ygCZ8tMHeGI9-qww7ZH6tsHUf-5ACqmhwY6jnlnidSHBrgMkq7on6x9smildQ9krSVOW4yk41&t=636271455501517547\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":20794,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `fgimg.png`; SHA-256 `4004293f081201ead3df6f86daa9d3974bde048ae8187cda602dffb256324124`; size 20115 bytes\n SHA-1: `599d252cbb0ff0d16eafc0ce09526bf322f260e7`; MD5: `a621eac32d4fa685b60de7c01c648dc8`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4994,\"response_frame\":5120,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/_layouts/images/fgimg.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":20115,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `bootstrap-theme.min.css`; SHA-256 `2453e31f9c5e0dbee528d11f97a85edf897ed93406954ce8e475f0244abf249a`; size 19963 bytes\n SHA-1: `fc6b4268fbd57ad95d2b41a1d4d6866f222fbdb2`; MD5: `89b29714ad4aaaa3953ef3b51cf9c43a`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4585,\"response_frame\":4614,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap-theme.min.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":19963,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `48_testimonial_klimper.jpg`; SHA-256 `198f44920d0d51bc49281f580acc760fd88a96e2422c8784114df6dab93ecc09`; size 19117 bytes\n SHA-1: `4f89047e6fbf66831401156b3c3e6657e43d06ce`; MD5: `73c4b7583e32cb9722a428f418318f01`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8579,\"response_frame\":8643,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/Testimonial/48_testimonial_klimper.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":19117,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `jquery.jcarousel.min.js`; SHA-256 `4935fdc24e4a4873c078817732e45651c05091b946eff4fb774476a31d52e769`; size 18123 bytes\n SHA-1: `c7234015bf72349e7af55cf5c20a868aadc2dbf5`; MD5: `75bf8407996a0507b808690d4165f83a`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4788,\"response_frame\":4886,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/Javascript%20Library/jquery.jcarousel.min.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":18123,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `glyphicons-halflings-regular.woff2`; SHA-256 `fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c`; size 18028 bytes\n SHA-1: `ca35b697d99cae4d1b60f2d60fcd37771987eb07`; MD5: `448c34a56d699c29117adc64c43affeb`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8059,\"response_frame\":8079,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/Style%20Library/bootstrap334/fonts/glyphicons-halflings-regular.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":18028,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `48_testimonial_kliese.jpg`; SHA-256 `398cea3dc83051c117a65a9897bd17c84dace5d700ecd01943d1e47af57b5490`; size 16805 bytes\n SHA-1: `d2d6ef4a3570420e47ff85916f108b6c8e9e2b92`; MD5: `9ab36723052e138649a588f59370eadd`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8581,\"response_frame\":8607,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/Testimonial/48_testimonial_kliese.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":16805,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `mediaplayer.js%3frev=Q6vfD9BNL%2B9PvwgrVEcc%2FA%3D%3D`; SHA-256 `7e0baff43a753a2dce0e85dbbd562a503c9f558f846784f3626c0b5d31c9d6d3`; size 16377 bytes\n SHA-1: `48dd0059a18f737669bc17f482dabab954ff172f`; MD5: `43abdf0fd04d2fef4fbf082b54471cfc`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6903,\"response_frame\":6912,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/_layouts/mediaplayer.js?rev=Q6vfD9BNL%2B9PvwgrVEcc%2FA%3D%3D\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":16377,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ScriptResx.ashx%3fculture=en%2Dus&name=SP%2ERes&rev=b6%2FcRx1a6orhAQ%2FcF%2B0ytQ%3D%3D`; SHA-256 `ec8202663864f3744450858c1e5a51826427b7b7b082b5d182d7be0dc47f2c4e`; size 14312 bytes\n SHA-1: `9d0492478aeb1e645e3ea1113633c22479743207`; MD5: `d47862735c2dbdb3a7f6b585cdc7994a`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6581,\"response_frame\":6599,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/_layouts/ScriptResx.ashx?culture=en%2Dus&name=SP%2ERes&rev=b6%2FcRx1a6orhAQ%2FcF%2B0ytQ%3D%3D\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14312,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `CUAnschutz.jpg`; SHA-256 `19fda88c2df63d85b7762799904408d0703f7efe7d6956d70c776458075747f3`; size 13648 bytes\n SHA-1: `1c659042b232a20ed23663fda6433407822dcb96`; MD5: `2df4d4b1c6b2ce3b4ecc7f7dd10bf028`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5201,\"response_frame\":5242,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUAnschutz.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":13648,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `sp.core.js%3frev=7ByNlH%2BvcgRJg%2BRCctdC0w%3D%3D`; SHA-256 `ea99682af1f2ca9bb54887a9cc1ced7c09b2f6d7feb277f2c3d6f3b57af25fc1`; size 12352 bytes\n SHA-1: `4dead7fbde90aced120172db43a09bf00e2c0271`; MD5: `ec1c8d947faf72044983e44272d742d3`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6579,\"response_frame\":6593,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/_layouts/sp.core.js?rev=7ByNlH%2BvcgRJg%2BRCctdC0w%3D%3D\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":12352,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `CUDenver.jpg`; SHA-256 `b2aba18ac53e4abc1a631c98959e5411fc64efe761dbe216e1f559b1e2d7aef2`; size 11926 bytes\n SHA-1: `2fc2bf21c8785337eb2b74961272d7659aefda33`; MD5: `e50db431a93bfe87da97ebc24b407223`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5289,\"response_frame\":5469,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUDenver.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":11926,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `CUSouth.jpg`; SHA-256 `7df7e6f7c22f1938c2313beb743eb60040f607f2a703a5134c8842ce7e7946ab`; size 10826 bytes\n SHA-1: `ebd1be648dd452947389932a9f1301c6ff655f6c`; MD5: `966031991ea4ecb07029361f94cf006e`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5355,\"response_frame\":5493,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUSouth.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":10826,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `WebResource.axd%3fd=nK66gdmZPDA-w-JjHyggjO_q5ZVRp7ooiUATeOMUtTMCTlfkvxq8mxRHybfWnA0Swfdbv1YBCieMhY76WgB3McU0Erit7tpi9kGXDOtvazCF8h1BLSyM9r_pT9xkzGtAoB6i_bw2w0dM46xzuwSmUZ9Il-pR8sIBMDjV6n64EKHYbfoJqQA9doUWhsRbzsGCzJ1g7D2-gJrdDaKQJ1H6GipIFEoKwv_UCr3VeSqOsCE`; SHA-256 `b5fcfa087b1cc0b1f61c17437c0a533c027dd68bb1e42898682bad189bacdf67`; size 9556 bytes\n SHA-1: `1e87c08af2dccc90b9268ffcf99995058679e02d`; MD5: `1caa71cc4d4eaa709b80136bfeced358`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8154,\"response_frame\":8187,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":107,\"url\":\"http://www.ucdenver.edu/WebResource.axd?d=nK66gdmZPDA-w-JjHyggjO_q5ZVRp7ooiUATeOMUtTMCTlfkvxq8mxRHybfWnA0Swfdbv1YBCieMhY76WgB3McU0Erit7tpi9kGXDOtvazCF8h1BLSyM9r_pT9xkzGtAoB6i_bw2w0dM46xzuwSmUZ9Il-pR8sIBMDjV6n64EKHYbfoJqQA9doUWhsRbzsGCzJ1g7D2-gJrdDaKQJ1H6GipIFEoKwv_UCr3VeSqOsCEXfpiHtt2ZR-Y3UW4oyGmrVOioeA2&t=635701215589701395\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":9556,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `cta_visit_small.jpg`; SHA-256 `022d0a09ef989821ccf3e8bd48be89355052024fc688fe3c4c84c3da00a6e082`; size 8672 bytes\n SHA-1: `6d542fcc45327ca1d798ed9c4885f28a107fec93`; MD5: `2e86bf8f683e533368db29183a979cd8`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5197,\"response_frame\":5269,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit_small.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":8672,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `degree-app.css`; SHA-256 `1519c5e27fa45f1ceb90ae78923c474e3f5597d45e6a8c61ad73367a432333b8`; size 8091 bytes\n SHA-1: `480244e421d0c5f577b9195b4ecfcd3805246d01`; MD5: `e01eb5a1803bdc4c771d29d9291c37ee`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4636,\"response_frame\":4708,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-app.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":8091,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `cta_apply_small.jpg`; SHA-256 `ff7d32dd7321a2b3c5597c69caae82409019ac22e11ecc4530188d4e3b144302`; size 7687 bytes\n SHA-1: `e94a6d5d480953369029c35803c53cff4843e986`; MD5: `dbcc46d7ddc44a6dc6dface8d624e21c`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5195,\"response_frame\":5256,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply_small.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":7687,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `cta_appStatus_small.jpg`; SHA-256 `c8e9a8b2cf530cc873941944744e8d053a34d2759194dae198e579c9e17399a2`; size 7600 bytes\n SHA-1: `36009611b33c862fb9b49643ad1a071cf2ad5a11`; MD5: `1a88b02b67ae5fbcca5976b247ab16e0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5199,\"response_frame\":5219,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_appStatus_small.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":7600,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `kwizcom_jsutility.js%3fv=13.4.81&source=kwizcomsharepointutilities`; SHA-256 `f4fbf7d12ec5db69f6a21a8323602fe7e8aa8c4f59baea6115fe1323c3e1358f`; size 6037 bytes\n SHA-1: `7bcb64761fd2364326e2559dad3aa1f794a641bd`; MD5: `c02955bd063c0ad3c8d0701f09bbb06f`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8182,\"response_frame\":8238,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/_layouts/kwizcom.sharepoint.foundation/kwizcom_jsutility.js?v=13.4.81&source=kwizcomsharepointutilities\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":6037,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `cta_catalog_small.jpg`; SHA-256 `a417a78e9d645ffa38f11bbcd1e4bdd0295bb71e5a7dfd692b3495dac2ef4107`; size 5780 bytes\n SHA-1: `b4fa94e1d5e2ceca211082f8354c393b3a7a4884`; MD5: `0dfd56931f9d8cb938febff2f7fead29`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5168,\"response_frame\":5208,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":107,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog_small.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5780,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `cta_calendar_small.jpg`; SHA-256 `fb229f5700cae4392b42fe23e328ba5e697a7c84f4678670791a22ead70a9d09`; size 5604 bytes\n SHA-1: `ecd9ceff27c64131e3b064fcf4245481d576932d`; MD5: `42d54e77f296e36650e127c3e92f0ef7`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5170,\"response_frame\":5226,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_calendar_small.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5604,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `favicon.ico`; SHA-256 `e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a`; size 5430 bytes\n SHA-1: `0bcbe73d6a198f6e5ebafa035b734a12809cefa6`; MD5: `f74755b4757448d71fdcb4650a701816`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1939,\"response_frame\":1947,\"server_ip\":\"192.162.244.171\",\"status_code\":\"200\",\"tcp_stream\":53,\"url\":\"http://dhsiwyqdlskwsqo.com/favicon.ico\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5430,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `CUDenver_cuitc-300.png`; SHA-256 `72c3d8a0ee2408bcb595f51ec68806252c9b60a6be25b091f1d0a88655517f12`; size 4805 bytes\n SHA-1: `e13dcdba00e7fd11da56ea8c0abab6c233be98d1`; MD5: `2faee9a51807ab5e3e4a30ddba0d6984`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4996,\"response_frame\":5127,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/SiteCollectionImages/Logos/CUDenver_cuitc-300.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":4805,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `loading.gif`; SHA-256 `11065daca98f9840f58be03dd0fa78c710b9509ad517857acacf715c491de6d6`; size 4565 bytes\n SHA-1: `d63987c33df38115c366d2bb44e92d372c14ec43`; MD5: `390cfc9c03423cfe31fa37675c365214`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8585,\"response_frame\":8617,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/_layouts/KWizCom_Aggregator/loading.gif\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":4565,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `leftChevron.gif`; SHA-256 `86a4c543d749c972e930c08df70d17f81c7eae19ea9854476eda897fd33fbfc5`; size 4229 bytes\n SHA-1: `d9c1951cbf95955b6b725908f457cf3a5b1397a9`; MD5: `9608b17db2b5993e3e66810749cdaa38`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6034,\"response_frame\":6291,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/leftChevron.gif\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":4229,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `rightChevron.gif`; SHA-256 `eac280b1fd4d84b2b386d93b51f9193c42f10fe9c3cb0dd1e67ebff66fd31952`; size 4217 bytes\n SHA-1: `301a50508617b230719593821d679c30ceadee2d`; MD5: `18dbc17cfcd8881155508fd614882089`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6011,\"response_frame\":6064,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/rightChevron.gif\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":4217,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `8lw2Htym.avi`; SHA-256 `2e2e544728c5e5f5cfdc9ad2faf6063af99088e1c3edc32e5074e7ad541c18a0`; size 2320 bytes\n SHA-1: `cdfead4e3acdc0b4fe3d3d4c461ed9af97cfb1ec`; MD5: `d5e1c5d5bb229adeb7d21b58865b7c1e`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2226,\"response_frame\":2229,\"server_ip\":\"192.162.244.171\",\"status_code\":\"200\",\"tcp_stream\":53,\"url\":\"http://dhsiwyqdlskwsqo.com/images/UIL_2BVxj_2FFv/cAgM9ZivBfYRBhzmpmqE8/gTexqC1Lh_2F0iW2/AATDXP0c4G4qcxV/_2FXAAoF8eHHNZ8c43/RrSntOi0N/4VTdgqIWbPwlUsd3uIxL/BZP_2Bzh085fEx639Yq/B1kvRr_2FOEM0k57tlZ1QS/8lw2Htym.avi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2320,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `data.js`; SHA-256 `8ba51e69c99c8a2fee83d5cd85f86d044a51c9979f845ca6abf75901ad83f84c`; size 2281 bytes\n SHA-1: `0f46256a51f76798f9df2d1edc109438bd7cd969`; MD5: `8672e6faebb2f45571625793edbcb072`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5160,\"response_frame\":5166,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/data.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2281,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `youtube.png`; SHA-256 `9d7c79b24ac12a185212ccab8741f4acdbd7ab160099e719bedd682806886ac9`; size 2133 bytes\n SHA-1: `8ca00bf24f5b13a51b5fd6550acc3d73a934d0f0`; MD5: `cfbfca7cc289fd1eb2b7997de37d459a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5841,\"response_frame\":6003,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/youtube.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2133,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `googleplus.png`; SHA-256 `46868c166bdd75230bd20064033f281d2d6ca30a512eee717871dac9da416955`; size 2012 bytes\n SHA-1: `01bdae362c6a517d12583d0de461c90c9e924be6`; MD5: `13175b2ebad03c4cba1888f632797bbc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5807,\"response_frame\":5978,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/googleplus.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2012,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `instagram.png`; SHA-256 `4e3d1cd476ae289fb9a9f4ce26b781659410914c81d11b4befc7735f4c71b2b1`; size 1844 bytes\n SHA-1: `25fbb599029bea25f8faee7bd43c92d1b08b3ff6`; MD5: `cc03981c4f9e17ba74264e12b42fd98a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5845,\"response_frame\":5989,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/instagram.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1844,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `linkedin.png`; SHA-256 `25d7dc2c15716821face8630fbf2c166969dc0852e19c822e07982ea512da981`; size 1830 bytes\n SHA-1: `69254b664068b14e4b5089bb3ba6b47709f724a4`; MD5: `2d3f6d40ab8cb18744b7083e9e0a716f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5642,\"response_frame\":5885,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/linkedin.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1830,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `bgximg.png`; SHA-256 `561ffc13ce19398e938a84992b3791d95e9d6f7b904e3f79c9728dc0c23a8297`; size 1770 bytes\n SHA-1: `47a25c0e49db1e786592703a9cb9f154ad96a53b`; MD5: `a4706be6763760dc3f78f185dc7dac91`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5567,\"response_frame\":5803,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":103,\"url\":\"http://www.ucdenver.edu/_layouts/images/bgximg.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1770,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `twitter.png`; SHA-256 `6cba436e9e5adbe296a382ece4309eb469ec3a0d37d3b14058800f9fd57338ab`; size 1761 bytes\n SHA-1: `361b50b8af21607eaae32357bd209ede5c0c40e0`; MD5: `b89e4c2cfe1e5a508ef89abcf4658e7a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5887,\"response_frame\":6008,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/twitter.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1761,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `facebook.png`; SHA-256 `b943dd2830226be743c9bfcb5ffa4eec591e55d09a736ffecdfd3d8b6581da31`; size 1524 bytes\n SHA-1: `62a4b3acdd85f090f85acd42d0e69d278117fa9c`; MD5: `91e1e8b7c6b0fc7bb26804274280f6a4`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5889,\"response_frame\":6028,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/facebook.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1524,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `UCDJS.js`; SHA-256 `61f39b4c6a88443103c0260f69dfc9484012f6bddad680b567c3ababcf416b4e`; size 1451 bytes\n SHA-1: `b884a71ab541b80ef049af50f5a86e87e08907db`; MD5: `1f145fa2d88e00b5fb2a54734e234ea3`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4871,\"response_frame\":4957,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/Javascript%20Library/UCDJS.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1451,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ProcessQuery`; SHA-256 `da725c97aae07686110485c776b5ebb1733fb26674466d07417aa2ee3c0e09a9`; size 1426 bytes\n SHA-1: `cc8b8331446106ba928d9bbac6ef31f2a1c00136`; MD5: `54a0ee586a1fdc423a057de2cdc2da21`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `QLtab.png`; SHA-256 `bfedb831c9a4afb407a127b04080c8f649d2134e713d4a1f810d9f670295cf7d`; size 1319 bytes\n SHA-1: `55ecc50f7c3f553576ad84354fe8d9ec5347b15f`; MD5: `795734766d8d8eabd97f05288cf63ede`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5235,\"response_frame\":5287,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/QLtab.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1319,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `searchButton(1).png`; SHA-256 `9be5b65b630c074027b64f5544e24575e36aba498ee43b12167e82b40872e01f`; size 1198 bytes\n SHA-1: `41a5249de5ac77f52dbb47a7ff833d914bc46005`; MD5: `28daea4f06e3bd95faf33d131bb681e7`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5245,\"response_frame\":5360,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/searchButton.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1198,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `favicon(1).ico`; SHA-256 `d2e3bd61e7e0d4f908192813267d98927cc31043d84387b1a941e3b5b15f9134`; size 1150 bytes\n SHA-1: `1e088c6adab0a7af292e74cce589028c4b2b0cc9`; MD5: `d54b1846733136b9761c4dacb3273518`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6585,\"response_frame\":6603,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":107,\"url\":\"http://www.ucdenver.edu/favicon.ico\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1150,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `local.js`; SHA-256 `9a4e9990d71244aaa68b4bff6d5910665e7df9051cd4ee030e61b8e7f16180c1`; size 1085 bytes\n SHA-1: `1729b5ccecc775be5baf61c84cb7e78f9abc54a1`; MD5: `a7339ca2b67e9009b86233f2fcf9dbb2`; completeness: unknown; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8178,\"response_frame\":8234,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.ucdenver.edu/programs/undergraduate/Documents/Styles_Scripts/local.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1085,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `carousel.js`; SHA-256 `9557385d62733e77c3bb5b473d9bb2fa29bd51f8b010d221cbefe8297a454291`; size 882 bytes\n SHA-1: `d260447d2e6a87cc40c04ad5eeaa9a109748cebe`; MD5: `8c017c4df0d778913e88b1f0f8412cd4`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5123,\"response_frame\":5139,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/carousel.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":882,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `client(1).rar`; SHA-256 `f099877e9778681f5ca0c77b7f18b5aa675caa6d5cd50abc28dfe6136ac3b8ac`; size 773 bytes\n SHA-1: `90ef3a402359573d9bcf53598831148c0d7f17d0`; MD5: `83d0a8e5c463c3ef3dd80b88e4600850`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2564,\"response_frame\":2566,\"server_ip\":\"62.149.140.59\",\"status_code\":\"200\",\"tcp_stream\":71,\"url\":\"http://www.ferranorga.net/img/client.rar\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":773,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `print.css`; SHA-256 `d60aea1fe282db3ac579713c98d24d46850375db28ccfec0793d10f275b860a5`; size 705 bytes\n SHA-1: `9b2fbe704b925e06ae43e436ef6c0672dc5aaeac`; MD5: `2dafeec6b68c399a3cb3dc84d312246b`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6074,\"response_frame\":6304,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/Style%20Library/responsive/print.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":705,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `searchButton.png`; SHA-256 `56bbf5dbefa7919f0b8666d9cfc272b0ddbc9e920a373c1ab701d960dc09ce3a`; size 629 bytes\n SHA-1: `2acabec737d636e3b5815f7f6e24a0b183a97462`; MD5: `30b2b2cc6b55ef41ce8274f7bce93f05`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5162,\"response_frame\":5164,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":107,\"url\":\"http://www.ucdenver.edu/PublishingImages/UCDLayoutImages/searchButton.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":629,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `sites(1).asmx`; SHA-256 `58c778f59b121390544d07cc4ff6948eb35045eafe376247ef285d4f72cfe167`; size 575 bytes\n SHA-1: `6a5387f6d96e958d4ca6a7333891003c42e1df2c`; MD5: `b3406fbcf2081486c94ef8aa3b69fa53`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6889,\"response_frame\":6898,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/_vti_bin/sites.asmx\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":575,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `__utm.gif%3futmwv=5.7.2&utms=1&utmn=362717400&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=408037419&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAQE~`; SHA-256 `ca0405f6832d0b1aaf7e5c00aa3241cccf19859dc47ca15ab3a90a9ffcbdf150`; size 368 bytes\n SHA-1: `d713977d40cede02db69090be78ede17b7c5910e`; MD5: `49133c6f83755c8943d0618911f280bb`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5617,\"response_frame\":5690,\"server_ip\":\"216.58.192.46\",\"status_code\":\"302\",\"tcp_stream\":109,\"url\":\"http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=362717400&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624860490&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=408037419&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAQE~\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":368,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `sites.asmx`; SHA-256 `24e819821e2f9afcfed4ad0e8490935378abfb0df723850078e731cfd9ef6edd`; size 332 bytes\n SHA-1: `8f780b9be1cc58c5d5ee6119a3a2b34b46ba34a6`; MD5: `62ab2c7cb237cb67acf74eed8107003c`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `client.rar`; SHA-256 `f9985bf8754e921e90a0c63e3458daf79c492f25bbaf3cf13bb14d18ca27fd5a`; size 248 bytes\n SHA-1: `7f959b259b45e036635a6dde19e07fb0880f17fe`; MD5: `df2a71ce3ecdd17b8f925fe3a228f305`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2555,\"response_frame\":2557,\"server_ip\":\"62.149.140.59\",\"status_code\":\"301\",\"tcp_stream\":70,\"url\":\"http://ferranorga.net/img/client.rar\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":248,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `undergraduate`; SHA-256 `a630dac9b5b0fbea3974ad09401522aeda12f11bbe5344508829d575c03cd644`; size 188 bytes\n SHA-1: `aabb55c4e6f56a796e9fc87c023d451c8f60a975`; MD5: `be342213d34238761b352a2d2fa848b0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8107,\"response_frame\":8110,\"server_ip\":\"132.194.7.45\",\"status_code\":\"302\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/programs/undergraduate\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":188,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `minus.gif`; SHA-256 `37e9250c18e218e58fb1818a608e9ad463a4b4743ebf3c08ca738001cc8970e0`; size 185 bytes\n SHA-1: `525729a730cf552370348b1fa4bbfc2aadad74fc`; MD5: `134f5f02b1433c1b41ebda6b7a50373d`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8583,\"response_frame\":8587,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.ucdenver.edu/programs/undergraduate/Pages/_layouts/images/minus.gif\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":185,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `CreativeWriting.aspx`; SHA-256 `5c9486d0aa62b50180e77e62b15f9977b3b0fd3f7d9b1f797de4c41b7da02b7d`; size 157 bytes\n SHA-1: `0c412305ed8f60facbb15f10ad87ba2265b27485`; MD5: `82cb0393de9499aa1eb0936f3c6bae07`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9022,\"response_frame\":9026,\"server_ip\":\"132.194.7.45\",\"status_code\":\"302\",\"tcp_stream\":105,\"url\":\"http://www.ucdenver.edu/academics/colleges/CLAS/Departments/english/Programs/BachelorOfArts/BAEnglish/Pages/CreativeWriting.aspx\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":157,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `blank.js%3frev=QGOYAJlouiWgFRlhHVlMKA%3D%3D`; SHA-256 `7bacd1e07f7de2e51fcd1eafbcd9ec0aaad5c16ac4c4d846a86a5654a00506b4`; size 120 bytes\n SHA-1: `6e0d7ac653992be095efec8373ee8e3279b4356e`; MD5: `406398009968ba25a01519611d594c28`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4899,\"response_frame\":4987,\"server_ip\":\"132.194.7.45\",\"status_code\":\"200\",\"tcp_stream\":104,\"url\":\"http://www.ucdenver.edu/_layouts/blank.js?rev=QGOYAJlouiWgFRlhHVlMKA%3D%3D\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":120,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `__utm.gif%3futmwv=5.7.2&utms=2&utmn=1279953315&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage%2aNav%20-%20Primary%2aDe.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~`; SHA-256 `8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015`; size 35 bytes\n SHA-1: `0f4e929dd5bb2564f7ab9c76338e04e292a42ace`; MD5: `28d6814f309ea289f847c69cf91194c6`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8057,\"response_frame\":8061,\"server_ip\":\"216.58.192.46\",\"status_code\":\"200\",\"tcp_stream\":109,\"url\":\"http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=2&utmn=1279953315&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Degrees%20%26%20Programs)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624866037&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~\"},{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8105,\"response_frame\":8109,\"server_ip\":\"216.58.192.46\",\"status_code\":\"200\",\"tcp_stream\":109,\"url\":\"http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=3&utmn=1832691277&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Bachelor%270s%20Degrees)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624887589&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~\"},{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8669,\"response_frame\":8678,\"server_ip\":\"216.58.192.46\",\"status_code\":\"200\",\"tcp_stream\":109,\"url\":\"http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=4&utmn=1892096743&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x446&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Bachelor%27s%20degrees%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=326256236&utmr=0&utmp=%2Fprograms%2Fundergraduate%2FPages%2Fdefault.aspx&utmht=1541624894067&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":35,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ncsi.txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n SHA-1: `33bf88d5b82df3723d5863c7d23445e345828904`; MD5: `cd5a4d3fdd5bffc16bf959ef75cf37bc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.22.15.119\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":428,\"response_frame\":430,\"server_ip\":\"72.246.64.187\",\"status_code\":\"200\",\"tcp_stream\":27,\"url\":\"http://www.msftncsi.com/ncsi.txt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `a350bb1aec8150ebf567b85b61560b6616578c33600d4649d3eb686fd9e4542a`; recorded 2026-09-22T16:09:37.228263+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":395,\"observable_limit\":5000,\"observables_checked\":395,\"observables_total\":395,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `0c443755-98f4-45dd-a9c4-e04e0415fe14` shares 58 observations. This does not establish a common campaign.\n- Prior analysis `f4c6d05d-a600-4616-9c66-c96965645a65` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `5bff54cd-16de-44cb-a009-c88818ce138f` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `bd9602ed-341a-4123-aae3-9fafa5731518` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `0bb7a995-231c-4046-95ec-acea419eb7b4` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `d4027bcf-0ef6-4e3c-a68a-68dfe35adb33` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `8879e360-655c-4073-beb9-68018699a4d4` shares 26 observations. This does not establish a common campaign.\n- Prior analysis `961bdc9a-7460-440f-a246-f55748149bcc` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `1c2e6d58-c62a-4009-939b-3aa82de281a2` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `76f521c2-4e4a-41d5-95ad-a44fd9887dd8` shares 36 observations. This does not establish a common campaign.\n- Prior analysis `fa0da8be-03fb-404d-a526-6c99c6b4f000` shares 28 observations. This does not establish a common campaign.\n- Prior analysis `05851801-c224-489b-b9da-9e5d035c60b4` shares 16 observations. This does not establish a common campaign.\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 31 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 35 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 1 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `31f265dc-3055-4628-8df4-136d4058e842` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `8174eaa7-e189-467f-b05e-fb7397bfcf16` shares 4 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":106,\"export_status\":\"completed\",\"exported_objects\":109,\"hashed_bytes\":7594694,\"hashed_objects\":109,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":106,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":106}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 33/33, identities 4/4, observables 395/395, artifacts 106/106. Full returned inventory is in the JSON result.\n- Warning: Conflicting TCP overlap: fallback extraction rejected this direction\n\n## Evidence-backed IOC assessment\n\n383 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `3487d1b73191f71b5bd55ce0e78b961e7e804d6c3a39fb3b350c8b775dfa8a5b`.\n\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `0565714e317ce67e68fdf0cfb19b84e068ff1650ffa6d0955c4aba3bda3d7d50`; updated 2026-09-22T17:48:44.130550+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-00d0b56c8c27cc813e704fd6\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-00d0b56c8c27cc813e704fd6\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-00e6b1eab9f0fd7d4245946d\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-00e6b1eab9f0fd7d4245946d\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-a9daf1b54f3867ddcc7a6e82\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-a9daf1b54f3867ddcc7a6e82\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-36aae558a6cbd96b4ac20c18\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-36aae558a6cbd96b4ac20c18\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-55276904c0cca8e9ef7c902b\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-55276904c0cca8e9ef7c902b\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-c8e93d4cfcd896ee9b62e06d\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-c8e93d4cfcd896ee9b62e06d\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-0334862e1b5d13ee6652b009\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-0334862e1b5d13ee6652b009\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":7,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":7,\"retained_targets\":77,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 4632, "stream": 0, "flow_id": "flow-90de1c118d24d3bbf97699ed", "packets": 48, "transport": "udp", "last_frame": 3479, "first_frame": 1, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 4632, "last_seen_epoch": "1541624802.791824", "responder_bytes": 0, "first_seen_epoch": "1541623247.036005" }, { "bytes": 320, "stream": 1, "flow_id": "flow-39a0bdbaa1b32437ea807d6b", "packets": 2, "transport": "udp", "last_frame": 4, "first_frame": 3, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 56504, "responder_port": 53, "initiator_bytes": 127, "last_seen_epoch": "1541623247.090323", "responder_bytes": 193, "first_seen_epoch": "1541623247.090073" }, { "bytes": 320, "stream": 2, "flow_id": "flow-672b1b9f111c9955cc8b63c8", "packets": 2, "transport": "udp", "last_frame": 6, "first_frame": 5, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 60638, "responder_port": 53, "initiator_bytes": 127, "last_seen_epoch": "1541623247.091195", "responder_bytes": 193, "first_seen_epoch": "1541623247.091" }, { "bytes": 196, "stream": 3, "flow_id": "flow-584412c8d718b2fa2b936bb6", "packets": 2, "transport": "udp", "last_frame": 8, "first_frame": 7, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 55055, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1541623247.096007", "responder_bytes": 106, "first_seen_epoch": "1541623247.095753" }, { "bytes": 449, "stream": 4, "flow_id": "flow-129c748593da828e884ec5f4", "packets": 2, "transport": "udp", "last_frame": 11, "first_frame": 9, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 55057, "responder_port": 389, "initiator_bytes": 213, "last_seen_epoch": "1541623247.146032", "responder_bytes": 236, "first_seen_epoch": "1541623247.145569" }, { "bytes": 492, "stream": 5, "flow_id": "flow-a0aee42910db29d24a7e9b7b", "packets": 2, "transport": "udp", "last_frame": 13, "first_frame": 10, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 55058, "responder_port": 389, "initiator_bytes": 256, "last_seen_epoch": "1541623247.146204", "responder_bytes": 236, "first_seen_epoch": "1541623247.14576" }, { "bytes": 449, "stream": 6, "flow_id": "flow-ca1b6bf94f4109f1acad798d", "packets": 2, "transport": "udp", "last_frame": 14, "first_frame": 12, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 55059, "responder_port": 389, "initiator_bytes": 213, "last_seen_epoch": "1541623247.146339", "responder_bytes": 236, "first_seen_epoch": "1541623247.146129" }, { "bytes": 2326, "stream": 0, "flow_id": "flow-fa88995428c6abd1c583783e", "packets": 17, "transport": "tcp", "last_frame": 518, "first_frame": 15, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49155, "responder_port": 135, "initiator_bytes": 1216, "last_seen_epoch": "1541623275.561573", "responder_bytes": 1110, "first_seen_epoch": "1541623247.263067" }, { "bytes": 15550, "stream": 1, "flow_id": "flow-aed0d191805b7de1e5433e30", "packets": 52, "transport": "tcp", "last_frame": 984, "first_frame": 22, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49156, "responder_port": 49155, "initiator_bytes": 10331, "last_seen_epoch": "1541623335.569554", "responder_bytes": 5219, "first_seen_epoch": "1541623247.270429" }, { "bytes": 992, "stream": 2, "flow_id": "flow-bdda5f9733f9d9e501dad842", "packets": 8, "transport": "tcp", "last_frame": 32, "first_frame": 25, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49157, "responder_port": 88, "initiator_bytes": 472, "last_seen_epoch": "1541623247.275054", "responder_bytes": 520, "first_seen_epoch": "1541623247.272763" }, { "bytes": 2501, "stream": 3, "flow_id": "flow-9e78fb8e71c4a36f94ca553f", "packets": 10, "transport": "tcp", "last_frame": 42, "first_frame": 33, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49158, "responder_port": 88, "initiator_bytes": 606, "last_seen_epoch": "1541623247.292822", "responder_bytes": 1895, "first_seen_epoch": "1541623247.291085" }, { "bytes": 3950, "stream": 4, "flow_id": "flow-08792d4dd984aee350a937df", "packets": 12, "transport": "tcp", "last_frame": 54, "first_frame": 43, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49159, "responder_port": 88, "initiator_bytes": 1987, "last_seen_epoch": "1541623247.298564", "responder_bytes": 1963, "first_seen_epoch": "1541623247.295545" }, { "bytes": 6842, "stream": 5, "flow_id": "flow-257f347be7112cfa132d4262", "packets": 25, "transport": "tcp", "last_frame": 508, "first_frame": 69, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49160, "responder_port": 445, "initiator_bytes": 4858, "last_seen_epoch": "1541623263.831538", "responder_bytes": 1984, "first_seen_epoch": "1541623247.342978" }, { "bytes": 992, "stream": 6, "flow_id": "flow-f3f0bc6c0e2a981330377138", "packets": 8, "transport": "tcp", "last_frame": 83, "first_frame": 76, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49161, "responder_port": 88, "initiator_bytes": 472, "last_seen_epoch": "1541623247.350732", "responder_bytes": 520, "first_seen_epoch": "1541623247.348127" }, { "bytes": 2501, "stream": 7, "flow_id": "flow-43f16659031bf1e54f4d1760", "packets": 10, "transport": "tcp", "last_frame": 95, "first_frame": 84, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49162, "responder_port": 88, "initiator_bytes": 606, "last_seen_epoch": "1541623247.388565", "responder_bytes": 1895, "first_seen_epoch": "1541623247.375779" }, { "bytes": 3920, "stream": 8, "flow_id": "flow-7586403cf7b7b6295bd6e1c9", "packets": 12, "transport": "tcp", "last_frame": 107, "first_frame": 96, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49163, "responder_port": 88, "initiator_bytes": 1970, "last_seen_epoch": "1541623247.395197", "responder_bytes": 1950, "first_seen_epoch": "1541623247.389437" }, { "bytes": 3619, "stream": 9, "flow_id": "flow-4aceceee2878e88f2b289ed8", "packets": 12, "transport": "tcp", "last_frame": 124, "first_frame": 108, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49164, "responder_port": 88, "initiator_bytes": 1803, "last_seen_epoch": "1541623247.398201", "responder_bytes": 1816, "first_seen_epoch": "1541623247.395332" }, { "bytes": 4502, "stream": 10, "flow_id": "flow-4908a3d40ae4ccf36af07119", "packets": 20, "transport": "tcp", "last_frame": 516, "first_frame": 111, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49165, "responder_port": 49158, "initiator_bytes": 2620, "last_seen_epoch": "1541623275.561418", "responder_bytes": 1882, "first_seen_epoch": "1541623247.397188" }, { "bytes": 9067, "stream": 11, "flow_id": "flow-44e1fe2cb700f844cef2caa0", "packets": 29, "transport": "tcp", "last_frame": 251, "first_frame": 144, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49166, "responder_port": 389, "initiator_bytes": 4377, "last_seen_epoch": "1541623247.644625", "responder_bytes": 4690, "first_seen_epoch": "1541623247.414665" }, { "bytes": 3920, "stream": 12, "flow_id": "flow-e378beb20b4c94f1cd6a1e32", "packets": 12, "transport": "tcp", "last_frame": 162, "first_frame": 151, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49167, "responder_port": 88, "initiator_bytes": 1970, "last_seen_epoch": "1541623247.422932", "responder_bytes": 1950, "first_seen_epoch": "1541623247.419396" }, { "bytes": 330, "stream": 7, "flow_id": "flow-bed827a12b48f72801d76fc7", "packets": 2, "transport": "udp", "last_frame": 172, "first_frame": 171, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 51356, "responder_port": 53, "initiator_bytes": 132, "last_seen_epoch": "1541623247.429977", "responder_bytes": 198, "first_seen_epoch": "1541623247.429709" }, { "bytes": 434, "stream": 8, "flow_id": "flow-aa8e980b2cd15b82dbd784bc", "packets": 2, "transport": "udp", "last_frame": 174, "first_frame": 173, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 51357, "responder_port": 389, "initiator_bytes": 191, "last_seen_epoch": "1541623247.430978", "responder_bytes": 243, "first_seen_epoch": "1541623247.430757" }, { "bytes": 300, "stream": 9, "flow_id": "flow-47e426143431b703cda3d030", "packets": 2, "transport": "udp", "last_frame": 176, "first_frame": 175, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 50261, "responder_port": 53, "initiator_bytes": 117, "last_seen_epoch": "1541623247.460829", "responder_bytes": 183, "first_seen_epoch": "1541623247.46058" }, { "bytes": 449, "stream": 10, "flow_id": "flow-efd369d2a34f67b697e9aa7b", "packets": 2, "transport": "udp", "last_frame": 178, "first_frame": 177, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 50262, "responder_port": 389, "initiator_bytes": 213, "last_seen_epoch": "1541623247.465588", "responder_bytes": 236, "first_seen_epoch": "1541623247.465218" }, { "bytes": 348, "stream": 13, "flow_id": "flow-510a2ca637cb20d3a3a0e01f", "packets": 6, "transport": "tcp", "last_frame": 185, "first_frame": 179, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49168, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1541623247.538766", "responder_bytes": 174, "first_seen_epoch": "1541623247.536355" }, { "bytes": 330, "stream": 11, "flow_id": "flow-613f97d31e41be051ba38b34", "packets": 2, "transport": "udp", "last_frame": 188, "first_frame": 187, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 65381, "responder_port": 53, "initiator_bytes": 132, "last_seen_epoch": "1541623247.541306", "responder_bytes": 198, "first_seen_epoch": "1541623247.541064" }, { "bytes": 434, "stream": 12, "flow_id": "flow-69eaf9ca4654f49a0ebf6955", "packets": 2, "transport": "udp", "last_frame": 190, "first_frame": 189, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 65382, "responder_port": 389, "initiator_bytes": 191, "last_seen_epoch": "1541623247.542798", "responder_bytes": 243, "first_seen_epoch": "1541623247.542431" }, { "bytes": 5552, "stream": 14, "flow_id": "flow-c63f4d1f177b23be89eb8322", "packets": 15, "transport": "tcp", "last_frame": 217, "first_frame": 191, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49169, "responder_port": 389, "initiator_bytes": 2599, "last_seen_epoch": "1541623247.578148", "responder_bytes": 2953, "first_seen_epoch": "1541623247.568329" }, { "bytes": 3950, "stream": 15, "flow_id": "flow-eb7296804e03e7e0c7dcea61", "packets": 12, "transport": "tcp", "last_frame": 209, "first_frame": 198, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49170, "responder_port": 88, "initiator_bytes": 1987, "last_seen_epoch": "1541623247.575657", "responder_bytes": 1963, "first_seen_epoch": "1541623247.573808" }, { "bytes": 348, "stream": 16, "flow_id": "flow-232b41ec80cb2b68a2f1ea76", "packets": 6, "transport": "tcp", "last_frame": 228, "first_frame": 222, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49172, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1541623247.638188", "responder_bytes": 174, "first_seen_epoch": "1541623247.636507" }, { "bytes": 348, "stream": 17, "flow_id": "flow-6bb87419de56c02bda4324d1", "packets": 6, "transport": "tcp", "last_frame": 235, "first_frame": 230, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49173, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1541623247.640267", "responder_bytes": 174, "first_seen_epoch": "1541623247.63908" }, { "bytes": 348, "stream": 18, "flow_id": "flow-8ce9f220bfbe918e65ea2f96", "packets": 6, "transport": "tcp", "last_frame": 244, "first_frame": 238, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49174, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1541623247.643208", "responder_bytes": 174, "first_seen_epoch": "1541623247.64174" }, { "bytes": 341, "stream": 13, "flow_id": "flow-afae17bb8d115f325657fc76", "packets": 2, "transport": "udp", "last_frame": 278, "first_frame": 277, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 56639, "responder_port": 53, "initiator_bytes": 132, "last_seen_epoch": "1541623248.495193", "responder_bytes": 209, "first_seen_epoch": "1541623248.494873" }, { "bytes": 279, "stream": 14, "flow_id": "flow-61d042942171ff4af7d422a9", "packets": 2, "transport": "udp", "last_frame": 280, "first_frame": 279, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 57115, "responder_port": 53, "initiator_bytes": 101, "last_seen_epoch": "1541623248.496435", "responder_bytes": 178, "first_seen_epoch": "1541623248.496201" }, { "bytes": 8180, "stream": 19, "flow_id": "flow-893dc8609c825cca26d313a1", "packets": 20, "transport": "tcp", "last_frame": 396, "first_frame": 281, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49175, "responder_port": 389, "initiator_bytes": 3396, "last_seen_epoch": "1541623248.905603", "responder_bytes": 4784, "first_seen_epoch": "1541623248.498331" }, { "bytes": 3852, "stream": 20, "flow_id": "flow-0acfe70b2798398deb4b5cec", "packets": 12, "transport": "tcp", "last_frame": 303, "first_frame": 292, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49176, "responder_port": 88, "initiator_bytes": 1948, "last_seen_epoch": "1541623248.534362", "responder_bytes": 1904, "first_seen_epoch": "1541623248.531141" }, { "bytes": 3637, "stream": 21, "flow_id": "flow-f82720e57dad73289a794b7c", "packets": 12, "transport": "tcp", "last_frame": 326, "first_frame": 308, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49177, "responder_port": 88, "initiator_bytes": 1807, "last_seen_epoch": "1541623248.542972", "responder_bytes": 1830, "first_seen_epoch": "1541623248.540449" }, { "bytes": 3378, "stream": 22, "flow_id": "flow-1824b4d2d4cf3fae472c5c6c", "packets": 13, "transport": "tcp", "last_frame": 390, "first_frame": 309, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49178, "responder_port": 389, "initiator_bytes": 2524, "last_seen_epoch": "1541623248.562913", "responder_bytes": 854, "first_seen_epoch": "1541623248.540508" }, { "bytes": 3302, "stream": 23, "flow_id": "flow-787922b8390124824d997091", "packets": 10, "transport": "tcp", "last_frame": 338, "first_frame": 325, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49179, "responder_port": 88, "initiator_bytes": 2878, "last_seen_epoch": "1541623248.544691", "responder_bytes": 424, "first_seen_epoch": "1541623248.542913" }, { "bytes": 8710, "stream": 24, "flow_id": "flow-77d837a07087b280dd77e5c0", "packets": 34, "transport": "tcp", "last_frame": 526, "first_frame": 343, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49180, "responder_port": 445, "initiator_bytes": 5892, "last_seen_epoch": "1541623287.824735", "responder_bytes": 2818, "first_seen_epoch": "1541623248.549606" }, { "bytes": 3920, "stream": 25, "flow_id": "flow-a760c839a008ab73170172f7", "packets": 12, "transport": "tcp", "last_frame": 359, "first_frame": 348, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49181, "responder_port": 88, "initiator_bytes": 1970, "last_seen_epoch": "1541623248.552785", "responder_bytes": 1950, "first_seen_epoch": "1541623248.550823" }, { "bytes": 3619, "stream": 26, "flow_id": "flow-1c34ad640031e87af36271a2", "packets": 12, "transport": "tcp", "last_frame": 371, "first_frame": 360, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49182, "responder_port": 88, "initiator_bytes": 1803, "last_seen_epoch": "1541623248.553931", "responder_bytes": 1816, "first_seen_epoch": "1541623248.552914" }, { "bytes": 146, "stream": 15, "flow_id": "flow-996be81a5f447400b3b6cab2", "packets": 2, "transport": "udp", "last_frame": 409, "first_frame": 403, "initiator_ip": "10.22.15.119", "responder_ip": "224.0.0.252", "initiator_port": 49688, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1541623250.050697", "responder_bytes": 0, "first_seen_epoch": "1541623249.9571" }, { "bytes": 1026, "stream": 16, "flow_id": "flow-f4043ade79b1ae955d37a93b", "packets": 3, "transport": "udp", "last_frame": 2250, "first_frame": 404, "initiator_ip": "10.22.15.119", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 1026, "last_seen_epoch": "1541623797.537766", "responder_bytes": 0, "first_seen_epoch": "1541623249.964576" }, { "bytes": 1026, "stream": 17, "flow_id": "flow-88a72384c1d30e0f9896028f", "packets": 3, "transport": "udp", "last_frame": 2251, "first_frame": 405, "initiator_ip": "10.22.15.2", "responder_ip": "10.22.15.119", "initiator_port": 67, "responder_port": 68, "initiator_bytes": 1026, "last_seen_epoch": "1541623797.538077", "responder_bytes": 0, "first_seen_epoch": "1541623249.964889" }, { "bytes": 237, "stream": 18, "flow_id": "flow-5bd7bb316e7780e1a1f608a5", "packets": 2, "transport": "udp", "last_frame": 407, "first_frame": 406, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 64719, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1541623249.980801", "responder_bytes": 157, "first_seen_epoch": "1541623249.980468" }, { "bytes": 128, "stream": 19, "flow_id": "flow-32f6edf57d5ce3b06cf8ba5b", "packets": 2, "transport": "udp", "last_frame": 410, "first_frame": 408, "initiator_ip": "10.22.15.119", "responder_ip": "224.0.0.252", "initiator_port": 63570, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1541623250.090797", "responder_bytes": 0, "first_seen_epoch": "1541623249.992718" }, { "bytes": 196, "stream": 20, "flow_id": "flow-973465e137b7ec5814576ec2", "packets": 2, "transport": "udp", "last_frame": 414, "first_frame": 413, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 56888, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1541623250.618757", "responder_bytes": 106, "first_seen_epoch": "1541623250.618469" }, { "bytes": 241, "stream": 21, "flow_id": "flow-46494161477880d0d9aa0db3", "packets": 2, "transport": "udp", "last_frame": 416, "first_frame": 415, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 53253, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1541623250.627639", "responder_bytes": 159, "first_seen_epoch": "1541623250.627375" }, { "bytes": 231, "stream": 22, "flow_id": "flow-5f693ee824554f371236aa20", "packets": 2, "transport": "udp", "last_frame": 418, "first_frame": 417, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49247, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1541623250.791929", "responder_bytes": 153, "first_seen_epoch": "1541623250.774107" }, { "bytes": 660, "stream": 23, "flow_id": "flow-9853ec8935d24f3cc05ba92f", "packets": 6, "transport": "udp", "last_frame": 10184, "first_frame": 421, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 330, "last_seen_epoch": "1541625300.13241", "responder_bytes": 330, "first_seen_epoch": "1541623252.115281" }, { "bytes": 258, "stream": 24, "flow_id": "flow-cda33209783a8885b82c3501", "packets": 2, "transport": "udp", "last_frame": 424, "first_frame": 423, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 63725, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1541623252.644208", "responder_bytes": 182, "first_seen_epoch": "1541623252.570392" }, { "bytes": 832, "stream": 27, "flow_id": "flow-c71f3ea0a4d2af10e2dacc2e", "packets": 10, "transport": "tcp", "last_frame": 434, "first_frame": 425, "initiator_ip": "10.22.15.119", "responder_ip": "72.246.64.187", "initiator_port": 49183, "responder_port": 80, "initiator_bytes": 379, "last_seen_epoch": "1541623252.684806", "responder_bytes": 453, "first_seen_epoch": "1541623252.646621" }, { "bytes": 256, "stream": 25, "flow_id": "flow-e242cf98e3b178adeced767e", "packets": 2, "transport": "udp", "last_frame": 436, "first_frame": 435, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 56174, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1541623254.972506", "responder_bytes": 167, "first_seen_epoch": "1541623254.972102" }, { "bytes": 312, "stream": 26, "flow_id": "flow-5656ec7506afd6c42fdfe73f", "packets": 2, "transport": "udp", "last_frame": 438, "first_frame": 437, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 62513, "responder_port": 53, "initiator_bytes": 156, "last_seen_epoch": "1541623254.977431", "responder_bytes": 156, "first_seen_epoch": "1541623254.974894" }, { "bytes": 7195, "stream": 28, "flow_id": "flow-e2fef6c6c056eb2086a4474b", "packets": 21, "transport": "tcp", "last_frame": 502, "first_frame": 439, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49185, "responder_port": 389, "initiator_bytes": 3402, "last_seen_epoch": "1541623257.867608", "responder_bytes": 3793, "first_seen_epoch": "1541623257.814412" }, { "bytes": 4163, "stream": 29, "flow_id": "flow-268d9ab96e3d64fb196f2944", "packets": 13, "transport": "tcp", "last_frame": 500, "first_frame": 458, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49186, "responder_port": 389, "initiator_bytes": 3349, "last_seen_epoch": "1541623257.867155", "responder_bytes": 814, "first_seen_epoch": "1541623257.832351" }, { "bytes": 992, "stream": 30, "flow_id": "flow-2a941c8659692314abe323b1", "packets": 8, "transport": "tcp", "last_frame": 474, "first_frame": 467, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49187, "responder_port": 88, "initiator_bytes": 472, "last_seen_epoch": "1541623257.841691", "responder_bytes": 520, "first_seen_epoch": "1541623257.840486" }, { "bytes": 2501, "stream": 31, "flow_id": "flow-d0addae2dd629cc8ddee243f", "packets": 10, "transport": "tcp", "last_frame": 484, "first_frame": 475, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49188, "responder_port": 88, "initiator_bytes": 606, "last_seen_epoch": "1541623257.858266", "responder_bytes": 1895, "first_seen_epoch": "1541623257.856837" }, { "bytes": 3790, "stream": 32, "flow_id": "flow-85f9cc4af7eb2cc64c889e63", "packets": 12, "transport": "tcp", "last_frame": 496, "first_frame": 485, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49189, "responder_port": 88, "initiator_bytes": 1914, "last_seen_epoch": "1541623257.862605", "responder_bytes": 1876, "first_seen_epoch": "1541623257.860419" }, { "bytes": 931, "stream": 33, "flow_id": "flow-4ec71aec7cdf165d3ed7df12", "packets": 8, "transport": "tcp", "last_frame": 534, "first_frame": 527, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49190, "responder_port": 88, "initiator_bytes": 463, "last_seen_epoch": "1541623290.118817", "responder_bytes": 468, "first_seen_epoch": "1541623290.117226" }, { "bytes": 2494, "stream": 34, "flow_id": "flow-e1d13305bd5615c6f49a1a06", "packets": 10, "transport": "tcp", "last_frame": 544, "first_frame": 535, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49191, "responder_port": 88, "initiator_bytes": 597, "last_seen_epoch": "1541623290.130049", "responder_bytes": 1897, "first_seen_epoch": "1541623290.128278" }, { "bytes": 3698, "stream": 35, "flow_id": "flow-c808370af9fa432558eab094", "packets": 12, "transport": "tcp", "last_frame": 556, "first_frame": 545, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49192, "responder_port": 88, "initiator_bytes": 1834, "last_seen_epoch": "1541623290.133782", "responder_bytes": 1864, "first_seen_epoch": "1541623290.130166" }, { "bytes": 1280, "stream": 36, "flow_id": "flow-210f225f0535c2184808ad3e", "packets": 12, "transport": "tcp", "last_frame": 706, "first_frame": 557, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49193, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1541623305.571776", "responder_bytes": 562, "first_seen_epoch": "1541623290.688797" }, { "bytes": 3994, "stream": 37, "flow_id": "flow-a681df33cbe2935fbef3b555", "packets": 12, "transport": "tcp", "last_frame": 575, "first_frame": 564, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49194, "responder_port": 88, "initiator_bytes": 2009, "last_seen_epoch": "1541623290.693498", "responder_bytes": 1985, "first_seen_epoch": "1541623290.690386" }, { "bytes": 341, "stream": 27, "flow_id": "flow-0e7a65033b7c929b67519fa4", "packets": 2, "transport": "udp", "last_frame": 593, "first_frame": 592, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 59195, "responder_port": 53, "initiator_bytes": 132, "last_seen_epoch": "1541623291.22787", "responder_bytes": 209, "first_seen_epoch": "1541623291.227579" }, { "bytes": 279, "stream": 28, "flow_id": "flow-9ca7298a3d4059e7a18dd7ed", "packets": 2, "transport": "udp", "last_frame": 595, "first_frame": 594, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 59482, "responder_port": 53, "initiator_bytes": 101, "last_seen_epoch": "1541623291.228499", "responder_bytes": 178, "first_seen_epoch": "1541623291.228317" }, { "bytes": 5290, "stream": 38, "flow_id": "flow-01f1864864dea3448a5ff113", "packets": 16, "transport": "tcp", "last_frame": 679, "first_frame": 596, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49195, "responder_port": 389, "initiator_bytes": 2967, "last_seen_epoch": "1541623291.772133", "responder_bytes": 2323, "first_seen_epoch": "1541623291.229509" }, { "bytes": 3964, "stream": 39, "flow_id": "flow-98fadf2e4f67e13bc963fd88", "packets": 12, "transport": "tcp", "last_frame": 610, "first_frame": 599, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49196, "responder_port": 88, "initiator_bytes": 1992, "last_seen_epoch": "1541623291.234548", "responder_bytes": 1972, "first_seen_epoch": "1541623291.231076" }, { "bytes": 3532, "stream": 40, "flow_id": "flow-859efd94c3051939e8f438f9", "packets": 15, "transport": "tcp", "last_frame": 673, "first_frame": 617, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49197, "responder_port": 389, "initiator_bytes": 2624, "last_seen_epoch": "1541623291.255757", "responder_bytes": 908, "first_seen_epoch": "1541623291.240355" }, { "bytes": 6970, "stream": 41, "flow_id": "flow-048f0bc41502801588c5fb34", "packets": 25, "transport": "tcp", "last_frame": 980, "first_frame": 630, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49198, "responder_port": 445, "initiator_bytes": 5112, "last_seen_epoch": "1541623329.829562", "responder_bytes": 1858, "first_seen_epoch": "1541623291.247117" }, { "bytes": 3964, "stream": 42, "flow_id": "flow-51f993ba6790a36dc4d52e82", "packets": 12, "transport": "tcp", "last_frame": 646, "first_frame": 635, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49199, "responder_port": 88, "initiator_bytes": 1992, "last_seen_epoch": "1541623291.250173", "responder_bytes": 1972, "first_seen_epoch": "1541623291.248529" }, { "bytes": 3663, "stream": 43, "flow_id": "flow-357908e70b84d1c4f999bde2", "packets": 12, "transport": "tcp", "last_frame": 658, "first_frame": 647, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49200, "responder_port": 88, "initiator_bytes": 1825, "last_seen_epoch": "1541623291.251378", "responder_bytes": 1838, "first_seen_epoch": "1541623291.250284" }, { "bytes": 168, "stream": 29, "flow_id": "flow-1c45e10527c3417897bb20e6", "packets": 2, "transport": "udp", "last_frame": 681, "first_frame": 680, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 65142, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1541623291.790021", "responder_bytes": 92, "first_seen_epoch": "1541623291.773708" }, { "bytes": 180, "stream": 30, "flow_id": "flow-5785fc9f3d6b21823081bb3e", "packets": 2, "transport": "udp", "last_frame": 683, "first_frame": 682, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 52351, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1541623291.810157", "responder_bytes": 104, "first_seen_epoch": "1541623291.790344" }, { "bytes": 229, "stream": 31, "flow_id": "flow-1b6562100a376b029d98820c", "packets": 2, "transport": "udp", "last_frame": 685, "first_frame": 684, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 57485, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1541623305.080372", "responder_bytes": 157, "first_seen_epoch": "1541623305.055861" }, { "bytes": 7707, "stream": 44, "flow_id": "flow-46e81c127894c48907a4de1d", "packets": 35, "transport": "tcp", "last_frame": 998, "first_frame": 686, "initiator_ip": "10.22.15.119", "responder_ip": "74.6.141.28", "initiator_port": 49201, "responder_port": 993, "initiator_bytes": 1491, "last_seen_epoch": "1541623343.999721", "responder_bytes": 6216, "first_seen_epoch": "1541623305.097494" }, { "bytes": 184202, "stream": 45, "flow_id": "flow-f4ffc981d822cb3989a1a8fa", "packets": 317, "transport": "tcp", "last_frame": 1127, "first_frame": 714, "initiator_ip": "10.22.15.119", "responder_ip": "74.6.141.28", "initiator_port": 49202, "responder_port": 993, "initiator_bytes": 8589, "last_seen_epoch": "1541623501.18731", "responder_bytes": 175613, "first_seen_epoch": "1541623305.965534" }, { "bytes": 1280, "stream": 46, "flow_id": "flow-f36289d0e61c94965ff30ce8", "packets": 12, "transport": "tcp", "last_frame": 1022, "first_frame": 999, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49203, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1541623357.941989", "responder_bytes": 562, "first_seen_epoch": "1541623347.926565" }, { "bytes": 1466, "stream": 47, "flow_id": "flow-bb9c0b1e1bd0fa9c8dc4e7a9", "packets": 12, "transport": "tcp", "last_frame": 1020, "first_frame": 1006, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49204, "responder_port": 49155, "initiator_bytes": 872, "last_seen_epoch": "1541623357.94182", "responder_bytes": 594, "first_seen_epoch": "1541623347.928266" }, { "bytes": 221, "stream": 32, "flow_id": "flow-d6123cafb0b956d5daaeb42f", "packets": 2, "transport": "udp", "last_frame": 1029, "first_frame": 1028, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 50575, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1541623379.015119", "responder_bytes": 149, "first_seen_epoch": "1541623378.9259" }, { "bytes": 8985, "stream": 48, "flow_id": "flow-efae40fd168174786c6effb3", "packets": 48, "transport": "tcp", "last_frame": 1077, "first_frame": 1030, "initiator_ip": "10.22.15.119", "responder_ip": "74.6.141.50", "initiator_port": 49205, "responder_port": 465, "initiator_bytes": 2954, "last_seen_epoch": "1541623382.821692", "responder_bytes": 6031, "first_seen_epoch": "1541623379.015798" }, { "bytes": 17713, "stream": 49, "flow_id": "flow-f6cdcb91a0a8a07cb00063ad", "packets": 66, "transport": "tcp", "last_frame": 1241, "first_frame": 1128, "initiator_ip": "10.22.15.119", "responder_ip": "74.6.141.28", "initiator_port": 49206, "responder_port": 993, "initiator_bytes": 2531, "last_seen_epoch": "1541623587.811237", "responder_bytes": 15182, "first_seen_epoch": "1541623531.91907" }, { "bytes": 9177, "stream": 50, "flow_id": "flow-aff59816bc214dc0cb65f816", "packets": 48, "transport": "tcp", "last_frame": 1237, "first_frame": 1187, "initiator_ip": "10.22.15.119", "responder_ip": "74.6.141.50", "initiator_port": 49207, "responder_port": 465, "initiator_bytes": 3146, "last_seen_epoch": "1541623556.243873", "responder_bytes": 6031, "first_seen_epoch": "1541623552.004049" }, { "bytes": 164, "stream": 33, "flow_id": "flow-7d508b7ece0b3116b98ff529", "packets": 2, "transport": "udp", "last_frame": 1243, "first_frame": 1242, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 53482, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1541623631.425241", "responder_bytes": 90, "first_seen_epoch": "1541623630.882323" }, { "bytes": 468905, "stream": 51, "flow_id": "flow-015f94752181afadf602e0ca", "packets": 450, "transport": "tcp", "last_frame": 1693, "first_frame": 1244, "initiator_ip": "10.22.15.119", "responder_ip": "46.29.160.132", "initiator_port": 49208, "responder_port": 80, "initiator_bytes": 7661, "last_seen_epoch": "1541623636.559131", "responder_bytes": 461244, "first_seen_epoch": "1541623631.433683" }, { "bytes": 248, "stream": 52, "flow_id": "flow-d18a2748c67cd333e9efed5c", "packets": 4, "transport": "tcp", "last_frame": 1726, "first_frame": 1694, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.116", "initiator_port": 49209, "responder_port": 80, "initiator_bytes": 194, "last_seen_epoch": "1541623711.733681", "responder_bytes": 54, "first_seen_epoch": "1541623636.613776" }, { "bytes": 168, "stream": 34, "flow_id": "flow-e8baf9ce8cf2c5165b0f60db", "packets": 2, "transport": "udp", "last_frame": 1698, "first_frame": 1697, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 52602, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1541623657.522464", "responder_bytes": 92, "first_seen_epoch": "1541623657.50688" }, { "bytes": 180, "stream": 35, "flow_id": "flow-774bc2ebe701da153303666e", "packets": 2, "transport": "udp", "last_frame": 1700, "first_frame": 1699, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 54892, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1541623657.523396", "responder_bytes": 104, "first_seen_epoch": "1541623657.523123" }, { "bytes": 221, "stream": 36, "flow_id": "flow-109dad7d2a1dfd6fccd0a83b", "packets": 2, "transport": "udp", "last_frame": 1705, "first_frame": 1704, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 55160, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1541623699.591391", "responder_bytes": 147, "first_seen_epoch": "1541623699.520395" }, { "bytes": 220, "stream": 37, "flow_id": "flow-b07df650fdec06880eb0be71", "packets": 2, "transport": "udp", "last_frame": 1720, "first_frame": 1713, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 53148, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1541623703.066674", "responder_bytes": 148, "first_seen_epoch": "1541623703.045964" }, { "bytes": 260, "stream": 38, "flow_id": "flow-3586f5c997919c855a701ecc", "packets": 2, "transport": "udp", "last_frame": 1724, "first_frame": 1714, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 63984, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1541623703.10219", "responder_bytes": 188, "first_seen_epoch": "1541623703.056771" }, { "bytes": 271, "stream": 39, "flow_id": "flow-da4f83b6d3b99e3db8a7a0dc", "packets": 2, "transport": "udp", "last_frame": 1721, "first_frame": 1715, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 60610, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1541623703.101869", "responder_bytes": 199, "first_seen_epoch": "1541623703.057682" }, { "bytes": 231, "stream": 40, "flow_id": "flow-720ea5bcd66f3b219659af7e", "packets": 2, "transport": "udp", "last_frame": 1719, "first_frame": 1716, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 55527, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1541623703.066561", "responder_bytes": 159, "first_seen_epoch": "1541623703.058312" }, { "bytes": 271, "stream": 41, "flow_id": "flow-603751950180d1aa81adfa36", "packets": 2, "transport": "udp", "last_frame": 1722, "first_frame": 1717, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 58927, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1541623703.101986", "responder_bytes": 199, "first_seen_epoch": "1541623703.060728" }, { "bytes": 271, "stream": 42, "flow_id": "flow-6408ddba0bbbe68a836e60c5", "packets": 2, "transport": "udp", "last_frame": 1723, "first_frame": 1718, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 56200, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1541623703.102105", "responder_bytes": 199, "first_seen_epoch": "1541623703.061311" }, { "bytes": 174, "stream": 43, "flow_id": "flow-99df52b602277afc74d0fc84", "packets": 2, "transport": "udp", "last_frame": 1729, "first_frame": 1728, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 55040, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1541623725.722135", "responder_bytes": 95, "first_seen_epoch": "1541623725.437476" }, { "bytes": 183712, "stream": 53, "flow_id": "flow-9b3e7a4cc9aa93550dedf41a", "packets": 221, "transport": "tcp", "last_frame": 2232, "first_frame": 1730, "initiator_ip": "10.22.15.119", "responder_ip": "192.162.244.171", "initiator_port": 49210, "responder_port": 80, "initiator_bytes": 6350, "last_seen_epoch": "1541623732.041846", "responder_bytes": 177362, "first_seen_epoch": "1541623725.751777" }, { "bytes": 232, "stream": 54, "flow_id": "flow-181099af5780358e85c6c91e", "packets": 4, "transport": "tcp", "last_frame": 2233, "first_frame": 1731, "initiator_ip": "10.22.15.119", "responder_ip": "192.162.244.171", "initiator_port": 49211, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1541623732.041986", "responder_bytes": 58, "first_seen_epoch": "1541623725.752081" }, { "bytes": 232, "stream": 55, "flow_id": "flow-9f3b2ff5a2ba98659edd2b19", "packets": 4, "transport": "tcp", "last_frame": 2234, "first_frame": 1949, "initiator_ip": "10.22.15.119", "responder_ip": "192.162.244.171", "initiator_port": 49212, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1541623732.043628", "responder_bytes": 58, "first_seen_epoch": "1541623728.203769" }, { "bytes": 221827, "stream": 56, "flow_id": "flow-01a4f2ec0ebd60003df55823", "packets": 275, "transport": "tcp", "last_frame": 2235, "first_frame": 1950, "initiator_ip": "10.22.15.119", "responder_ip": "192.162.244.171", "initiator_port": 49213, "responder_port": 80, "initiator_bytes": 7423, "last_seen_epoch": "1541623732.043735", "responder_bytes": 214404, "first_seen_epoch": "1541623728.203972" }, { "bytes": 178, "stream": 44, "flow_id": "flow-4972a45eaa455427ae8f656a", "packets": 2, "transport": "udp", "last_frame": 2237, "first_frame": 2236, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 64493, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1541623797.226998", "responder_bytes": 97, "first_seen_epoch": "1541623797.206687" }, { "bytes": 209, "stream": 45, "flow_id": "flow-cf011e4ac97d5cfcb8a1cc82", "packets": 2, "transport": "udp", "last_frame": 2239, "first_frame": 2238, "initiator_ip": "10.22.15.119", "responder_ip": "208.67.222.222", "initiator_port": 64494, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1541623797.246082", "responder_bytes": 122, "first_seen_epoch": "1541623797.233056" }, { "bytes": 257, "stream": 46, "flow_id": "flow-1e6edcf81108c035032dbeb3", "packets": 2, "transport": "udp", "last_frame": 2241, "first_frame": 2240, "initiator_ip": "10.22.15.119", "responder_ip": "208.67.222.222", "initiator_port": 64495, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1541623797.371219", "responder_bytes": 165, "first_seen_epoch": "1541623797.246789" }, { "bytes": 257, "stream": 47, "flow_id": "flow-d9e72d0f4b868d0984ca48d6", "packets": 2, "transport": "udp", "last_frame": 2243, "first_frame": 2242, "initiator_ip": "10.22.15.119", "responder_ip": "208.67.222.222", "initiator_port": 64496, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1541623797.407306", "responder_bytes": 165, "first_seen_epoch": "1541623797.371808" }, { "bytes": 168, "stream": 48, "flow_id": "flow-5431550d97e1201ade1a1e73", "packets": 2, "transport": "udp", "last_frame": 2245, "first_frame": 2244, "initiator_ip": "10.22.15.119", "responder_ip": "208.67.222.222", "initiator_port": 64497, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1541623797.4262", "responder_bytes": 92, "first_seen_epoch": "1541623797.408013" }, { "bytes": 198, "stream": 49, "flow_id": "flow-dde5fd83c4dde09cc04a489a", "packets": 2, "transport": "udp", "last_frame": 2247, "first_frame": 2246, "initiator_ip": "10.22.15.119", "responder_ip": "208.67.222.222", "initiator_port": 64498, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1541623797.443366", "responder_bytes": 122, "first_seen_epoch": "1541623797.429411" }, { "bytes": 164, "stream": 50, "flow_id": "flow-05a16ff722320c5f489649f7", "packets": 2, "transport": "udp", "last_frame": 2252, "first_frame": 2249, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 64120, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1541623797.918025", "responder_bytes": 90, "first_seen_epoch": "1541623797.536622" }, { "bytes": 3061, "stream": 57, "flow_id": "flow-f629485dee0dc6bb35d7597b", "packets": 19, "transport": "tcp", "last_frame": 2352, "first_frame": 2253, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49214, "responder_port": 443, "initiator_bytes": 1327, "last_seen_epoch": "1541623810.458804", "responder_bytes": 1734, "first_seen_epoch": "1541623797.924464" }, { "bytes": 340, "stream": 51, "flow_id": "flow-78289cded7b6ca4dc6605008", "packets": 2, "transport": "udp", "last_frame": 2266, "first_frame": 2265, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 60931, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1541623798.576317", "responder_bytes": 250, "first_seen_epoch": "1541623798.514101" }, { "bytes": 59459, "stream": 58, "flow_id": "flow-86419ebe80d9e95edf3a0316", "packets": 61, "transport": "tcp", "last_frame": 2366, "first_frame": 2267, "initiator_ip": "10.22.15.119", "responder_ip": "72.246.64.147", "initiator_port": 49215, "responder_port": 80, "initiator_bytes": 1309, "last_seen_epoch": "1541623858.66047", "responder_bytes": 58150, "first_seen_epoch": "1541623798.578187" }, { "bytes": 3200, "stream": 59, "flow_id": "flow-c433564d5fef5a8cd5c06cb3", "packets": 20, "transport": "tcp", "last_frame": 2376, "first_frame": 2332, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49216, "responder_port": 443, "initiator_bytes": 1413, "last_seen_epoch": "1541623917.504707", "responder_bytes": 1787, "first_seen_epoch": "1541623799.261982" }, { "bytes": 3680, "stream": 60, "flow_id": "flow-39b407583986483a4825e75f", "packets": 20, "transport": "tcp", "last_frame": 2373, "first_frame": 2349, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49217, "responder_port": 443, "initiator_bytes": 1893, "last_seen_epoch": "1541623917.504369", "responder_bytes": 1787, "first_seen_epoch": "1541623810.290276" }, { "bytes": 3146, "stream": 61, "flow_id": "flow-f6657ab921e13230602867dd", "packets": 19, "transport": "tcp", "last_frame": 2414, "first_frame": 2377, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49218, "responder_port": 443, "initiator_bytes": 1359, "last_seen_epoch": "1541624137.511985", "responder_bytes": 1787, "first_seen_epoch": "1541623999.246426" }, { "bytes": 3114, "stream": 62, "flow_id": "flow-741b01b5613d433f711370b4", "packets": 19, "transport": "tcp", "last_frame": 2413, "first_frame": 2392, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49219, "responder_port": 443, "initiator_bytes": 1327, "last_seen_epoch": "1541624066.321014", "responder_bytes": 1787, "first_seen_epoch": "1541624000.27006" }, { "bytes": 6332, "stream": 63, "flow_id": "flow-53c70b0b19f8214b6029f7ee", "packets": 22, "transport": "tcp", "last_frame": 2436, "first_frame": 2415, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49220, "responder_port": 445, "initiator_bytes": 4622, "last_seen_epoch": "1541624163.8295", "responder_bytes": 1710, "first_seen_epoch": "1541624147.861842" }, { "bytes": 3061, "stream": 64, "flow_id": "flow-62ee406996546a33f9688624", "packets": 19, "transport": "tcp", "last_frame": 2475, "first_frame": 2437, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49221, "responder_port": 443, "initiator_bytes": 1327, "last_seen_epoch": "1541624212.419529", "responder_bytes": 1734, "first_seen_epoch": "1541624200.271912" }, { "bytes": 3077, "stream": 65, "flow_id": "flow-048c14d9d5dc9b244966f77c", "packets": 19, "transport": "tcp", "last_frame": 2492, "first_frame": 2452, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49222, "responder_port": 443, "initiator_bytes": 1343, "last_seen_epoch": "1541624223.759773", "responder_bytes": 1734, "first_seen_epoch": "1541624201.288347" }, { "bytes": 4065, "stream": 66, "flow_id": "flow-c41fa76547199b0e4dd9350b", "packets": 22, "transport": "tcp", "last_frame": 2519, "first_frame": 2469, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49223, "responder_port": 443, "initiator_bytes": 2224, "last_seen_epoch": "1541624320.280741", "responder_bytes": 1841, "first_seen_epoch": "1541624212.251533" }, { "bytes": 3718, "stream": 67, "flow_id": "flow-3d4d4a782d0d9b087bf39a83", "packets": 21, "transport": "tcp", "last_frame": 2516, "first_frame": 2490, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49224, "responder_port": 443, "initiator_bytes": 1877, "last_seen_epoch": "1541624320.280299", "responder_bytes": 1841, "first_seen_epoch": "1541624223.592401" }, { "bytes": 3093, "stream": 68, "flow_id": "flow-d763c37b6b96900e5ff8bc0b", "packets": 19, "transport": "tcp", "last_frame": 2576, "first_frame": 2520, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49225, "responder_port": 443, "initiator_bytes": 1359, "last_seen_epoch": "1541624414.713042", "responder_bytes": 1734, "first_seen_epoch": "1541624401.292994" }, { "bytes": 3285, "stream": 69, "flow_id": "flow-52885da68da63a78cc99ccff", "packets": 19, "transport": "tcp", "last_frame": 2603, "first_frame": 2535, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49226, "responder_port": 443, "initiator_bytes": 1359, "last_seen_epoch": "1541624425.699789", "responder_bytes": 1926, "first_seen_epoch": "1541624402.382627" }, { "bytes": 164, "stream": 52, "flow_id": "flow-5e192b45f022d63dcf480272", "packets": 2, "transport": "udp", "last_frame": 2551, "first_frame": 2550, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 53884, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1541624403.692275", "responder_bytes": 90, "first_seen_epoch": "1541624403.524417" }, { "bytes": 1299, "stream": 70, "flow_id": "flow-ceee9ee9386e903d2a8326bb", "packets": 11, "transport": "tcp", "last_frame": 2594, "first_frame": 2552, "initiator_ip": "10.22.15.119", "responder_ip": "62.149.140.59", "initiator_port": 49227, "responder_port": 80, "initiator_bytes": 515, "last_seen_epoch": "1541624421.055014", "responder_bytes": 784, "first_seen_epoch": "1541624403.693084" }, { "bytes": 172, "stream": 53, "flow_id": "flow-8fac0824ae2640eec2c851ce", "packets": 2, "transport": "udp", "last_frame": 2560, "first_frame": 2559, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 55935, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1541624404.222937", "responder_bytes": 94, "first_seen_epoch": "1541624404.006477" }, { "bytes": 1863, "stream": 71, "flow_id": "flow-9d6d0bb4bcd4aad785c757fc", "packets": 11, "transport": "tcp", "last_frame": 2592, "first_frame": 2561, "initiator_ip": "10.22.15.119", "responder_ip": "62.149.140.59", "initiator_port": 49228, "responder_port": 80, "initiator_bytes": 519, "last_seen_epoch": "1541624421.054834", "responder_bytes": 1344, "first_seen_epoch": "1541624404.223604" }, { "bytes": 3884, "stream": 72, "flow_id": "flow-74dd63f1fae66939400838c0", "packets": 22, "transport": "tcp", "last_frame": 2626, "first_frame": 2570, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49229, "responder_port": 443, "initiator_bytes": 2043, "last_seen_epoch": "1541624540.277221", "responder_bytes": 1841, "first_seen_epoch": "1541624414.536028" }, { "bytes": 3750, "stream": 73, "flow_id": "flow-252f68d5cd5a2ee30cc1e016", "packets": 21, "transport": "tcp", "last_frame": 2623, "first_frame": 2597, "initiator_ip": "10.22.15.119", "responder_ip": "95.181.198.115", "initiator_port": 49230, "responder_port": 443, "initiator_bytes": 1909, "last_seen_epoch": "1541624540.276651", "responder_bytes": 1841, "first_seen_epoch": "1541624425.518211" }, { "bytes": 178, "stream": 54, "flow_id": "flow-2dc0de78c5a5ab4ea22fbb22", "packets": 2, "transport": "udp", "last_frame": 2628, "first_frame": 2627, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 55499, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1541624602.506125", "responder_bytes": 97, "first_seen_epoch": "1541624602.394148" }, { "bytes": 10278, "stream": 74, "flow_id": "flow-f3029fc1229b28b9214eec58", "packets": 26, "transport": "tcp", "last_frame": 2670, "first_frame": 2629, "initiator_ip": "10.22.15.119", "responder_ip": "46.229.214.92", "initiator_port": 49231, "responder_port": 443, "initiator_bytes": 1496, "last_seen_epoch": "1541624614.984689", "responder_bytes": 8782, "first_seen_epoch": "1541624602.507094" }, { "bytes": 3421, "stream": 75, "flow_id": "flow-adf895ca34c1153708ffa887", "packets": 21, "transport": "tcp", "last_frame": 2695, "first_frame": 2651, "initiator_ip": "10.22.15.119", "responder_ip": "46.229.214.92", "initiator_port": 49232, "responder_port": 443, "initiator_bytes": 1484, "last_seen_epoch": "1541624760.280483", "responder_bytes": 1937, "first_seen_epoch": "1541624603.638641" }, { "bytes": 3719, "stream": 76, "flow_id": "flow-29c32488f8baa087d003f61a", "packets": 20, "transport": "tcp", "last_frame": 2692, "first_frame": 2668, "initiator_ip": "10.22.15.119", "responder_ip": "46.229.214.92", "initiator_port": 49233, "responder_port": 443, "initiator_bytes": 1948, "last_seen_epoch": "1541624760.279992", "responder_bytes": 1771, "first_seen_epoch": "1541624614.824363" }, { "bytes": 860, "stream": 55, "flow_id": "flow-be857edd0800865466604b27", "packets": 4, "transport": "udp", "last_frame": 2740, "first_frame": 2696, "initiator_ip": "10.22.15.119", "responder_ip": "239.255.255.250", "initiator_port": 55500, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1541624765.218107", "responder_bytes": 0, "first_seen_epoch": "1541624762.197551" }, { "bytes": 194, "stream": 56, "flow_id": "flow-7c614d7548a0b67f3d438e6c", "packets": 2, "transport": "udp", "last_frame": 2699, "first_frame": 2697, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 51766, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1541624762.856918", "responder_bytes": 105, "first_seen_epoch": "1541624762.530738" }, { "bytes": 174, "stream": 57, "flow_id": "flow-1e1625611ddffa7cd76e94af", "packets": 2, "transport": "udp", "last_frame": 2719, "first_frame": 2698, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 60040, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1541624763.152884", "responder_bytes": 95, "first_seen_epoch": "1541624762.854415" }, { "bytes": 492, "stream": 58, "flow_id": "flow-ca481f23c0d43a33ca242aaa", "packets": 6, "transport": "udp", "last_frame": 3437, "first_frame": 2701, "initiator_ip": "10.22.15.119", "responder_ip": "224.0.0.251", "initiator_port": 5353, "responder_port": 5353, "initiator_bytes": 492, "last_seen_epoch": "1541624797.584679", "responder_bytes": 0, "first_seen_epoch": "1541624762.860037" }, { "bytes": 5564, "stream": 77, "flow_id": "flow-52979fee28adca7570966574", "packets": 20, "transport": "tcp", "last_frame": 2819, "first_frame": 2702, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.35", "initiator_port": 49234, "responder_port": 443, "initiator_bytes": 1541, "last_seen_epoch": "1541624789.860146", "responder_bytes": 4023, "first_seen_epoch": "1541624762.867954" }, { "bytes": 8182, "stream": 78, "flow_id": "flow-480e9bf9c1bc7ac11cebcf7b", "packets": 21, "transport": "tcp", "last_frame": 2816, "first_frame": 2720, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.45", "initiator_port": 49235, "responder_port": 443, "initiator_bytes": 2013, "last_seen_epoch": "1541624789.855603", "responder_bytes": 6169, "first_seen_epoch": "1541624763.156101" }, { "bytes": 164, "stream": 59, "flow_id": "flow-bd1f14992df9676ec96df24c", "packets": 2, "transport": "udp", "last_frame": 2743, "first_frame": 2742, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 57109, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1541624767.479203", "responder_bytes": 90, "first_seen_epoch": "1541624767.161679" }, { "bytes": 5948, "stream": 79, "flow_id": "flow-0fef2f1e33efb42d8f73ab01", "packets": 22, "transport": "tcp", "last_frame": 2817, "first_frame": 2744, "initiator_ip": "10.22.15.119", "responder_ip": "172.217.2.68", "initiator_port": 49236, "responder_port": 443, "initiator_bytes": 1870, "last_seen_epoch": "1541624789.855656", "responder_bytes": 4078, "first_seen_epoch": "1541624767.480152" }, { "bytes": 249, "stream": 60, "flow_id": "flow-756f95ae8d97112cc511aa02", "packets": 2, "transport": "udp", "last_frame": 2763, "first_frame": 2762, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 60412, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1541624769.236532", "responder_bytes": 163, "first_seen_epoch": "1541624769.235989" }, { "bytes": 257, "stream": 61, "flow_id": "flow-31a617c7f7a74e44e5532135", "packets": 2, "transport": "udp", "last_frame": 2766, "first_frame": 2764, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 62444, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1541624769.238347", "responder_bytes": 167, "first_seen_epoch": "1541624769.238004" }, { "bytes": 239, "stream": 62, "flow_id": "flow-aa21cc73e271e8834a399644", "packets": 2, "transport": "udp", "last_frame": 2771, "first_frame": 2765, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 52199, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1541624769.44504", "responder_bytes": 157, "first_seen_epoch": "1541624769.238088" }, { "bytes": 259, "stream": 63, "flow_id": "flow-b3eb2e9c027c585df818d45f", "packets": 2, "transport": "udp", "last_frame": 2768, "first_frame": 2767, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 59038, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1541624769.238877", "responder_bytes": 168, "first_seen_epoch": "1541624769.238681" }, { "bytes": 247, "stream": 64, "flow_id": "flow-b173cb5f2ceafc702e034ecb", "packets": 2, "transport": "udp", "last_frame": 2772, "first_frame": 2769, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 59493, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1541624769.445501", "responder_bytes": 161, "first_seen_epoch": "1541624769.239971" }, { "bytes": 249, "stream": 65, "flow_id": "flow-96ffa7b399693d2d6361ea28", "packets": 2, "transport": "udp", "last_frame": 2775, "first_frame": 2770, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 64061, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1541624769.529988", "responder_bytes": 162, "first_seen_epoch": "1541624769.240233" }, { "bytes": 140, "stream": 66, "flow_id": "flow-4a7ff4f553521fb74f793e5f", "packets": 2, "transport": "udp", "last_frame": 2778, "first_frame": 2773, "initiator_ip": "10.22.15.119", "responder_ip": "224.0.0.252", "initiator_port": 61357, "responder_port": 5355, "initiator_bytes": 140, "last_seen_epoch": "1541624769.558205", "responder_bytes": 0, "first_seen_epoch": "1541624769.446963" }, { "bytes": 148, "stream": 67, "flow_id": "flow-89d281469856a5048fc6b90a", "packets": 2, "transport": "udp", "last_frame": 2777, "first_frame": 2774, "initiator_ip": "10.22.15.119", "responder_ip": "224.0.0.252", "initiator_port": 55404, "responder_port": 5355, "initiator_bytes": 148, "last_seen_epoch": "1541624769.558079", "responder_bytes": 0, "first_seen_epoch": "1541624769.4474" }, { "bytes": 150, "stream": 68, "flow_id": "flow-d953bf025ee615cdb29c5ac2", "packets": 2, "transport": "udp", "last_frame": 2779, "first_frame": 2776, "initiator_ip": "10.22.15.119", "responder_ip": "224.0.0.252", "initiator_port": 53478, "responder_port": 5355, "initiator_bytes": 150, "last_seen_epoch": "1541624769.635418", "responder_bytes": 0, "first_seen_epoch": "1541624769.531843" }, { "bytes": 184, "stream": 69, "flow_id": "flow-26957068da6bd73dc590376b", "packets": 2, "transport": "udp", "last_frame": 2790, "first_frame": 2789, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 50078, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1541624778.225835", "responder_bytes": 100, "first_seen_epoch": "1541624778.193456" }, { "bytes": 6371, "stream": 80, "flow_id": "flow-c3ba824d5df17c3d67f3f930", "packets": 19, "transport": "tcp", "last_frame": 2822, "first_frame": 2791, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.42", "initiator_port": 49237, "responder_port": 443, "initiator_bytes": 1478, "last_seen_epoch": "1541624789.867112", "responder_bytes": 4893, "first_seen_epoch": "1541624778.226528" }, { "bytes": 860, "stream": 70, "flow_id": "flow-5e5924109da479071ffa1685", "packets": 4, "transport": "udp", "last_frame": 3436, "first_frame": 2824, "initiator_ip": "10.22.15.119", "responder_ip": "239.255.255.250", "initiator_port": 50079, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1541624796.959614", "responder_bytes": 0, "first_seen_epoch": "1541624793.957286" }, { "bytes": 5837, "stream": 81, "flow_id": "flow-00cc0695753b0e4b9b9d7ee4", "packets": 25, "transport": "tcp", "last_frame": 10129, "first_frame": 2825, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.35", "initiator_port": 49238, "responder_port": 443, "initiator_bytes": 1706, "last_seen_epoch": "1541624952.034233", "responder_bytes": 4131, "first_seen_epoch": "1541624794.359647" }, { "bytes": 7487, "stream": 82, "flow_id": "flow-74f5c62d0a54a63a680eae98", "packets": 28, "transport": "tcp", "last_frame": 10092, "first_frame": 2836, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.45", "initiator_port": 49239, "responder_port": 443, "initiator_bytes": 2232, "last_seen_epoch": "1541624952.025845", "responder_bytes": 5255, "first_seen_epoch": "1541624794.491096" }, { "bytes": 566270, "stream": 83, "flow_id": "flow-9f3350c08d32d5969565776c", "packets": 709, "transport": "tcp", "last_frame": 10130, "first_frame": 2837, "initiator_ip": "10.22.15.119", "responder_ip": "172.217.2.68", "initiator_port": 49240, "responder_port": 443, "initiator_bytes": 55517, "last_seen_epoch": "1541624952.034276", "responder_bytes": 510753, "first_seen_epoch": "1541624794.500614" }, { "bytes": 206, "stream": 71, "flow_id": "flow-f5dd203ae7e2579f188ce33a", "packets": 2, "transport": "udp", "last_frame": 2962, "first_frame": 2954, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 53487, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1541624794.815584", "responder_bytes": 129, "first_seen_epoch": "1541624794.787349" }, { "bytes": 41055, "stream": 84, "flow_id": "flow-d704c04e75d01006931e0786", "packets": 60, "transport": "tcp", "last_frame": 10087, "first_frame": 2963, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.35", "initiator_port": 49241, "responder_port": 443, "initiator_bytes": 2797, "last_seen_epoch": "1541624952.024678", "responder_bytes": 38258, "first_seen_epoch": "1541624794.816326" }, { "bytes": 1399, "stream": 85, "flow_id": "flow-caf12e316a8a25dd6aa378f0", "packets": 12, "transport": "tcp", "last_frame": 3485, "first_frame": 2974, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.35", "initiator_port": 49242, "responder_port": 443, "initiator_bytes": 909, "last_seen_epoch": "1541624806.66727", "responder_bytes": 490, "first_seen_epoch": "1541624794.867556" }, { "bytes": 166, "stream": 72, "flow_id": "flow-bbb83971bceb7ace36a78b64", "packets": 2, "transport": "udp", "last_frame": 3029, "first_frame": 3002, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 51411, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1541624794.934525", "responder_bytes": 91, "first_seen_epoch": "1541624794.904273" }, { "bytes": 166, "stream": 73, "flow_id": "flow-dd1276937c32dedcfd030743", "packets": 2, "transport": "udp", "last_frame": 3028, "first_frame": 3005, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 52875, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1541624794.934417", "responder_bytes": 91, "first_seen_epoch": "1541624794.905693" }, { "bytes": 60588, "stream": 86, "flow_id": "flow-0ac81bbf03e08ff0f42f62f2", "packets": 78, "transport": "tcp", "last_frame": 10118, "first_frame": 3030, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.35", "initiator_port": 49243, "responder_port": 443, "initiator_bytes": 3330, "last_seen_epoch": "1541624952.032038", "responder_bytes": 57258, "first_seen_epoch": "1541624794.936297" }, { "bytes": 15723, "stream": 87, "flow_id": "flow-fdb263b5fae1b280f96fe74a", "packets": 34, "transport": "tcp", "last_frame": 10119, "first_frame": 3031, "initiator_ip": "10.22.15.119", "responder_ip": "172.217.3.67", "initiator_port": 49244, "responder_port": 443, "initiator_bytes": 2051, "last_seen_epoch": "1541624952.032078", "responder_bytes": 13672, "first_seen_epoch": "1541624794.936615" }, { "bytes": 422909, "stream": 88, "flow_id": "flow-8092c4ebaac8510529e82851", "packets": 476, "transport": "tcp", "last_frame": 10131, "first_frame": 3032, "initiator_ip": "10.22.15.119", "responder_ip": "172.217.2.68", "initiator_port": 49245, "responder_port": 443, "initiator_bytes": 27016, "last_seen_epoch": "1541624952.034329", "responder_bytes": 395893, "first_seen_epoch": "1541624794.942198" }, { "bytes": 187, "stream": 74, "flow_id": "flow-639a48f23a06cc3087978171", "packets": 2, "transport": "udp", "last_frame": 3302, "first_frame": 3301, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 51756, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1541624795.441778", "responder_bytes": 112, "first_seen_epoch": "1541624795.412335" }, { "bytes": 58624, "stream": 89, "flow_id": "flow-3753f5c40488f5e378575c95", "packets": 76, "transport": "tcp", "last_frame": 10101, "first_frame": 3303, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.46", "initiator_port": 49246, "responder_port": 443, "initiator_bytes": 3068, "last_seen_epoch": "1541624952.028405", "responder_bytes": 55556, "first_seen_epoch": "1541624795.442661" }, { "bytes": 216, "stream": 75, "flow_id": "flow-c5bc27aac372033b1113e8a0", "packets": 2, "transport": "udp", "last_frame": 3416, "first_frame": 3415, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 61298, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1541624795.663259", "responder_bytes": 136, "first_seen_epoch": "1541624795.634633" }, { "bytes": 15468, "stream": 90, "flow_id": "flow-1d20518e5a0e407b57b226a9", "packets": 43, "transport": "tcp", "last_frame": 10104, "first_frame": 3417, "initiator_ip": "10.22.15.119", "responder_ip": "172.217.3.66", "initiator_port": 49247, "responder_port": 443, "initiator_bytes": 5421, "last_seen_epoch": "1541624952.028636", "responder_bytes": 10047, "first_seen_epoch": "1541624795.667078" }, { "bytes": 243, "stream": 76, "flow_id": "flow-ebaa57dc0b9f844b73bfac21", "packets": 2, "transport": "udp", "last_frame": 3455, "first_frame": 3453, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 61608, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1541624800.935184", "responder_bytes": 160, "first_seen_epoch": "1541624800.934735" }, { "bytes": 247, "stream": 77, "flow_id": "flow-d08c17146d8b8ec70a4cbb64", "packets": 2, "transport": "udp", "last_frame": 3456, "first_frame": 3454, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 56977, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1541624800.935321", "responder_bytes": 162, "first_seen_epoch": "1541624800.93485" }, { "bytes": 233, "stream": 78, "flow_id": "flow-3cd2617bd50312d3cc1400c7", "packets": 2, "transport": "udp", "last_frame": 3465, "first_frame": 3457, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 55322, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1541624800.977934", "responder_bytes": 154, "first_seen_epoch": "1541624800.935729" }, { "bytes": 237, "stream": 79, "flow_id": "flow-d4bc91cbe0fec94541b5b9a8", "packets": 2, "transport": "udp", "last_frame": 3462, "first_frame": 3458, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 63090, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1541624800.976625", "responder_bytes": 156, "first_seen_epoch": "1541624800.935933" }, { "bytes": 243, "stream": 80, "flow_id": "flow-f2883468dd17f3fc9bacef60", "packets": 2, "transport": "udp", "last_frame": 3460, "first_frame": 3459, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 51977, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1541624800.937265", "responder_bytes": 160, "first_seen_epoch": "1541624800.937038" }, { "bytes": 233, "stream": 81, "flow_id": "flow-260fab9ce6c3a465335f78c3", "packets": 2, "transport": "udp", "last_frame": 3464, "first_frame": 3461, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 50439, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1541624800.97749", "responder_bytes": 154, "first_seen_epoch": "1541624800.938209" }, { "bytes": 138, "stream": 82, "flow_id": "flow-e9e8aacf206fb8f0e83eac3e", "packets": 2, "transport": "udp", "last_frame": 3470, "first_frame": 3463, "initiator_ip": "10.22.15.119", "responder_ip": "224.0.0.252", "initiator_port": 53626, "responder_port": 5355, "initiator_bytes": 138, "last_seen_epoch": "1541624801.073712", "responder_bytes": 0, "first_seen_epoch": "1541624800.977277" }, { "bytes": 134, "stream": 83, "flow_id": "flow-f482ef58fe7e9c51407b6dde", "packets": 2, "transport": "udp", "last_frame": 3468, "first_frame": 3466, "initiator_ip": "10.22.15.119", "responder_ip": "224.0.0.252", "initiator_port": 53718, "responder_port": 5355, "initiator_bytes": 134, "last_seen_epoch": "1541624801.073369", "responder_bytes": 0, "first_seen_epoch": "1541624800.978119" }, { "bytes": 134, "stream": 84, "flow_id": "flow-d968a56f31513affbe8cadc9", "packets": 2, "transport": "udp", "last_frame": 3469, "first_frame": 3467, "initiator_ip": "10.22.15.119", "responder_ip": "224.0.0.252", "initiator_port": 55623, "responder_port": 5355, "initiator_bytes": 134, "last_seen_epoch": "1541624801.073527", "responder_bytes": 0, "first_seen_epoch": "1541624800.978381" }, { "bytes": 1606, "stream": 91, "flow_id": "flow-be74c1a5fd4b5f31c5db0336", "packets": 12, "transport": "tcp", "last_frame": 3979, "first_frame": 3573, "initiator_ip": "10.22.15.119", "responder_ip": "172.217.2.68", "initiator_port": 49248, "responder_port": 443, "initiator_bytes": 1112, "last_seen_epoch": "1541624826.806071", "responder_bytes": 494, "first_seen_epoch": "1541624810.097616" }, { "bytes": 1606, "stream": 92, "flow_id": "flow-dfa2b6abb09a1f76b535dd63", "packets": 12, "transport": "tcp", "last_frame": 3981, "first_frame": 3580, "initiator_ip": "10.22.15.119", "responder_ip": "172.217.2.68", "initiator_port": 49249, "responder_port": 443, "initiator_bytes": 1112, "last_seen_epoch": "1541624826.806143", "responder_bytes": 494, "first_seen_epoch": "1541624810.128591" }, { "bytes": 181, "stream": 85, "flow_id": "flow-e5668e1289fdbaf7c7458d15", "packets": 2, "transport": "udp", "last_frame": 3706, "first_frame": 3703, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49981, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1541624810.900411", "responder_bytes": 108, "first_seen_epoch": "1541624810.86933" }, { "bytes": 7647, "stream": 93, "flow_id": "flow-85ceeba5dcdd50a27836ffa2", "packets": 25, "transport": "tcp", "last_frame": 10127, "first_frame": 3707, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.67", "initiator_port": 49250, "responder_port": 443, "initiator_bytes": 2292, "last_seen_epoch": "1541624952.034139", "responder_bytes": 5355, "first_seen_epoch": "1541624810.901493" }, { "bytes": 188, "stream": 86, "flow_id": "flow-ee9a655ab7ca98535a8fb262", "packets": 2, "transport": "udp", "last_frame": 3827, "first_frame": 3810, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 52927, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1541624811.300199", "responder_bytes": 102, "first_seen_epoch": "1541624811.266452" }, { "bytes": 9956, "stream": 94, "flow_id": "flow-6627ca83483f4c27b5333a55", "packets": 28, "transport": "tcp", "last_frame": 10107, "first_frame": 3828, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.46", "initiator_port": 49251, "responder_port": 443, "initiator_bytes": 2005, "last_seen_epoch": "1541624952.028797", "responder_bytes": 7951, "first_seen_epoch": "1541624811.300908" }, { "bytes": 11083, "stream": 95, "flow_id": "flow-b3ad6e3d50cb129ab9fa221b", "packets": 31, "transport": "tcp", "last_frame": 10108, "first_frame": 3829, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.46", "initiator_port": 49252, "responder_port": 443, "initiator_bytes": 2570, "last_seen_epoch": "1541624952.028832", "responder_bytes": 8513, "first_seen_epoch": "1541624811.301073" }, { "bytes": 9733, "stream": 96, "flow_id": "flow-f94d05fee15ecf87239cd76e", "packets": 28, "transport": "tcp", "last_frame": 10097, "first_frame": 3830, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.46", "initiator_port": 49253, "responder_port": 443, "initiator_bytes": 2004, "last_seen_epoch": "1541624952.028295", "responder_bytes": 7729, "first_seen_epoch": "1541624811.301221" }, { "bytes": 12407, "stream": 97, "flow_id": "flow-5bd48e721087f7588d76ddce", "packets": 31, "transport": "tcp", "last_frame": 10088, "first_frame": 3831, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.46", "initiator_port": 49254, "responder_port": 443, "initiator_bytes": 2059, "last_seen_epoch": "1541624952.024836", "responder_bytes": 10348, "first_seen_epoch": "1541624811.301364" }, { "bytes": 10037, "stream": 98, "flow_id": "flow-adbb8108338f0933bdbc6d90", "packets": 28, "transport": "tcp", "last_frame": 10106, "first_frame": 3832, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.46", "initiator_port": 49255, "responder_port": 443, "initiator_bytes": 2005, "last_seen_epoch": "1541624952.028749", "responder_bytes": 8032, "first_seen_epoch": "1541624811.301645" }, { "bytes": 10393, "stream": 99, "flow_id": "flow-b326d6229f18bc50db0c94c8", "packets": 28, "transport": "tcp", "last_frame": 10090, "first_frame": 3833, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.46", "initiator_port": 49256, "responder_port": 443, "initiator_bytes": 2004, "last_seen_epoch": "1541624952.025594", "responder_bytes": 8389, "first_seen_epoch": "1541624811.301888" }, { "bytes": 1606, "stream": 100, "flow_id": "flow-12fb57d65baac4a3110bf65b", "packets": 12, "transport": "tcp", "last_frame": 4533, "first_frame": 4456, "initiator_ip": "10.22.15.119", "responder_ip": "172.217.2.68", "initiator_port": 49257, "responder_port": 443, "initiator_bytes": 1112, "last_seen_epoch": "1541624858.565409", "responder_bytes": 494, "first_seen_epoch": "1541624844.597979" }, { "bytes": 9838, "stream": 101, "flow_id": "flow-562626edebb9fdef650d1109", "packets": 26, "transport": "tcp", "last_frame": 10121, "first_frame": 4486, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.35", "initiator_port": 49258, "responder_port": 443, "initiator_bytes": 1596, "last_seen_epoch": "1541624952.033351", "responder_bytes": 8242, "first_seen_epoch": "1541624853.865707" }, { "bytes": 198, "stream": 87, "flow_id": "flow-0672641e5df48b76254bbb3a", "packets": 2, "transport": "udp", "last_frame": 4501, "first_frame": 4491, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 53985, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1541624853.951935", "responder_bytes": 119, "first_seen_epoch": "1541624853.912838" }, { "bytes": 6730, "stream": 102, "flow_id": "flow-5b868799e6ac0f7d7906f9f3", "packets": 23, "transport": "tcp", "last_frame": 10073, "first_frame": 4502, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.46", "initiator_port": 49259, "responder_port": 443, "initiator_bytes": 1604, "last_seen_epoch": "1541624952.018634", "responder_bytes": 5126, "first_seen_epoch": "1541624853.952803" }, { "bytes": 168, "stream": 88, "flow_id": "flow-1b138f467e1658a07d1986b5", "packets": 2, "transport": "udp", "last_frame": 4544, "first_frame": 4538, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 54984, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1541624858.654111", "responder_bytes": 92, "first_seen_epoch": "1541624858.58054" }, { "bytes": 422464, "stream": 103, "flow_id": "flow-8ff4be230bc64ae8a28ce4c5", "packets": 452, "transport": "tcp", "last_frame": 10154, "first_frame": 4545, "initiator_ip": "10.22.15.119", "responder_ip": "132.194.7.45", "initiator_port": 49260, "responder_port": 80, "initiator_bytes": 21164, "last_seen_epoch": "1541624952.116143", "responder_bytes": 401300, "first_seen_epoch": "1541624858.654697" }, { "bytes": 520426, "stream": 104, "flow_id": "flow-d921082827e503b2e1c07753", "packets": 544, "transport": "tcp", "last_frame": 10159, "first_frame": 4558, "initiator_ip": "10.22.15.119", "responder_ip": "132.194.7.45", "initiator_port": 49261, "responder_port": 80, "initiator_bytes": 23513, "last_seen_epoch": "1541624952.118633", "responder_bytes": 496913, "first_seen_epoch": "1541624859.108288" }, { "bytes": 585645, "stream": 105, "flow_id": "flow-467529c5eb28532c5d92931e", "packets": 611, "transport": "tcp", "last_frame": 10155, "first_frame": 4559, "initiator_ip": "10.22.15.119", "responder_ip": "132.194.7.45", "initiator_port": 49262, "responder_port": 80, "initiator_bytes": 25681, "last_seen_epoch": "1541624952.116229", "responder_bytes": 559964, "first_seen_epoch": "1541624859.10885" }, { "bytes": 429955, "stream": 106, "flow_id": "flow-67cd9e096ef62e9eeaeb14ce", "packets": 439, "transport": "tcp", "last_frame": 10147, "first_frame": 4560, "initiator_ip": "10.22.15.119", "responder_ip": "132.194.7.45", "initiator_port": 49263, "responder_port": 80, "initiator_bytes": 18581, "last_seen_epoch": "1541624952.096866", "responder_bytes": 411374, "first_seen_epoch": "1541624859.109446" }, { "bytes": 364046, "stream": 107, "flow_id": "flow-08a62e5c2e592297125c82e5", "packets": 392, "transport": "tcp", "last_frame": 10157, "first_frame": 4561, "initiator_ip": "10.22.15.119", "responder_ip": "132.194.7.45", "initiator_port": 49264, "responder_port": 80, "initiator_bytes": 19505, "last_seen_epoch": "1541624952.117527", "responder_bytes": 344541, "first_seen_epoch": "1541624859.110528" }, { "bytes": 1576163, "stream": 108, "flow_id": "flow-c6a1f80911cb59f6dab38227", "packets": 1586, "transport": "tcp", "last_frame": 10149, "first_frame": 4562, "initiator_ip": "10.22.15.119", "responder_ip": "132.194.7.45", "initiator_port": 49265, "responder_port": 80, "initiator_bytes": 45492, "last_seen_epoch": "1541624952.097175", "responder_bytes": 1530671, "first_seen_epoch": "1541624859.111472" }, { "bytes": 211, "stream": 89, "flow_id": "flow-94595dc2f86811de5dc2ba63", "packets": 2, "transport": "udp", "last_frame": 5274, "first_frame": 5266, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 54297, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1541624860.397101", "responder_bytes": 124, "first_seen_epoch": "1541624860.363489" }, { "bytes": 228, "stream": 90, "flow_id": "flow-5867ddd58ad5641c0139fd42", "packets": 2, "transport": "udp", "last_frame": 5275, "first_frame": 5271, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 54257, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1541624860.397205", "responder_bytes": 144, "first_seen_epoch": "1541624860.364107" }, { "bytes": 29034, "stream": 109, "flow_id": "flow-929ea1b48e467211b3615452", "packets": 48, "transport": "tcp", "last_frame": 10128, "first_frame": 5276, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.46", "initiator_port": 49266, "responder_port": 80, "initiator_bytes": 5857, "last_seen_epoch": "1541624952.03419", "responder_bytes": 23177, "first_seen_epoch": "1541624860.397631" }, { "bytes": 9726, "stream": 110, "flow_id": "flow-bdb8c31cf8ae08d816b654ad", "packets": 28, "transport": "tcp", "last_frame": 10105, "first_frame": 5277, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.38", "initiator_port": 49267, "responder_port": 443, "initiator_bytes": 3019, "last_seen_epoch": "1541624952.028702", "responder_bytes": 6707, "first_seen_epoch": "1541624860.397894" }, { "bytes": 198, "stream": 91, "flow_id": "flow-41e00d669ab1e5649dc629c1", "packets": 2, "transport": "udp", "last_frame": 5477, "first_frame": 5457, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 51403, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1541624860.547098", "responder_bytes": 119, "first_seen_epoch": "1541624860.516907" }, { "bytes": 8266, "stream": 111, "flow_id": "flow-1355abc65e7a3d0e50525341", "packets": 26, "transport": "tcp", "last_frame": 10074, "first_frame": 5478, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.46", "initiator_port": 49268, "responder_port": 443, "initiator_bytes": 2261, "last_seen_epoch": "1541624952.018752", "responder_bytes": 6005, "first_seen_epoch": "1541624860.54774" }, { "bytes": 343, "stream": 92, "flow_id": "flow-6064e0c01140d98995a3ca91", "packets": 2, "transport": "udp", "last_frame": 5746, "first_frame": 5689, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 58475, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1541624860.680901", "responder_bytes": 265, "first_seen_epoch": "1541624860.650537" }, { "bytes": 191, "stream": 93, "flow_id": "flow-e5e6200eca3265cacdeb1b44", "packets": 2, "transport": "udp", "last_frame": 5925, "first_frame": 5691, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 50386, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1541624860.792162", "responder_bytes": 121, "first_seen_epoch": "1541624860.659079" }, { "bytes": 226, "stream": 94, "flow_id": "flow-1e55bd208f80a500378123fb", "packets": 2, "transport": "udp", "last_frame": 5835, "first_frame": 5714, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 59558, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1541624860.731333", "responder_bytes": 149, "first_seen_epoch": "1541624860.665729" }, { "bytes": 252, "stream": 95, "flow_id": "flow-a868a735cb5bf13738a806d9", "packets": 2, "transport": "udp", "last_frame": 5783, "first_frame": 5715, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 64083, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1541624860.705335", "responder_bytes": 169, "first_seen_epoch": "1541624860.667178" }, { "bytes": 6558, "stream": 112, "flow_id": "flow-d77afd8536f3e4089b089bf0", "packets": 21, "transport": "tcp", "last_frame": 10032, "first_frame": 5751, "initiator_ip": "10.22.15.119", "responder_ip": "54.86.197.0", "initiator_port": 49269, "responder_port": 443, "initiator_bytes": 1790, "last_seen_epoch": "1541624952.005773", "responder_bytes": 4768, "first_seen_epoch": "1541624860.691044" }, { "bytes": 6669, "stream": 113, "flow_id": "flow-6151ce237916ff98012ef125", "packets": 22, "transport": "tcp", "last_frame": 10135, "first_frame": 5787, "initiator_ip": "10.22.15.119", "responder_ip": "172.217.193.155", "initiator_port": 49270, "responder_port": 443, "initiator_bytes": 1975, "last_seen_epoch": "1541624952.054722", "responder_bytes": 4694, "first_seen_epoch": "1541624860.706034" }, { "bytes": 6139, "stream": 114, "flow_id": "flow-ae442e8f090ef70b417ac38f", "packets": 22, "transport": "tcp", "last_frame": 8658, "first_frame": 5837, "initiator_ip": "10.22.15.119", "responder_ip": "209.15.36.22", "initiator_port": 49271, "responder_port": 443, "initiator_bytes": 1824, "last_seen_epoch": "1541624894.166584", "responder_bytes": 4315, "first_seen_epoch": "1541624860.731788" }, { "bytes": 6015, "stream": 115, "flow_id": "flow-fd8579912ce74b397da6ef25", "packets": 21, "transport": "tcp", "last_frame": 8660, "first_frame": 5838, "initiator_ip": "10.22.15.119", "responder_ip": "209.15.36.22", "initiator_port": 49272, "responder_port": 443, "initiator_bytes": 1696, "last_seen_epoch": "1541624894.166681", "responder_bytes": 4319, "first_seen_epoch": "1541624860.731979" }, { "bytes": 6616, "stream": 116, "flow_id": "flow-817c684adb3bf59d1be00031", "packets": 22, "transport": "tcp", "last_frame": 8652, "first_frame": 5926, "initiator_ip": "10.22.15.119", "responder_ip": "50.116.194.23", "initiator_port": 49273, "responder_port": 443, "initiator_bytes": 2040, "last_seen_epoch": "1541624894.166276", "responder_bytes": 4576, "first_seen_epoch": "1541624860.792661" }, { "bytes": 199, "stream": 96, "flow_id": "flow-94ba33f1f87dda8c6fefb567", "packets": 2, "transport": "udp", "last_frame": 6044, "first_frame": 6038, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 59761, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1541624860.904837", "responder_bytes": 119, "first_seen_epoch": "1541624860.873606" }, { "bytes": 6923, "stream": 117, "flow_id": "flow-e03eeab958a879769c16c3a3", "packets": 22, "transport": "tcp", "last_frame": 10109, "first_frame": 6047, "initiator_ip": "10.22.15.119", "responder_ip": "172.217.15.194", "initiator_port": 49274, "responder_port": 443, "initiator_bytes": 2110, "last_seen_epoch": "1541624952.02888", "responder_bytes": 4813, "first_seen_epoch": "1541624860.906757" }, { "bytes": 174, "stream": 97, "flow_id": "flow-3da1680587880c3d7836150a", "packets": 2, "transport": "udp", "last_frame": 6297, "first_frame": 6296, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 54691, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1541624861.02446", "responder_bytes": 95, "first_seen_epoch": "1541624861.02421" }, { "bytes": 7603, "stream": 118, "flow_id": "flow-95e77d75657dcd4a5b64006c", "packets": 22, "transport": "tcp", "last_frame": 8663, "first_frame": 6298, "initiator_ip": "10.22.15.119", "responder_ip": "209.15.36.22", "initiator_port": 49275, "responder_port": 443, "initiator_bytes": 1826, "last_seen_epoch": "1541624894.166841", "responder_bytes": 5777, "first_seen_epoch": "1541624861.024812" }, { "bytes": 7795, "stream": 119, "flow_id": "flow-68be176d675a5b7791b8daeb", "packets": 25, "transport": "tcp", "last_frame": 8666, "first_frame": 6299, "initiator_ip": "10.22.15.119", "responder_ip": "209.15.36.22", "initiator_port": 49276, "responder_port": 443, "initiator_bytes": 2626, "last_seen_epoch": "1541624894.166943", "responder_bytes": 5169, "first_seen_epoch": "1541624861.02502" }, { "bytes": 321, "stream": 98, "flow_id": "flow-833a0606a0d27fd57e312769", "packets": 2, "transport": "udp", "last_frame": 6328, "first_frame": 6307, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49505, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1541624861.092413", "responder_bytes": 245, "first_seen_epoch": "1541624861.058439" }, { "bytes": 7156, "stream": 120, "flow_id": "flow-47595ad0e0f59e024a19b8e3", "packets": 22, "transport": "tcp", "last_frame": 10035, "first_frame": 6329, "initiator_ip": "10.22.15.119", "responder_ip": "34.192.39.141", "initiator_port": 49277, "responder_port": 443, "initiator_bytes": 2086, "last_seen_epoch": "1541624952.005946", "responder_bytes": 5070, "first_seen_epoch": "1541624861.092998" }, { "bytes": 267, "stream": 99, "flow_id": "flow-8965b4099b86456442f3d455", "packets": 2, "transport": "udp", "last_frame": 6445, "first_frame": 6437, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 59576, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1541624861.327626", "responder_bytes": 183, "first_seen_epoch": "1541624861.269826" }, { "bytes": 379, "stream": 100, "flow_id": "flow-ef4540de06843d8beed927fe", "packets": 2, "transport": "udp", "last_frame": 6447, "first_frame": 6440, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 53871, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1541624861.32952", "responder_bytes": 305, "first_seen_epoch": "1541624861.311811" }, { "bytes": 166, "stream": 101, "flow_id": "flow-ff3a5ce83f8c1ed0fc237052", "packets": 2, "transport": "udp", "last_frame": 6460, "first_frame": 6441, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 52041, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1541624861.372243", "responder_bytes": 91, "first_seen_epoch": "1541624861.312992" }, { "bytes": 255, "stream": 102, "flow_id": "flow-72932ddd90794c69a5114938", "packets": 2, "transport": "udp", "last_frame": 6456, "first_frame": 6442, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 51696, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1541624861.362801", "responder_bytes": 177, "first_seen_epoch": "1541624861.318587" }, { "bytes": 274, "stream": 103, "flow_id": "flow-a94e43864feefa4b33935e7b", "packets": 2, "transport": "udp", "last_frame": 6458, "first_frame": 6443, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 62493, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1541624861.368818", "responder_bytes": 201, "first_seen_epoch": "1541624861.318677" }, { "bytes": 368, "stream": 104, "flow_id": "flow-066a61725e3129df17ed4c31", "packets": 2, "transport": "udp", "last_frame": 6449, "first_frame": 6444, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 62548, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1541624861.335497", "responder_bytes": 291, "first_seen_epoch": "1541624861.321007" }, { "bytes": 11664, "stream": 121, "flow_id": "flow-597dba8be03225a38630db5c", "packets": 29, "transport": "tcp", "last_frame": 10112, "first_frame": 6446, "initiator_ip": "10.22.15.119", "responder_ip": "23.56.194.57", "initiator_port": 49278, "responder_port": 443, "initiator_bytes": 2711, "last_seen_epoch": "1541624952.030003", "responder_bytes": 8953, "first_seen_epoch": "1541624861.328146" }, { "bytes": 7354, "stream": 122, "flow_id": "flow-b3e7a56cba0e828f33b0a5d9", "packets": 26, "transport": "tcp", "last_frame": 10012, "first_frame": 6448, "initiator_ip": "10.22.15.119", "responder_ip": "52.214.151.124", "initiator_port": 49279, "responder_port": 443, "initiator_bytes": 1812, "last_seen_epoch": "1541624952.004821", "responder_bytes": 5542, "first_seen_epoch": "1541624861.330289" }, { "bytes": 10869, "stream": 123, "flow_id": "flow-40268f2e210edb45733315b6", "packets": 30, "transport": "tcp", "last_frame": 8649, "first_frame": 6450, "initiator_ip": "10.22.15.119", "responder_ip": "34.227.43.215", "initiator_port": 49280, "responder_port": 443, "initiator_bytes": 2299, "last_seen_epoch": "1541624894.165906", "responder_bytes": 8570, "first_seen_epoch": "1541624861.335895" }, { "bytes": 11974, "stream": 124, "flow_id": "flow-e35872549eca294e6eb16cc8", "packets": 29, "transport": "tcp", "last_frame": 8655, "first_frame": 6457, "initiator_ip": "10.22.15.119", "responder_ip": "63.251.240.12", "initiator_port": 49281, "responder_port": 443, "initiator_bytes": 2503, "last_seen_epoch": "1541624894.166475", "responder_bytes": 9471, "first_seen_epoch": "1541624861.363591" }, { "bytes": 8282, "stream": 125, "flow_id": "flow-808ee3aa7c8efcdc07424cde", "packets": 27, "transport": "tcp", "last_frame": 10044, "first_frame": 6459, "initiator_ip": "10.22.15.119", "responder_ip": "52.207.122.163", "initiator_port": 49282, "responder_port": 443, "initiator_bytes": 1748, "last_seen_epoch": "1541624952.006351", "responder_bytes": 6534, "first_seen_epoch": "1541624861.37003" }, { "bytes": 8956, "stream": 126, "flow_id": "flow-493b42a9ae0e2df888082f7a", "packets": 28, "transport": "tcp", "last_frame": 10133, "first_frame": 6461, "initiator_ip": "10.22.15.119", "responder_ip": "107.178.246.49", "initiator_port": 49283, "responder_port": 443, "initiator_bytes": 2545, "last_seen_epoch": "1541624952.035091", "responder_bytes": 6411, "first_seen_epoch": "1541624861.3729" }, { "bytes": 170, "stream": 105, "flow_id": "flow-5e1290d765654214e424880c", "packets": 2, "transport": "udp", "last_frame": 9028, "first_frame": 9027, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 50309, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1541624907.124684", "responder_bytes": 93, "first_seen_epoch": "1541624907.089653" }, { "bytes": 159614, "stream": 127, "flow_id": "flow-826620f8e623ea09b8a1209f", "packets": 181, "transport": "tcp", "last_frame": 10141, "first_frame": 9029, "initiator_ip": "10.22.15.119", "responder_ip": "132.194.39.10", "initiator_port": 49284, "responder_port": 443, "initiator_bytes": 9565, "last_seen_epoch": "1541624952.083158", "responder_bytes": 150049, "first_seen_epoch": "1541624907.125637" }, { "bytes": 67039, "stream": 128, "flow_id": "flow-6923e47890dfc1a0d5916432", "packets": 78, "transport": "tcp", "last_frame": 10144, "first_frame": 9062, "initiator_ip": "10.22.15.119", "responder_ip": "132.194.39.10", "initiator_port": 49285, "responder_port": 443, "initiator_bytes": 4863, "last_seen_epoch": "1541624952.083449", "responder_bytes": 62176, "first_seen_epoch": "1541624907.770917" }, { "bytes": 24302, "stream": 129, "flow_id": "flow-134281e97cad16465c4634d1", "packets": 39, "transport": "tcp", "last_frame": 10151, "first_frame": 9063, "initiator_ip": "10.22.15.119", "responder_ip": "132.194.39.10", "initiator_port": 49286, "responder_port": 443, "initiator_bytes": 3441, "last_seen_epoch": "1541624952.103674", "responder_bytes": 20861, "first_seen_epoch": "1541624907.771245" }, { "bytes": 146972, "stream": 130, "flow_id": "flow-2e746d314f711b7fe4e28e19", "packets": 157, "transport": "tcp", "last_frame": 10140, "first_frame": 9064, "initiator_ip": "10.22.15.119", "responder_ip": "132.194.39.10", "initiator_port": 49287, "responder_port": 443, "initiator_bytes": 5510, "last_seen_epoch": "1541624952.08309", "responder_bytes": 141462, "first_seen_epoch": "1541624907.771546" }, { "bytes": 63693, "stream": 131, "flow_id": "flow-e7254aaa13b34ac6e3a4b1ab", "packets": 78, "transport": "tcp", "last_frame": 10145, "first_frame": 9065, "initiator_ip": "10.22.15.119", "responder_ip": "132.194.39.10", "initiator_port": 49288, "responder_port": 443, "initiator_bytes": 4165, "last_seen_epoch": "1541624952.083509", "responder_bytes": 59528, "first_seen_epoch": "1541624907.771834" }, { "bytes": 234, "stream": 106, "flow_id": "flow-8e3a289e9cfea506b2da0931", "packets": 2, "transport": "udp", "last_frame": 9070, "first_frame": 9068, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 52146, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1541624907.820322", "responder_bytes": 160, "first_seen_epoch": "1541624907.773895" }, { "bytes": 86285, "stream": 132, "flow_id": "flow-534b4740d9811b42594425c9", "packets": 101, "transport": "tcp", "last_frame": 10137, "first_frame": 9069, "initiator_ip": "10.22.15.119", "responder_ip": "132.194.39.10", "initiator_port": 49289, "responder_port": 443, "initiator_bytes": 6884, "last_seen_epoch": "1541624952.080913", "responder_bytes": 79401, "first_seen_epoch": "1541624907.788746" }, { "bytes": 11068, "stream": 133, "flow_id": "flow-36d10d8108b6ae71173eef41", "packets": 29, "transport": "tcp", "last_frame": 10110, "first_frame": 9071, "initiator_ip": "10.22.15.119", "responder_ip": "93.184.216.182", "initiator_port": 49290, "responder_port": 443, "initiator_bytes": 2152, "last_seen_epoch": "1541624952.028913", "responder_bytes": 8916, "first_seen_epoch": "1541624907.820975" }, { "bytes": 28356, "stream": 134, "flow_id": "flow-e9fbfb69337a1c470fb7afd6", "packets": 44, "transport": "tcp", "last_frame": 10117, "first_frame": 9342, "initiator_ip": "10.22.15.119", "responder_ip": "216.58.192.46", "initiator_port": 49291, "responder_port": 443, "initiator_bytes": 3214, "last_seen_epoch": "1541624952.031985", "responder_bytes": 25142, "first_seen_epoch": "1541624908.348815" }, { "bytes": 27197, "stream": 135, "flow_id": "flow-f390ed4b9cbb72491b4961c9", "packets": 41, "transport": "tcp", "last_frame": 10080, "first_frame": 9343, "initiator_ip": "10.22.15.119", "responder_ip": "93.184.216.182", "initiator_port": 49292, "responder_port": 443, "initiator_bytes": 2412, "last_seen_epoch": "1541624952.019369", "responder_bytes": 24785, "first_seen_epoch": "1541624908.350025" }, { "bytes": 28218, "stream": 136, "flow_id": "flow-01707483c54f749fa28768d0", "packets": 41, "transport": "tcp", "last_frame": 10083, "first_frame": 9344, "initiator_ip": "10.22.15.119", "responder_ip": "93.184.216.182", "initiator_port": 49293, "responder_port": 443, "initiator_bytes": 2412, "last_seen_epoch": "1541624952.019942", "responder_bytes": 25806, "first_seen_epoch": "1541624908.350693" }, { "bytes": 27131, "stream": 137, "flow_id": "flow-2830bb24b22169266d1ce10e", "packets": 40, "transport": "tcp", "last_frame": 10078, "first_frame": 9345, "initiator_ip": "10.22.15.119", "responder_ip": "93.184.216.182", "initiator_port": 49294, "responder_port": 443, "initiator_bytes": 2412, "last_seen_epoch": "1541624952.019263", "responder_bytes": 24719, "first_seen_epoch": "1541624908.351198" }, { "bytes": 26213, "stream": 138, "flow_id": "flow-75a4003d34521938a387e44b", "packets": 39, "transport": "tcp", "last_frame": 10079, "first_frame": 9346, "initiator_ip": "10.22.15.119", "responder_ip": "93.184.216.182", "initiator_port": 49295, "responder_port": 443, "initiator_bytes": 2412, "last_seen_epoch": "1541624952.019324", "responder_bytes": 23801, "first_seen_epoch": "1541624908.352419" }, { "bytes": 40262, "stream": 139, "flow_id": "flow-e38544feac5ffc51b3697041", "packets": 54, "transport": "tcp", "last_frame": 10084, "first_frame": 9347, "initiator_ip": "10.22.15.119", "responder_ip": "93.184.216.182", "initiator_port": 49296, "responder_port": 443, "initiator_bytes": 2682, "last_seen_epoch": "1541624952.019994", "responder_bytes": 37580, "first_seen_epoch": "1541624908.353166" }, { "bytes": 860, "stream": 107, "flow_id": "flow-303111c2ce2b0f5370b2077e", "packets": 4, "transport": "udp", "last_frame": 9906, "first_frame": 9898, "initiator_ip": "10.22.15.119", "responder_ip": "239.255.255.250", "initiator_port": 52148, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1541624916.896692", "responder_bytes": 0, "first_seen_epoch": "1541624913.892827" }, { "bytes": 6332, "stream": 140, "flow_id": "flow-df6d1a24c326bbb95c2b8e2f", "packets": 22, "transport": "tcp", "last_frame": 10182, "first_frame": 10161, "initiator_ip": "10.22.15.119", "responder_ip": "10.22.15.2", "initiator_port": 49297, "responder_port": 445, "initiator_bytes": 4622, "last_seen_epoch": "1541625063.835311", "responder_bytes": 1710, "first_seen_epoch": "1541625047.867033" }, { "bytes": 3265, "stream": 141, "flow_id": "flow-b62d11661b2bd4388be809bd", "packets": 19, "transport": "tcp", "last_frame": 10224, "first_frame": 10185, "initiator_ip": "10.22.15.119", "responder_ip": "46.229.214.92", "initiator_port": 49298, "responder_port": 443, "initiator_bytes": 1382, "last_seen_epoch": "1541625669.772873", "responder_bytes": 1883, "first_seen_epoch": "1541625603.641795" }, { "bytes": 6812, "stream": 142, "flow_id": "flow-952118b8a45cab05539afb7e", "packets": 28, "transport": "tcp", "last_frame": 10231, "first_frame": 10200, "initiator_ip": "10.22.15.119", "responder_ip": "46.229.214.92", "initiator_port": 49299, "responder_port": 443, "initiator_bytes": 4825, "last_seen_epoch": "1541625723.650355", "responder_bytes": 1987, "first_seen_epoch": "1541625614.780188" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.geeographic.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-722abad8ce0eaa7f9f5c41d2", "src_port": 56504, "tcp_stream": null, "udp_stream": 1, "frame_number": 3, "timestamp_epoch": "1541623247.090073000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "10.22.15.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.geeographic.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 56504, "event_id": "evt-841d9944ab203992a4009a2f", "src_port": 53, "tcp_stream": null, "udp_stream": 1, "frame_number": 4, "timestamp_epoch": "1541623247.090323000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.geeographic.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-22aa661595b1199013dc341a", "src_port": 60638, "tcp_stream": null, "udp_stream": 2, "frame_number": 5, "timestamp_epoch": "1541623247.091000000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "10.22.15.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.geeographic.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 60638, "event_id": "evt-08bb5079c66c34827be3e36c", "src_port": 53, "tcp_stream": null, "udp_stream": 2, "frame_number": 6, "timestamp_epoch": "1541623247.091195000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "geeographic-dc.geeographic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-57fa7de1f2c3da49ef3972ef", "src_port": 55055, "tcp_stream": null, "udp_stream": 3, "frame_number": 7, "timestamp_epoch": "1541623247.095753000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "10.22.15.2", "dns.qry.name": "geeographic-dc.geeographic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 55055, "event_id": "evt-13417edc9ed8df6a0274433a", "src_port": 53, "tcp_stream": null, "udp_stream": 3, "frame_number": 8, "timestamp_epoch": "1541623247.096007000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.geeographic.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-8b3266e8037dc76ebea9f72c", "src_port": 51356, "tcp_stream": null, "udp_stream": 7, "frame_number": 171, "timestamp_epoch": "1541623247.429709000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "10.22.15.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.geeographic.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 51356, "event_id": "evt-cd9a1bef7dcca1511d6b4ca1", "src_port": 53, "tcp_stream": null, "udp_stream": 7, "frame_number": 172, "timestamp_epoch": "1541623247.429977000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.geeographic.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-5f6f9177e5342fe8c454a29c", "src_port": 50261, "tcp_stream": null, "udp_stream": 9, "frame_number": 175, "timestamp_epoch": "1541623247.460580000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "10.22.15.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.geeographic.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 50261, "event_id": "evt-c221c273427f9be60c0039a2", "src_port": 53, "tcp_stream": null, "udp_stream": 9, "frame_number": 176, "timestamp_epoch": "1541623247.460829000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.geeographic.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-1be17299ad37d6b767289ce3", "src_port": 65381, "tcp_stream": null, "udp_stream": 11, "frame_number": 187, "timestamp_epoch": "1541623247.541064000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "10.22.15.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.geeographic.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 65381, "event_id": "evt-896c28ddfaf0b5627dd72396", "src_port": 53, "tcp_stream": null, "udp_stream": 11, "frame_number": 188, "timestamp_epoch": "1541623247.541306000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Geeographic-DC.geeographic.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-78ee46ec6ef58596952616f2", "src_port": 56639, "tcp_stream": null, "udp_stream": 13, "frame_number": 277, "timestamp_epoch": "1541623248.494873000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Geeographic-DC.geeographic.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 56639, "event_id": "evt-faef95da9bdd17ea74506169", "src_port": 53, "tcp_stream": null, "udp_stream": 13, "frame_number": 278, "timestamp_epoch": "1541623248.495193000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "_ldap._tcp.Geeographic-DC.geeographic.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-13148d94166a01edae81a72c", "src_port": 57115, "tcp_stream": null, "udp_stream": 14, "frame_number": 279, "timestamp_epoch": "1541623248.496201000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "_ldap._tcp.Geeographic-DC.geeographic.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 57115, "event_id": "evt-2e76ed867303f24fac988066", "src_port": 53, "tcp_stream": null, "udp_stream": 14, "frame_number": 280, "timestamp_epoch": "1541623248.496435000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "wpad.geeographic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-38d6c14124b69aba15da4359", "src_port": 64719, "tcp_stream": null, "udp_stream": 18, "frame_number": 406, "timestamp_epoch": "1541623249.980468000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "wpad.geeographic.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 64719, "event_id": "evt-639279eac0975136a2e832e7", "src_port": 53, "tcp_stream": null, "udp_stream": 18, "frame_number": 407, "timestamp_epoch": "1541623249.980801000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "Geeographic-DC.geeographic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-2de8b386f8d89aba1d1b09b1", "src_port": 56888, "tcp_stream": null, "udp_stream": 20, "frame_number": 413, "timestamp_epoch": "1541623250.618469000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "10.22.15.2", "dns.qry.name": "Geeographic-DC.geeographic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 56888, "event_id": "evt-a07e689f72cde23d115dd626", "src_port": 53, "tcp_stream": null, "udp_stream": 20, "frame_number": 414, "timestamp_epoch": "1541623250.618757000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "isatap.geeographic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-0ed36475d3f3d5d8699d8919", "src_port": 53253, "tcp_stream": null, "udp_stream": 21, "frame_number": 415, "timestamp_epoch": "1541623250.627375000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "isatap.geeographic.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 53253, "event_id": "evt-322dc0cb45082135c40469f6", "src_port": 53, "tcp_stream": null, "udp_stream": 21, "frame_number": 416, "timestamp_epoch": "1541623250.627639000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-43cef2036b13880efd7ae34f", "src_port": 49247, "tcp_stream": null, "udp_stream": 22, "frame_number": 417, "timestamp_epoch": "1541623250.774107000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 49247, "event_id": "evt-f3bd3906ec18be3f20eb7f49", "src_port": 53, "tcp_stream": null, "udp_stream": 22, "frame_number": 418, "timestamp_epoch": "1541623250.791929000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-876a63d17e4ae1068e66009c", "src_port": 63725, "tcp_stream": null, "udp_stream": 24, "frame_number": 423, "timestamp_epoch": "1541623252.570392000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "72.246.64.187,72.246.64.227", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 63725, "event_id": "evt-56cec63c9423a00f393d9368", "src_port": 53, "tcp_stream": null, "udp_stream": 24, "frame_number": 424, "timestamp_epoch": "1541623252.644208000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "Danger-Win-PC.geeographic.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-4951503cba57661789ed4fe4", "src_port": 56174, "tcp_stream": null, "udp_stream": 25, "frame_number": 435, "timestamp_epoch": "1541623254.972102000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "10.22.15.2", "dns.qry.name": "Danger-Win-PC.geeographic.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 56174, "event_id": "evt-4fd5534cb186f7b1b21fb97d", "src_port": 53, "tcp_stream": null, "udp_stream": 25, "frame_number": 436, "timestamp_epoch": "1541623254.972506000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.a": "10.22.15.119", "dns.qry.name": "geeographic.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-8bedca5cc2d837769498ffcf", "src_port": 62513, "tcp_stream": null, "udp_stream": 26, "frame_number": 437, "timestamp_epoch": "1541623254.974894000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "10.22.15.119", "dns.qry.name": "geeographic.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 62513, "event_id": "evt-651687126245c893aa2dcc4e", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 438, "timestamp_epoch": "1541623254.977431000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Geeographic-DC.geeographic.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-69b7824e9a2421ed3a664608", "src_port": 59195, "tcp_stream": null, "udp_stream": 27, "frame_number": 592, "timestamp_epoch": "1541623291.227579000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Geeographic-DC.geeographic.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 59195, "event_id": "evt-def094cbc30dfa8a8f52e764", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 593, "timestamp_epoch": "1541623291.227870000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "_ldap._tcp.Geeographic-DC.geeographic.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-e11e9016e3adbac5a153c9cc", "src_port": 59482, "tcp_stream": null, "udp_stream": 28, "frame_number": 594, "timestamp_epoch": "1541623291.228317000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "_ldap._tcp.Geeographic-DC.geeographic.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 59482, "event_id": "evt-bc3386c725e14862b7da4c99", "src_port": 53, "tcp_stream": null, "udp_stream": 28, "frame_number": 595, "timestamp_epoch": "1541623291.228499000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-b99a9ae138ccc021b776dd21", "src_port": 65142, "tcp_stream": null, "udp_stream": 29, "frame_number": 680, "timestamp_epoch": "1541623291.773708000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 65142, "event_id": "evt-c27e43b4346afef200a47c18", "src_port": 53, "tcp_stream": null, "udp_stream": 29, "frame_number": 681, "timestamp_epoch": "1541623291.790021000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-e71decb252194a1f71910246", "src_port": 52351, "tcp_stream": null, "udp_stream": 30, "frame_number": 682, "timestamp_epoch": "1541623291.790344000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.aaaa": "fd3e:4f5a:5b81::1", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 52351, "event_id": "evt-768809aa16bd80738d1f2c9f", "src_port": 53, "tcp_stream": null, "udp_stream": 30, "frame_number": 683, "timestamp_epoch": "1541623291.810157000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "imap.aol.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-c308e95c61fb94254bb86bcb", "src_port": 57485, "tcp_stream": null, "udp_stream": 31, "frame_number": 684, "timestamp_epoch": "1541623305.055861000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "74.6.141.28,66.218.86.51", "dns.cname": "internal-aol.imap.mail.g03.yahoodns.net", "dns.qry.name": "imap.aol.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 57485, "event_id": "evt-af52b18b250923d5fe0176a1", "src_port": 53, "tcp_stream": null, "udp_stream": 31, "frame_number": 685, "timestamp_epoch": "1541623305.080372000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "smtp.aol.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-b84e39ec89393420b673a146", "src_port": 50575, "tcp_stream": null, "udp_stream": 32, "frame_number": 1028, "timestamp_epoch": "1541623378.925900000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "74.6.141.50", "dns.cname": "smtp.cs.com,smtp.aol.g03.yahoodns.net", "dns.qry.name": "smtp.aol.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 50575, "event_id": "evt-997beb05805d0b0bb23e11d8", "src_port": 53, "tcp_stream": null, "udp_stream": 32, "frame_number": 1029, "timestamp_epoch": "1541623379.015119000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "shumbildac.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-20d035fc1d7ddbae3d90fcc2", "src_port": 53482, "tcp_stream": null, "udp_stream": 33, "frame_number": 1242, "timestamp_epoch": "1541623630.882323000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "46.29.160.132", "dns.qry.name": "shumbildac.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 53482, "event_id": "evt-2e00fd72dce89c1b795f3cfd", "src_port": 53, "tcp_stream": null, "udp_stream": 33, "frame_number": 1243, "timestamp_epoch": "1541623631.425241000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-5da966efe4308ea9f65e9784", "src_port": 52602, "tcp_stream": null, "udp_stream": 34, "frame_number": 1697, "timestamp_epoch": "1541623657.506880000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 52602, "event_id": "evt-82df2c96b199824f37cbd16e", "src_port": 53, "tcp_stream": null, "udp_stream": 34, "frame_number": 1698, "timestamp_epoch": "1541623657.522464000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-43c5bd1fe7e225d0787c96f8", "src_port": 54892, "tcp_stream": null, "udp_stream": 35, "frame_number": 1699, "timestamp_epoch": "1541623657.523123000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.aaaa": "fd3e:4f5a:5b81::1", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 54892, "event_id": "evt-972235899e5611542013e2cf", "src_port": 53, "tcp_stream": null, "udp_stream": 35, "frame_number": 1700, "timestamp_epoch": "1541623657.523396000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "cyanteread.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-c74e4d9d98c16963ad0e4334", "src_port": 55160, "tcp_stream": null, "udp_stream": 36, "frame_number": 1704, "timestamp_epoch": "1541623699.520395000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "cyanteread.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 55160, "event_id": "evt-632ed3d1687bccfe272a7c9b", "src_port": 53, "tcp_stream": null, "udp_stream": 36, "frame_number": 1705, "timestamp_epoch": "1541623699.591391000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-47d4e33c055c50677b2628a7", "src_port": 53148, "tcp_stream": null, "udp_stream": 37, "frame_number": 1713, "timestamp_epoch": "1541623703.045964000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-a75ddee3867b92a6922808d7", "src_port": 63984, "tcp_stream": null, "udp_stream": 38, "frame_number": 1714, "timestamp_epoch": "1541623703.056771000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-ac6c42d9e406908252cae1a4", "src_port": 60610, "tcp_stream": null, "udp_stream": 39, "frame_number": 1715, "timestamp_epoch": "1541623703.057682000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-c9132eeae91216278158d047", "src_port": 55527, "tcp_stream": null, "udp_stream": 40, "frame_number": 1716, "timestamp_epoch": "1541623703.058312000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-76cf68b6bf3b33ec5289ec31", "src_port": 58927, "tcp_stream": null, "udp_stream": 41, "frame_number": 1717, "timestamp_epoch": "1541623703.060728000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-d55f52db4824533c43063dec", "src_port": 56200, "tcp_stream": null, "udp_stream": 42, "frame_number": 1718, "timestamp_epoch": "1541623703.061311000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 55527, "event_id": "evt-29235393bcd76499cabaf95c", "src_port": 53, "tcp_stream": null, "udp_stream": 40, "frame_number": 1719, "timestamp_epoch": "1541623703.066561000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 53148, "event_id": "evt-a216c024441d71d4cd7682ad", "src_port": 53, "tcp_stream": null, "udp_stream": 37, "frame_number": 1720, "timestamp_epoch": "1541623703.066674000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 60610, "event_id": "evt-d379fda377197c140917ab78", "src_port": 53, "tcp_stream": null, "udp_stream": 39, "frame_number": 1721, "timestamp_epoch": "1541623703.101869000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 58927, "event_id": "evt-32a685bd379f944817c3f746", "src_port": 53, "tcp_stream": null, "udp_stream": 41, "frame_number": 1722, "timestamp_epoch": "1541623703.101986000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 56200, "event_id": "evt-5e6e4c50d310e8ac532ecf7a", "src_port": 53, "tcp_stream": null, "udp_stream": 42, "frame_number": 1723, "timestamp_epoch": "1541623703.102105000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 63984, "event_id": "evt-5a44cfd6bed7d7540d47b3af", "src_port": 53, "tcp_stream": null, "udp_stream": 38, "frame_number": 1724, "timestamp_epoch": "1541623703.102190000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "dhsiwyqdlskwsqo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-3853e1db1f0d9bad772633f1", "src_port": 55040, "tcp_stream": null, "udp_stream": 43, "frame_number": 1728, "timestamp_epoch": "1541623725.437476000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "192.162.244.171", "dns.qry.name": "dhsiwyqdlskwsqo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 55040, "event_id": "evt-caf0d9746a45dcad19b1bf21", "src_port": 53, "tcp_stream": null, "udp_stream": 43, "frame_number": 1729, "timestamp_epoch": "1541623725.722135000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "resolver1.opendns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-e6f6da705f0b8d2ad52c308e", "src_port": 64493, "tcp_stream": null, "udp_stream": 44, "frame_number": 2236, "timestamp_epoch": "1541623797.206687000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "208.67.222.222", "dns.qry.name": "resolver1.opendns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 64493, "event_id": "evt-e026856db1ee4062dfbdd031", "src_port": 53, "tcp_stream": null, "udp_stream": 44, "frame_number": 2237, "timestamp_epoch": "1541623797.226998000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "222.222.67.208.in-addr.arpa", "dns.qry.type": "12", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-5932094ca1d58cfb7e23b1d0", "src_port": 64494, "tcp_stream": null, "udp_stream": 45, "frame_number": 2238, "timestamp_epoch": "1541623797.233056000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "222.222.67.208.in-addr.arpa", "dns.qry.type": "12", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 64494, "event_id": "evt-955114b0b295d1f2859818d1", "src_port": 53, "tcp_stream": null, "udp_stream": 45, "frame_number": 2239, "timestamp_epoch": "1541623797.246082000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com.geeographic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-1c4e8f2f3b37c37022680698", "src_port": 64495, "tcp_stream": null, "udp_stream": 46, "frame_number": 2240, "timestamp_epoch": "1541623797.246789000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "myip.opendns.com.geeographic.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 64495, "event_id": "evt-0b09b6429f5ad51813c4bfcd", "src_port": 53, "tcp_stream": null, "udp_stream": 46, "frame_number": 2241, "timestamp_epoch": "1541623797.371219000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com.geeographic.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-9b411b926a383c8405d2f25d", "src_port": 64496, "tcp_stream": null, "udp_stream": 47, "frame_number": 2242, "timestamp_epoch": "1541623797.371808000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "myip.opendns.com.geeographic.com", "dns.qry.type": "28", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 64496, "event_id": "evt-75111bb61ffe642c8023fb65", "src_port": 53, "tcp_stream": null, "udp_stream": 47, "frame_number": 2243, "timestamp_epoch": "1541623797.407306000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-6afaf9f1f220d883cb612ea8", "src_port": 64497, "tcp_stream": null, "udp_stream": 48, "frame_number": 2244, "timestamp_epoch": "1541623797.408013000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "72.45.33.49", "dns.qry.name": "myip.opendns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 64497, "event_id": "evt-7c1a81233cecfd66d72b9949", "src_port": 53, "tcp_stream": null, "udp_stream": 48, "frame_number": 2245, "timestamp_epoch": "1541623797.426200000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-c436d5b1a4f5ce190bd5b481", "src_port": 64498, "tcp_stream": null, "udp_stream": 49, "frame_number": 2246, "timestamp_epoch": "1541623797.429411000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "28", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 64498, "event_id": "evt-c03a1e21d865d6b89b8018ff", "src_port": 53, "tcp_stream": null, "udp_stream": 49, "frame_number": 2247, "timestamp_epoch": "1541623797.443366000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "tmencedfur.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-b2b59171a325ad96db913cac", "src_port": 64120, "tcp_stream": null, "udp_stream": 50, "frame_number": 2249, "timestamp_epoch": "1541623797.536622000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "95.181.198.115", "dns.qry.name": "tmencedfur.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 64120, "event_id": "evt-6c92806b0d14505b3de5fa2e", "src_port": 53, "tcp_stream": null, "udp_stream": 50, "frame_number": 2252, "timestamp_epoch": "1541623797.918025000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-96c6b67a82aab44d0251afab", "src_port": 60931, "tcp_stream": null, "udp_stream": 51, "frame_number": 2265, "timestamp_epoch": "1541623798.514101000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "72.246.64.147,72.246.64.48", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 60931, "event_id": "evt-06705b12f1ddd3f607b92372", "src_port": 53, "tcp_stream": null, "udp_stream": 51, "frame_number": 2266, "timestamp_epoch": "1541623798.576317000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "ferranorga.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-fbb9c8125237b0304625f104", "src_port": 53884, "tcp_stream": null, "udp_stream": 52, "frame_number": 2550, "timestamp_epoch": "1541624403.524417000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "62.149.140.59", "dns.qry.name": "ferranorga.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 53884, "event_id": "evt-88f853030cafb2d4d40715eb", "src_port": 53, "tcp_stream": null, "udp_stream": 52, "frame_number": 2551, "timestamp_epoch": "1541624403.692275000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "www.ferranorga.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-93b29ab57a851c68418012f9", "src_port": 55935, "tcp_stream": null, "udp_stream": 53, "frame_number": 2559, "timestamp_epoch": "1541624404.006477000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "62.149.140.59", "dns.qry.name": "www.ferranorga.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 55935, "event_id": "evt-a4796688ef9d5c599774462d", "src_port": 53, "tcp_stream": null, "udp_stream": 53, "frame_number": 2560, "timestamp_epoch": "1541624404.222937000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "link.sandwseafood.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-15e694ac298620eb342eb02c", "src_port": 55499, "tcp_stream": null, "udp_stream": 54, "frame_number": 2627, "timestamp_epoch": "1541624602.394148000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "46.229.214.92", "dns.qry.name": "link.sandwseafood.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 55499, "event_id": "evt-8a4f979a74a36098fc17c3d4", "src_port": 53, "tcp_stream": null, "udp_stream": 54, "frame_number": 2628, "timestamp_epoch": "1541624602.506125000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "clientservices.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-15403ee21d60c18c14531f8f", "src_port": 51766, "tcp_stream": null, "udp_stream": 56, "frame_number": 2697, "timestamp_epoch": "1541624762.530738000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "accounts.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-fab5bbfac626ad9d20f596fd", "src_port": 60040, "tcp_stream": null, "udp_stream": 57, "frame_number": 2698, "timestamp_epoch": "1541624762.854415000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "216.58.192.35", "dns.qry.name": "clientservices.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 51766, "event_id": "evt-27f8a33fc8814b0c195e0ad6", "src_port": 53, "tcp_stream": null, "udp_stream": 56, "frame_number": 2699, "timestamp_epoch": "1541624762.856918000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "216.58.192.45", "dns.qry.name": "accounts.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 60040, "event_id": "evt-abd0452813a988f6ed96344f", "src_port": 53, "tcp_stream": null, "udp_stream": 57, "frame_number": 2719, "timestamp_epoch": "1541624763.152884000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-b11efe98d2c78ff82e1a61eb", "src_port": 57109, "tcp_stream": null, "udp_stream": 59, "frame_number": 2742, "timestamp_epoch": "1541624767.161679000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "172.217.2.68", "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 57109, "event_id": "evt-35dedca01e934ef6769e0fd5", "src_port": 53, "tcp_stream": null, "udp_stream": 59, "frame_number": 2743, "timestamp_epoch": "1541624767.479203000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "ivtqfoqdro.geeographic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-054af27629b43816e6d61012", "src_port": 60412, "tcp_stream": null, "udp_stream": 60, "frame_number": 2762, "timestamp_epoch": "1541624769.235989000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "ivtqfoqdro.geeographic.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 60412, "event_id": "evt-6f9b51decf00706c85c86e4b", "src_port": 53, "tcp_stream": null, "udp_stream": 60, "frame_number": 2763, "timestamp_epoch": "1541624769.236532000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "qigpzlvhnkqxpl.geeographic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-83e52f6ae248f400685245b7", "src_port": 62444, "tcp_stream": null, "udp_stream": 61, "frame_number": 2764, "timestamp_epoch": "1541624769.238004000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "ivtqfoqdro.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-747ea6c0b89117af3364942e", "src_port": 52199, "tcp_stream": null, "udp_stream": 62, "frame_number": 2765, "timestamp_epoch": "1541624769.238088000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "qigpzlvhnkqxpl.geeographic.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 62444, "event_id": "evt-b226e2e49f9b396f41b7f6ce", "src_port": 53, "tcp_stream": null, "udp_stream": 61, "frame_number": 2766, "timestamp_epoch": "1541624769.238347000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "qwpvlqamqfnzxfk.geeographic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-a5ab68e859d751832115d3d8", "src_port": 59038, "tcp_stream": null, "udp_stream": 63, "frame_number": 2767, "timestamp_epoch": "1541624769.238681000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "qwpvlqamqfnzxfk.geeographic.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 59038, "event_id": "evt-2ed0c4c3036e9723c66c1ae4", "src_port": 53, "tcp_stream": null, "udp_stream": 63, "frame_number": 2768, "timestamp_epoch": "1541624769.238877000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "qigpzlvhnkqxpl.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-aa8f413074c8ae3496f57b92", "src_port": 59493, "tcp_stream": null, "udp_stream": 64, "frame_number": 2769, "timestamp_epoch": "1541624769.239971000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "qwpvlqamqfnzxfk.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-de407c88b190c161d8bc3ac6", "src_port": 64061, "tcp_stream": null, "udp_stream": 65, "frame_number": 2770, "timestamp_epoch": "1541624769.240233000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "ivtqfoqdro.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 52199, "event_id": "evt-61cb4291edc2a2a85999341b", "src_port": 53, "tcp_stream": null, "udp_stream": 62, "frame_number": 2771, "timestamp_epoch": "1541624769.445040000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "qigpzlvhnkqxpl.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 59493, "event_id": "evt-1a4a85ec32bf7b5f2e6e4c42", "src_port": 53, "tcp_stream": null, "udp_stream": 64, "frame_number": 2772, "timestamp_epoch": "1541624769.445501000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "qwpvlqamqfnzxfk.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 64061, "event_id": "evt-f6533792ac3966885dd52f8d", "src_port": 53, "tcp_stream": null, "udp_stream": 65, "frame_number": 2775, "timestamp_epoch": "1541624769.529988000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "translate.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-2896dccc47321031d6a2990c", "src_port": 50078, "tcp_stream": null, "udp_stream": 69, "frame_number": 2789, "timestamp_epoch": "1541624778.193456000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "216.58.192.42", "dns.qry.name": "translate.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 50078, "event_id": "evt-52f8a717caec6b5acfc0404b", "src_port": 53, "tcp_stream": null, "udp_stream": 69, "frame_number": 2790, "timestamp_epoch": "1541624778.225835000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-fe034a6feca7e641dd0d5a80", "src_port": 53487, "tcp_stream": null, "udp_stream": 71, "frame_number": 2954, "timestamp_epoch": "1541624794.787349000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "216.58.192.35", "dns.cname": "gstaticadssl.l.google.com", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 53487, "event_id": "evt-bc04f4dc8f6ee65956604619", "src_port": 53, "tcp_stream": null, "udp_stream": 71, "frame_number": 2962, "timestamp_epoch": "1541624794.815584000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "www.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-e757a5a8f42883f83be0e8d2", "src_port": 51411, "tcp_stream": null, "udp_stream": 72, "frame_number": 3002, "timestamp_epoch": "1541624794.904273000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "ssl.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-546493db530ff07ef5dddae0", "src_port": 52875, "tcp_stream": null, "udp_stream": 73, "frame_number": 3005, "timestamp_epoch": "1541624794.905693000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "172.217.3.67", "dns.qry.name": "ssl.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 52875, "event_id": "evt-d2f46556a53f8cbfd506bb1e", "src_port": 53, "tcp_stream": null, "udp_stream": 73, "frame_number": 3028, "timestamp_epoch": "1541624794.934417000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "216.58.192.35", "dns.qry.name": "www.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 51411, "event_id": "evt-1011646e5421ee473853502d", "src_port": 53, "tcp_stream": null, "udp_stream": 72, "frame_number": 3029, "timestamp_epoch": "1541624794.934525000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "apis.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-b1e6f82ae94f6f81cb21973c", "src_port": 51756, "tcp_stream": null, "udp_stream": 74, "frame_number": 3301, "timestamp_epoch": "1541624795.412335000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "216.58.192.46", "dns.cname": "plus.l.google.com", "dns.qry.name": "apis.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 51756, "event_id": "evt-37f873079f3a010fd9c5edaa", "src_port": 53, "tcp_stream": null, "udp_stream": 74, "frame_number": 3302, "timestamp_epoch": "1541624795.441778000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "adservice.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-099b6dcb61a8f5fd9677b40f", "src_port": 61298, "tcp_stream": null, "udp_stream": 75, "frame_number": 3415, "timestamp_epoch": "1541624795.634633000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "172.217.3.66", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "adservice.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 61298, "event_id": "evt-27b6bead4b793cb1366b6570", "src_port": 53, "tcp_stream": null, "udp_stream": 75, "frame_number": 3416, "timestamp_epoch": "1541624795.663259000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "rtelyse.geeographic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-43e190f2c136ace30a60ea0c", "src_port": 61608, "tcp_stream": null, "udp_stream": 76, "frame_number": 3453, "timestamp_epoch": "1541624800.934735000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "edbmwhcwe.geeographic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-f08be664de78aaa229528a41", "src_port": 56977, "tcp_stream": null, "udp_stream": 77, "frame_number": 3454, "timestamp_epoch": "1541624800.934850000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "rtelyse.geeographic.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 61608, "event_id": "evt-7f4f1f3492a62ada1309b183", "src_port": 53, "tcp_stream": null, "udp_stream": 76, "frame_number": 3455, "timestamp_epoch": "1541624800.935184000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "edbmwhcwe.geeographic.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 56977, "event_id": "evt-c812e3b2aad8d4e9d35d4f39", "src_port": 53, "tcp_stream": null, "udp_stream": 77, "frame_number": 3456, "timestamp_epoch": "1541624800.935321000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "rtelyse.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-aaf00aeb10fc9a153097181f", "src_port": 55322, "tcp_stream": null, "udp_stream": 78, "frame_number": 3457, "timestamp_epoch": "1541624800.935729000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "edbmwhcwe.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-d9ae05bb91ee214920dbba71", "src_port": 63090, "tcp_stream": null, "udp_stream": 79, "frame_number": 3458, "timestamp_epoch": "1541624800.935933000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "zotwyog.geeographic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-3046b2a1d3af61b8347358e5", "src_port": 51977, "tcp_stream": null, "udp_stream": 80, "frame_number": 3459, "timestamp_epoch": "1541624800.937038000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "zotwyog.geeographic.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 51977, "event_id": "evt-96c00029477531fa3b668ee4", "src_port": 53, "tcp_stream": null, "udp_stream": 80, "frame_number": 3460, "timestamp_epoch": "1541624800.937265000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "zotwyog.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-22dc214a444bff5112871470", "src_port": 50439, "tcp_stream": null, "udp_stream": 81, "frame_number": 3461, "timestamp_epoch": "1541624800.938209000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "edbmwhcwe.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 63090, "event_id": "evt-c37235bdb4df382b88ba4a82", "src_port": 53, "tcp_stream": null, "udp_stream": 79, "frame_number": 3462, "timestamp_epoch": "1541624800.976625000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "zotwyog.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 50439, "event_id": "evt-dce3459a4ad1a0647c404387", "src_port": 53, "tcp_stream": null, "udp_stream": 81, "frame_number": 3464, "timestamp_epoch": "1541624800.977490000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.qry.name": "rtelyse.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 55322, "event_id": "evt-fe221bc27de436c79f19a15c", "src_port": 53, "tcp_stream": null, "udp_stream": 78, "frame_number": 3465, "timestamp_epoch": "1541624800.977934000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "id.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-17d4f9d5e7fa24b405a7c649", "src_port": 49981, "tcp_stream": null, "udp_stream": 85, "frame_number": 3703, "timestamp_epoch": "1541624810.869330000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "216.58.192.67", "dns.cname": "id.l.google.com", "dns.qry.name": "id.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 49981, "event_id": "evt-dd7b36e94c96cb3981a1966e", "src_port": 53, "tcp_stream": null, "udp_stream": 85, "frame_number": 3706, "timestamp_epoch": "1541624810.900411000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "encrypted-tbn0.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-382c432b69f332d69bc3de89", "src_port": 52927, "tcp_stream": null, "udp_stream": 86, "frame_number": 3810, "timestamp_epoch": "1541624811.266452000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "216.58.192.46", "dns.qry.name": "encrypted-tbn0.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 52927, "event_id": "evt-4d6621a7412d42906a71a7b2", "src_port": 53, "tcp_stream": null, "udp_stream": 86, "frame_number": 3827, "timestamp_epoch": "1541624811.300199000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "clients4.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-53c6629cfd7dd769bc4fb350", "src_port": 53985, "tcp_stream": null, "udp_stream": 87, "frame_number": 4491, "timestamp_epoch": "1541624853.912838000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "216.58.192.46", "dns.cname": "clients.l.google.com", "dns.qry.name": "clients4.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 53985, "event_id": "evt-63cee662e65242972d5e0988", "src_port": 53, "tcp_stream": null, "udp_stream": 87, "frame_number": 4501, "timestamp_epoch": "1541624853.951935000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "www.ucdenver.edu", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-d758f6706eb5efd11cd3b80a", "src_port": 54984, "tcp_stream": null, "udp_stream": 88, "frame_number": 4538, "timestamp_epoch": "1541624858.580540000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "132.194.7.45", "dns.qry.name": "www.ucdenver.edu", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 54984, "event_id": "evt-20b714f57d9ebcee7dadbb17", "src_port": 53, "tcp_stream": null, "udp_stream": 88, "frame_number": 4544, "timestamp_epoch": "1541624858.654111000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "8895986.fls.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-74f74e6c926d309a65c8bb78", "src_port": 54297, "tcp_stream": null, "udp_stream": 89, "frame_number": 5266, "timestamp_epoch": "1541624860.363489000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "www.google-analytics.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-145ccc7a6ef98e05ab18f61f", "src_port": 54257, "tcp_stream": null, "udp_stream": 90, "frame_number": 5271, "timestamp_epoch": "1541624860.364107000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "216.58.192.38", "dns.cname": "dart.l.doubleclick.net", "dns.qry.name": "8895986.fls.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 54297, "event_id": "evt-2d68f8d69ca19edf496657e1", "src_port": 53, "tcp_stream": null, "udp_stream": 89, "frame_number": 5274, "timestamp_epoch": "1541624860.397101000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "216.58.192.46", "dns.cname": "www-google-analytics.l.google.com", "dns.qry.name": "www.google-analytics.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 54257, "event_id": "evt-4375b33603582c2cd8fba149", "src_port": 53, "tcp_stream": null, "udp_stream": 90, "frame_number": 5275, "timestamp_epoch": "1541624860.397205000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "clients1.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-df6f577db7cbcfff0c0acb6d", "src_port": 51403, "tcp_stream": null, "udp_stream": 91, "frame_number": 5457, "timestamp_epoch": "1541624860.516907000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "216.58.192.46", "dns.cname": "clients.l.google.com", "dns.qry.name": "clients1.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 51403, "event_id": "evt-e8adce1b08a7cff8db83d56a", "src_port": 53, "tcp_stream": null, "udp_stream": 91, "frame_number": 5477, "timestamp_epoch": "1541624860.547098000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "insight.adsrvr.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-fdc93539befb8d1e8a502c6c", "src_port": 58475, "tcp_stream": null, "udp_stream": 92, "frame_number": 5689, "timestamp_epoch": "1541624860.650537000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "d.turn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-1cedcb438e1ff1fb6d2ef320", "src_port": 50386, "tcp_stream": null, "udp_stream": 93, "frame_number": 5691, "timestamp_epoch": "1541624860.659079000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "pixel-a.basis.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-3e167111acea49ba8c4397ef", "src_port": 59558, "tcp_stream": null, "udp_stream": 94, "frame_number": 5714, "timestamp_epoch": "1541624860.665729000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "stats.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-f755210ddb5c0f84ce475157", "src_port": 64083, "tcp_stream": null, "udp_stream": 95, "frame_number": 5715, "timestamp_epoch": "1541624860.667178000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "54.86.197.0,34.202.147.29,54.85.96.132,54.85.197.245,54.85.233.91,52.204.152.189,35.171.180.138,34.203.74.207", "dns.cname": "insight-760077375.us-east-1.elb.amazonaws.com", "dns.qry.name": "insight.adsrvr.org", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 58475, "event_id": "evt-e9a4e86c24103c944959bd75", "src_port": 53, "tcp_stream": null, "udp_stream": 92, "frame_number": 5746, "timestamp_epoch": "1541624860.680901000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "172.217.193.155,172.217.193.154,172.217.193.157,172.217.193.156", "dns.cname": "stats.l.doubleclick.net", "dns.qry.name": "stats.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 64083, "event_id": "evt-5cbe73c875f6fb1a4009f083", "src_port": 53, "tcp_stream": null, "udp_stream": 95, "frame_number": 5783, "timestamp_epoch": "1541624860.705335000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "209.15.36.22", "dns.cname": "wl-pixel.sitescout.com,pixel.sitescout.com", "dns.qry.name": "pixel-a.basis.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 59558, "event_id": "evt-00239fde593d739877aac329", "src_port": 53, "tcp_stream": null, "udp_stream": 94, "frame_number": 5835, "timestamp_epoch": "1541624860.731333000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "50.116.194.23", "dns.cname": "d.turn.com.akadns.net", "dns.qry.name": "d.turn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 50386, "event_id": "evt-a01d9bc52a372e246bade871", "src_port": 53, "tcp_stream": null, "udp_stream": 93, "frame_number": 5925, "timestamp_epoch": "1541624860.792162000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "cm.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-9e11d58f28c859bc015e4f58", "src_port": 59761, "tcp_stream": null, "udp_stream": 96, "frame_number": 6038, "timestamp_epoch": "1541624860.873606000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "172.217.15.194", "dns.cname": "pagead.l.doubleclick.net", "dns.qry.name": "cm.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 59761, "event_id": "evt-a0f1c8fa6eb3c45116a8a03f", "src_port": 53, "tcp_stream": null, "udp_stream": 96, "frame_number": 6044, "timestamp_epoch": "1541624860.904837000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "pixel.sitescout.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-21c089f706ce347872e43c82", "src_port": 54691, "tcp_stream": null, "udp_stream": 97, "frame_number": 6296, "timestamp_epoch": "1541624861.024210000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "209.15.36.22", "dns.qry.name": "pixel.sitescout.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 54691, "event_id": "evt-ddaeab00ebfb9edfaaf3c490", "src_port": 53, "tcp_stream": null, "udp_stream": 97, "frame_number": 6297, "timestamp_epoch": "1541624861.024460000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "match.adsrvr.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-b7ff4bbac887b9f1302e348a", "src_port": 49505, "tcp_stream": null, "udp_stream": 98, "frame_number": 6307, "timestamp_epoch": "1541624861.058439000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "34.192.39.141,52.4.55.137,34.224.172.188,34.204.248.161,52.72.190.60,54.81.75.176,54.236.245.79", "dns.cname": "match-975362022.us-east-1.elb.amazonaws.com", "dns.qry.name": "match.adsrvr.org", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 49505, "event_id": "evt-e1a7620856d9445ba52f93b6", "src_port": 53, "tcp_stream": null, "udp_stream": 98, "frame_number": 6328, "timestamp_epoch": "1541624861.092413000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "dsum-sec.casalemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-c423ac01b8c7f7448c23bb55", "src_port": 59576, "tcp_stream": null, "udp_stream": 99, "frame_number": 6437, "timestamp_epoch": "1541624861.269826000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "dpm.demdex.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-cb755aa120026cbd52aeba1f", "src_port": 53871, "tcp_stream": null, "udp_stream": 100, "frame_number": 6440, "timestamp_epoch": "1541624861.311811000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "pixel.tapad.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-b6382ec7d6efb7772ffcfe02", "src_port": 52041, "tcp_stream": null, "udp_stream": 101, "frame_number": 6441, "timestamp_epoch": "1541624861.312992000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "loadm.exelator.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-ad4e32c1efe596eaf6d652f4", "src_port": 51696, "tcp_stream": null, "udp_stream": 102, "frame_number": 6442, "timestamp_epoch": "1541624861.318587000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "sync.teads.tv", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-868c5a881f75b94fd78965b7", "src_port": 62493, "tcp_stream": null, "udp_stream": 103, "frame_number": 6443, "timestamp_epoch": "1541624861.318677000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "bcp.crwdcntrl.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-8f81a4d1c5bb2926f345ddb1", "src_port": 62548, "tcp_stream": null, "udp_stream": 104, "frame_number": 6444, "timestamp_epoch": "1541624861.321007000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "23.56.194.57", "dns.cname": "dsum-sec.casalemedia.com.edgekey.net,e8037.g.akamaiedge.net", "dns.qry.name": "dsum-sec.casalemedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 59576, "event_id": "evt-dfa77de216dbc97a54a75d8b", "src_port": 53, "tcp_stream": null, "udp_stream": 99, "frame_number": 6445, "timestamp_epoch": "1541624861.327626000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "52.214.151.124,52.213.58.51,52.210.34.59,52.208.135.160,52.31.219.56,52.30.113.91,52.210.213.208,54.194.108.5", "dns.cname": "gslb.demdex.net,irl1.demdex.net,dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com", "dns.qry.name": "dpm.demdex.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 53871, "event_id": "evt-4fbb05dfbb5242a3386d59e1", "src_port": 53, "tcp_stream": null, "udp_stream": 100, "frame_number": 6447, "timestamp_epoch": "1541624861.329520000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "34.227.43.215,34.199.147.194,34.192.90.231,34.236.63.37,35.168.53.247,35.168.218.13,34.239.206.211,35.168.67.88", "dns.cname": "td.crwdcntrl.net,nginx-bcp-stacka-1436622233.us-east-1.elb.amazonaws.com", "dns.qry.name": "bcp.crwdcntrl.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 62548, "event_id": "evt-ceca4fc74159b393950ac149", "src_port": 53, "tcp_stream": null, "udp_stream": 104, "frame_number": 6449, "timestamp_epoch": "1541624861.335497000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "63.251.240.12", "dns.cname": "loadus.tm.ssl.exelator.com,us-central.load.exelator.com,load.txexp.exelator.com", "dns.qry.name": "loadm.exelator.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 51696, "event_id": "evt-2b0cc0017ab3ff35e2d78d85", "src_port": 53, "tcp_stream": null, "udp_stream": 102, "frame_number": 6456, "timestamp_epoch": "1541624861.362801000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "52.207.122.163,34.237.159.145,34.198.191.149,52.20.145.225,52.7.21.186,34.198.228.49,34.205.99.3,52.0.244.217", "dns.qry.name": "sync.teads.tv", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 62493, "event_id": "evt-1d9c926b227e3eae9def8fda", "src_port": 53, "tcp_stream": null, "udp_stream": 103, "frame_number": 6458, "timestamp_epoch": "1541624861.368818000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "107.178.246.49", "dns.qry.name": "pixel.tapad.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 52041, "event_id": "evt-13629c65285ea3b25f9dd436", "src_port": 53, "tcp_stream": null, "udp_stream": 101, "frame_number": 6460, "timestamp_epoch": "1541624861.372243000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "clas.ucdenver.edu", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-6593b4b7c36695b6650c02d4", "src_port": 50309, "tcp_stream": null, "udp_stream": 105, "frame_number": 9027, "timestamp_epoch": "1541624907.089653000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "132.194.39.10", "dns.qry.name": "clas.ucdenver.edu", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 50309, "event_id": "evt-09bc33d42bb5e48e93e575c1", "src_port": 53, "tcp_stream": null, "udp_stream": 105, "frame_number": 9028, "timestamp_epoch": "1541624907.124684000" }, { "kind": "dns", "dst_ip": "10.22.15.2", "fields": { "dns.qry.name": "fast.fonts.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": 53, "event_id": "evt-ef92e0d166bbf8e76ecfdac1", "src_port": 52146, "tcp_stream": null, "udp_stream": 106, "frame_number": 9068, "timestamp_epoch": "1541624907.773895000" }, { "kind": "dns", "dst_ip": "10.22.15.119", "fields": { "dns.a": "93.184.216.182", "dns.cname": "fast.wac.1ac1.iotacdn.net,s9.gp1.wac.gammacdn.net", "dns.qry.name": "fast.fonts.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.22.15.2", "dst_port": 52146, "event_id": "evt-8852fc2f1f4d586209a0aa19", "src_port": 53, "tcp_stream": null, "udp_stream": 106, "frame_number": 9070, "timestamp_epoch": "1541624907.820322000" } ], "dhcp": [ { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "00:11:2f:d1:6e:52", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:2f:d1:6e:52,00:11:2f:d1:6e:52", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Danger-Win-PC" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6a1eefa3874bd7e951f5b16f", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 404, "timestamp_epoch": "1541623249.964576000" }, { "kind": "dhcp", "dst_ip": "10.22.15.119", "fields": { "eth.src": "00:18:8b:f7:20:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:2f:d1:6e:52", "dhcp.option.dhcp": "5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-6e5f47a588e45e1f1d769f56", "src_port": null, "tcp_stream": null, "udp_stream": 17, "frame_number": 405, "timestamp_epoch": "1541623249.964889000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "00:11:2f:d1:6e:52", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:2f:d1:6e:52,00:11:2f:d1:6e:52", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Danger-Win-PC" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-0968881e4a479ba74d473fc6", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 1702, "timestamp_epoch": "1541623699.459685000" }, { "kind": "dhcp", "dst_ip": "10.22.15.119", "fields": { "eth.src": "00:18:8b:f7:20:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:2f:d1:6e:52", "dhcp.option.dhcp": "5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-1793d9e07dd8d7c73259a021", "src_port": null, "tcp_stream": null, "udp_stream": 17, "frame_number": 1703, "timestamp_epoch": "1541623699.460248000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "00:11:2f:d1:6e:52", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:2f:d1:6e:52,00:11:2f:d1:6e:52", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Danger-Win-PC" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-e81d3969f99323a46b778600", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 2250, "timestamp_epoch": "1541623797.537766000" }, { "kind": "dhcp", "dst_ip": "10.22.15.119", "fields": { "eth.src": "00:18:8b:f7:20:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:2f:d1:6e:52", "dhcp.option.dhcp": "5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-6d3663d5d82306bc36b8443c", "src_port": null, "tcp_stream": null, "udp_stream": 17, "frame_number": 2251, "timestamp_epoch": "1541623797.538077000" } ], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "DANGER-WIN-PC<00>,DANGER-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-3af6fe58a6effb4d538e43ad", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1541623247.036005000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "GEEOGRAPHIC<00>,GEEOGRAPHIC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-420ea8b67b83018339d561d1", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2, "timestamp_epoch": "1541623247.036172000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "10", "kerberos.CNameString": "danger-win-pc$" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-4d811bc3dc1432fcaa31ec12", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 28, "timestamp_epoch": "1541623247.273582000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "30" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-864463b28e11250b30366d04", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 29, "timestamp_epoch": "1541623247.274701000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "10", "kerberos.CNameString": "danger-win-pc$" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-1eb4f012d7ae56a2c58d3dbe", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 36, "timestamp_epoch": "1541623247.291653000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-7c8566af168f4870dfeb79f7", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 38, "timestamp_epoch": "1541623247.292478000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-540dfac5b4ae8ad8cdd67fef", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 47, "timestamp_epoch": "1541623247.295966000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-cfa2a2682b6f81abc894bf2a", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 50, "timestamp_epoch": "1541623247.298099000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-104bf0feda35d9762d65c8b6", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 56, "timestamp_epoch": "1541623247.298861000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-544a8181084adbb8bbff0ce4", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 58, "timestamp_epoch": "1541623247.299467000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-1d5d517a2e357d5779ac2ee6", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 59, "timestamp_epoch": "1541623247.299702000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-4976ede01b29804a6c1e4886", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 73, "timestamp_epoch": "1541623247.345194000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-2f412ed250f900a1212db7cd", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 74, "timestamp_epoch": "1541623247.345500000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-df40005389f1c4fe74d23d00", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 75, "timestamp_epoch": "1541623247.345656000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "10", "kerberos.CNameString": "danger-win-pc$" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-bdc45bfabb184918fd002066", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 79, "timestamp_epoch": "1541623247.348514000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "30" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-1a6431106e90bdd41766667f", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 80, "timestamp_epoch": "1541623247.349295000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "10", "kerberos.CNameString": "danger-win-pc$" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-ab23267c64c8c7be1503d491", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 89, "timestamp_epoch": "1541623247.382136000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-2aeca9fe05b3f7defeab1a8f", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 91, "timestamp_epoch": "1541623247.383684000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-cc79faee3b7d92e9984c8996", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 100, "timestamp_epoch": "1541623247.392129000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-fded0bfd191673caefb7637c", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 103, "timestamp_epoch": "1541623247.394641000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-33b0068e19b9d5b083f63398", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 114, "timestamp_epoch": "1541623247.397487000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-db6797688d289c1a8d972471", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 119, "timestamp_epoch": "1541623247.397850000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-800bba5d6f256e0c3963d044", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 130, "timestamp_epoch": "1541623247.398691000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-2126b1c6ac9807c10ab84232", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 132, "timestamp_epoch": "1541623247.399395000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-1b5e9b442052616d728f0a9f", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 135, "timestamp_epoch": "1541623247.400268000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-28a078361514a0e1ccf6b322", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 137, "timestamp_epoch": "1541623247.400502000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-b8362b1b1636ed3afa9646dd", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 140, "timestamp_epoch": "1541623247.401387000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-ec55b502f3eb2f02af895fbd", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 141, "timestamp_epoch": "1541623247.401670000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-ed76359bd7846b3ea87c3fca", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 155, "timestamp_epoch": "1541623247.420746000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-eaf4fe551e5152ff9786f172", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 158, "timestamp_epoch": "1541623247.422317000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-a835cd565eb3ebb1a501ae83", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 164, "timestamp_epoch": "1541623247.423078000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-427905d9eaa7521f61957ab0", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 166, "timestamp_epoch": "1541623247.423783000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-7482f146f719a37e22a2e293", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 202, "timestamp_epoch": "1541623247.574387000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-7c668c618e6f6916150ac18b", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 205, "timestamp_epoch": "1541623247.575275000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-8479ff078a165d645b9f75f3", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 211, "timestamp_epoch": "1541623247.575919000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-b4a20945cd046398b12a55e3", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 213, "timestamp_epoch": "1541623247.576569000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "DANGER-WIN-PC<20>,DANGER-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-ae489e65308fb20a20569057", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 221, "timestamp_epoch": "1541623247.614882000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "DANGER-WIN-PC<00>,DANGER-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-916a4286ca70d959351d3b9d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 253, "timestamp_epoch": "1541623247.785146000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "GEEOGRAPHIC<00>,GEEOGRAPHIC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-0bb4bf58ce5f502a945cafca", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 254, "timestamp_epoch": "1541623247.786032000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-eafcac7ecc63477153cb2ee1", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 255, "timestamp_epoch": "1541623247.833820000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-dc58de3759adeb0fa669db71", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 256, "timestamp_epoch": "1541623247.834126000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6c2c6a511fbe7808ee01e91a", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 260, "timestamp_epoch": "1541623247.899318000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-d745de09c211ed8a0d74c0e3", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 262, "timestamp_epoch": "1541623247.899959000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-b65d6816c88dd0b26f6b5e0f", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 263, "timestamp_epoch": "1541623247.900186000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "DANGER-WIN-PC<20>,DANGER-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-60ab8fb09b0895d98d0d54a5", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 276, "timestamp_epoch": "1541623248.360882000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-27ba63303ed49ed1632d7227", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 289, "timestamp_epoch": "1541623248.500775000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-009a15df2cf6aeb40be2eaa2", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 291, "timestamp_epoch": "1541623248.502017000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-93c50f8519df2d687436eba4", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 296, "timestamp_epoch": "1541623248.531711000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-14b5ae02390a527cdd3d0ab7", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 299, "timestamp_epoch": "1541623248.533861000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "DANGER-WIN-PC<00>,DANGER-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-ac8ef7c976675000e4c54001", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 306, "timestamp_epoch": "1541623248.540123000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "GEEOGRAPHIC<00>,GEEOGRAPHIC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-4a9cc028d1505029b446c161", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 307, "timestamp_epoch": "1541623248.540227000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-75ace719613e41ff45782a88", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 314, "timestamp_epoch": "1541623248.540898000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-eba264fdd772c3463a4dbae2", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 318, "timestamp_epoch": "1541623248.542374000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-cb961040f43a55dd6ac65f33", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 323, "timestamp_epoch": "1541623248.542803000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6cf4a736dc4722104d35ce8d", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 330, "timestamp_epoch": "1541623248.543195000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-04e54da350c2e8ae0da4f6cb", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 332, "timestamp_epoch": "1541623248.543707000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "30" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-5e886367e5ef44d4dbd088a2", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 333, "timestamp_epoch": "1541623248.544182000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-67ceaf7205fca6323ca74778", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 346, "timestamp_epoch": "1541623248.550021000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-ae2ed8a1bd7da3c87faa6e07", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 347, "timestamp_epoch": "1541623248.550225000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-adbf1dd3879ffe6d0ef8feb1", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 352, "timestamp_epoch": "1541623248.551181000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-a45bd403247f35c891febc7e", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 355, "timestamp_epoch": "1541623248.552472000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-4400813520e5820411801113", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 364, "timestamp_epoch": "1541623248.553262000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-a383ccef51bf34c5cc95f31b", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 367, "timestamp_epoch": "1541623248.553572000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-af9590ed972ec15b55787ef9", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 375, "timestamp_epoch": "1541623248.554205000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-4ec64418f0846764c30de339", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 376, "timestamp_epoch": "1541623248.555357000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-5861e19f474725e0b8ecfb33", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 377, "timestamp_epoch": "1541623248.555863000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-0cc02f4073e780671cbaecb4", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 378, "timestamp_epoch": "1541623248.555999000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-1495710a75737dde67eea295", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 379, "timestamp_epoch": "1541623248.556367000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-6b433d4fdf01bbda3a421cbf", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 380, "timestamp_epoch": "1541623248.558925000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-409ffed0806d6f0bf6cd72be", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 381, "timestamp_epoch": "1541623248.559274000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-62fd890da8f016a5e2f42909", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 382, "timestamp_epoch": "1541623248.559414000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-4996ae638f58470bef5d57db", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 383, "timestamp_epoch": "1541623248.559655000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-f0f3092be257c5befdf7ebb0", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 384, "timestamp_epoch": "1541623248.559763000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-7a9035308413ef118c9ea897", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 385, "timestamp_epoch": "1541623248.560166000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-a07a31c60b63993f76f451f9", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 386, "timestamp_epoch": "1541623248.560406000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-bbe31f0cbd2c3c272c49f466", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 387, "timestamp_epoch": "1541623248.560738000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-16811f153d6f57b5638bff88", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 388, "timestamp_epoch": "1541623248.560849000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "DANGER-WIN-PC<20>,DANGER-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-add203cce867d37800d066fd", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 397, "timestamp_epoch": "1541623249.111298000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "GEEOGRAPHIC<00>,GEEOGRAPHIC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-72e8770f782648ee828cda9f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 398, "timestamp_epoch": "1541623249.290880000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "DANGER-WIN-PC<00>,DANGER-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-87cc03ed101a4dccd6965d46", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 399, "timestamp_epoch": "1541623249.291061000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "DANGER-WIN-PC<20>,DANGER-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-98e316bde713a0d412753e0d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 400, "timestamp_epoch": "1541623249.861180000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "Danger-Win-PC" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-705f04d00012ac1a36fe3d93", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 403, "timestamp_epoch": "1541623249.957100000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "wpad" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-266d4ffa58686ddc9fa3ff83", "src_port": null, "tcp_stream": null, "udp_stream": 19, "frame_number": 408, "timestamp_epoch": "1541623249.992718000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "Danger-Win-PC" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-d18081c65ada45cadc98707a", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 409, "timestamp_epoch": "1541623250.050697000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "wpad" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-9fabbc2d0b27ea2aab0acdc5", "src_port": null, "tcp_stream": null, "udp_stream": 19, "frame_number": 410, "timestamp_epoch": "1541623250.090797000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6b53dff593c9627ab2327a33", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 411, "timestamp_epoch": "1541623250.292087000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-c85d936d0eea1c0a4245d656", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 419, "timestamp_epoch": "1541623251.041123000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-88169c6085ae37d40afe6ace", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 420, "timestamp_epoch": "1541623251.801534000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-2db5f8117e29a5ecc6766f14", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 447, "timestamp_epoch": "1541623257.817209000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-7f04884968685743c799ed57", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 449, "timestamp_epoch": "1541623257.818427000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6c074ec0e04885a0ac82260e", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 462, "timestamp_epoch": "1541623257.837420000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-63b73b4d86acdd6c75e033cd", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 464, "timestamp_epoch": "1541623257.838139000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "10", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-d2c595f4749ed69f3f79320b", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 470, "timestamp_epoch": "1541623257.840898000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "30" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-05d2746fe9e287567cc53e62", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 471, "timestamp_epoch": "1541623257.841268000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "10", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-f1fa7b5068489abf6c089610", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 478, "timestamp_epoch": "1541623257.857286000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-536058665f3251666f19a518", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 480, "timestamp_epoch": "1541623257.857857000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-aaff279c3e2b76767d1326ba", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 489, "timestamp_epoch": "1541623257.860906000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DANGER-WIN-PC$" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-7c3f9ff53752ec7634e779a4", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 492, "timestamp_epoch": "1541623257.862280000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6b4deaea5581899035cfefc4", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 503, "timestamp_epoch": "1541623263.830367000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-d650b54597667aeab1c773ae", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 504, "timestamp_epoch": "1541623263.830680000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-c96dd58c9e33b7b0c7f95e80", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 505, "timestamp_epoch": "1541623263.830944000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-36dd3db94a1c6189108eb158", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 506, "timestamp_epoch": "1541623263.831154000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-ac315ffe400324f89506b630", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 507, "timestamp_epoch": "1541623263.831448000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-29ca25eccae07c2433a70ced", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 509, "timestamp_epoch": "1541623263.831727000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-b4256f2ff76905dcb362274b", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 519, "timestamp_epoch": "1541623275.826634000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-eb1080e588a1d6fb8a9be9de", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 520, "timestamp_epoch": "1541623275.826858000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-04aeeb7da4a67558fc22c4aa", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 522, "timestamp_epoch": "1541623287.823792000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-b878e62eca7c1ee4cacfd0ea", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 523, "timestamp_epoch": "1541623287.824051000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-13a10013059395b833d6f2e3", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 524, "timestamp_epoch": "1541623287.824242000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-0fd7387392d480fb62c4ce60", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 525, "timestamp_epoch": "1541623287.824416000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "10", "kerberos.CNameString": "carlos.danger" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-bac368071984717485daba1e", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 530, "timestamp_epoch": "1541623290.117632000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "30" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-b54a47751ff177bf2ce3e374", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 531, "timestamp_epoch": "1541623290.118470000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "10", "kerberos.CNameString": "carlos.danger" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-97470ca3a9b4870a54feefd2", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 538, "timestamp_epoch": "1541623290.128719000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "carlos.danger" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-0173c6673cb0dec99e11a575", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 540, "timestamp_epoch": "1541623290.129633000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-1cb7140eae51705cad6ed4d6", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 549, "timestamp_epoch": "1541623290.130507000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "carlos.danger" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-18a0359eb39d205f43025285", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 552, "timestamp_epoch": "1541623290.133215000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-98df4143911a299c4687abf6", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 568, "timestamp_epoch": "1541623290.690742000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "carlos.danger" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-6c181c571c240f63b4af6c97", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 571, "timestamp_epoch": "1541623290.692290000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-b47a9a698aa5f84379fddb22", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 577, "timestamp_epoch": "1541623290.693766000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-0e6fcdb63c56d16a66aa2b56", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 579, "timestamp_epoch": "1541623290.694630000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-48f1ee89f5f90e735e4de9c5", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 580, "timestamp_epoch": "1541623290.694831000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-a20868f1d8604d95e2935857", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 603, "timestamp_epoch": "1541623291.231479000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "carlos.danger" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-032d08f59a21d1fc4e3eb82e", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 606, "timestamp_epoch": "1541623291.234198000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-c5f8724e574c7a664ec0ff6b", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 612, "timestamp_epoch": "1541623291.234957000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-46b48bcfff035a980933544d", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 614, "timestamp_epoch": "1541623291.235665000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-7abf8f6c32f19416abae21a7", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 621, "timestamp_epoch": "1541623291.241809000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-e5353455b77356d1c316f0fc", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 623, "timestamp_epoch": "1541623291.242484000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-49854237f4191adef6323f28", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 633, "timestamp_epoch": "1541623291.247630000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-20ded54349a6bc9d59f960ae", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 634, "timestamp_epoch": "1541623291.248016000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-eb6beaeb0933e391fe9af450", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 639, "timestamp_epoch": "1541623291.248917000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "carlos.danger" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-55c0f8f15ad2ebf83f64ac45", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 642, "timestamp_epoch": "1541623291.249855000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "12,14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-5a750055e0c3f70cafc5ec5d", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 651, "timestamp_epoch": "1541623291.250698000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "carlos.danger" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-e3f8a4e05691f79eda806af4", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 654, "timestamp_epoch": "1541623291.251044000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-8577bbc65bc7691d07eecc86", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 662, "timestamp_epoch": "1541623291.251884000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-4095fc1e36c59f44576a1b1d", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 663, "timestamp_epoch": "1541623291.253038000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-64eb35637955a08999cb7729", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 664, "timestamp_epoch": "1541623291.253449000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-930b9cda433030c0661f8e9d", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 665, "timestamp_epoch": "1541623291.253571000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-9151b83e980b2d72b31372e2", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 666, "timestamp_epoch": "1541623291.253966000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-c1b75c0cbef67017cb59e719", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 667, "timestamp_epoch": "1541623291.254243000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-19f2b98173f3cc7186f3cbfd", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 668, "timestamp_epoch": "1541623291.254651000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-69a3231b2d24efd1bc13b571", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 669, "timestamp_epoch": "1541623291.254798000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-d3150c8b1794becc40d6bbb3", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 826, "timestamp_epoch": "1541623317.832637000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-ad4828c6a07fdf74f0d8e57e", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 827, "timestamp_epoch": "1541623317.832977000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6d06f0d20d563f9a35a0f790", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 976, "timestamp_epoch": "1541623329.828738000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-f916fb84cbcbbf348741da87", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 977, "timestamp_epoch": "1541623329.829070000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-be57980e5b75924fbeaec363", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 978, "timestamp_epoch": "1541623329.829215000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-4bb934e5e680c18cd73ed64e", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 979, "timestamp_epoch": "1541623329.829356000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-83f2ace5364c8319721639a4", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1701, "timestamp_epoch": "1541623699.455037000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "CYANTEREAD.COM<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-f09d0731d7392053e18e7495", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1706, "timestamp_epoch": "1541623699.592479000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-3b1f84b32fc8cad1d0115d43", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1707, "timestamp_epoch": "1541623700.205381000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "CYANTEREAD.COM<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-1e6494ac8a7ea5ace0f80b80", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1708, "timestamp_epoch": "1541623700.346487000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-974118d5e55f2744be4950c7", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1709, "timestamp_epoch": "1541623700.969498000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "CYANTEREAD.COM<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6609ab0802df518222eb38d2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1710, "timestamp_epoch": "1541623701.110232000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "CYANTEREAD.COM<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-86c0dac4909b33fd76988ae5", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1711, "timestamp_epoch": "1541623701.876285000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "CYANTEREAD.COM<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-a3f4e2acba6781dbd8ee0fd9", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1712, "timestamp_epoch": "1541623702.640223000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "CYANTEREAD.COM<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-250232c1e1db3fa3e5958cc9", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1725, "timestamp_epoch": "1541623703.404892000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-bba3bdb5073b93226227babe", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1727, "timestamp_epoch": "1541623725.416979000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-64791e87ea3f390242eb3f22", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1755, "timestamp_epoch": "1541623726.177416000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-2a88c853397b549f477c2d5b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1867, "timestamp_epoch": "1541623726.942332000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-686def3a9ab94b38278e38cb", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2248, "timestamp_epoch": "1541623797.518890000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-e99ea4516cd1f0d0f2ffbcdf", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2260, "timestamp_epoch": "1541623798.276287000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-74b0e7e82821b646b384d5c1", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2329, "timestamp_epoch": "1541623799.040545000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-3eb4130b20d57055a20aaf26", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2419, "timestamp_epoch": "1541624147.862934000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-f3ea91970dce8de795a7372c", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2420, "timestamp_epoch": "1541624147.863098000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-d45a9bd27fe6c70cc21515e0", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2421, "timestamp_epoch": "1541624147.863323000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-f0920387d8b9ddb2c1c057d9", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2425, "timestamp_epoch": "1541624147.864701000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-348686379ce31548c4bac3aa", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2426, "timestamp_epoch": "1541624147.865354000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-9b8cf711969499f60da42ef6", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2427, "timestamp_epoch": "1541624147.865753000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-b4c5221f1e185fce9c61650d", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2428, "timestamp_epoch": "1541624147.865900000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-8186f46bb78efbbbe1a781bb", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2429, "timestamp_epoch": "1541624147.866272000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-83ad736e9df51da4afaf2e7e", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2430, "timestamp_epoch": "1541624147.866495000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-cff8874ad8ca2e3f82443a6e", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2432, "timestamp_epoch": "1541624163.828392000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-e6d1a0b3e0ca6f7dc88bb6e5", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2433, "timestamp_epoch": "1541624163.828685000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-ff5519d4c663001f39af0ef2", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2434, "timestamp_epoch": "1541624163.828931000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-0a635b49d995d75cfe40dff0", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 2435, "timestamp_epoch": "1541624163.829159000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-41269d858d2830a4742296f3", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 2701, "timestamp_epoch": "1541624762.860037000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-079715d2690da7946265223d", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 2738, "timestamp_epoch": "1541624763.868582000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-e40a7ae5361c043c9c155225", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 2741, "timestamp_epoch": "1541624765.876623000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "ivtqfoqdro" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-0a9edff4dae3259f58eb163a", "src_port": null, "tcp_stream": null, "udp_stream": 66, "frame_number": 2773, "timestamp_epoch": "1541624769.446963000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "qigpzlvhnkqxpl" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-cedebcd5cbf7bec351174a42", "src_port": null, "tcp_stream": null, "udp_stream": 67, "frame_number": 2774, "timestamp_epoch": "1541624769.447400000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "qwpvlqamqfnzxfk" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-cef4e18e0fba5414ff6c650e", "src_port": null, "tcp_stream": null, "udp_stream": 68, "frame_number": 2776, "timestamp_epoch": "1541624769.531843000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "qigpzlvhnkqxpl" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-2af08f8d9bbc53e5ea1eec33", "src_port": null, "tcp_stream": null, "udp_stream": 67, "frame_number": 2777, "timestamp_epoch": "1541624769.558079000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "ivtqfoqdro" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-c29916d9c595ded5e63f0316", "src_port": null, "tcp_stream": null, "udp_stream": 66, "frame_number": 2778, "timestamp_epoch": "1541624769.558205000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "qwpvlqamqfnzxfk" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-e71fb839fdea0467d2335cb0", "src_port": null, "tcp_stream": null, "udp_stream": 68, "frame_number": 2779, "timestamp_epoch": "1541624769.635418000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "IVTQFOQDRO<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-11a8c1a2d9859f57a981cca5", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2780, "timestamp_epoch": "1541624769.760998000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "QIGPZLVHNKQXPL<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-9ad419be79602c0b547db49c", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2781, "timestamp_epoch": "1541624769.761121000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "QWPVLQAMQFNZXFK<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-c78132b9984e9feab47f6de6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2782, "timestamp_epoch": "1541624769.839635000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "IVTQFOQDRO<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-a07e21905ee831ba3ac9e2a2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2783, "timestamp_epoch": "1541624770.515834000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "QIGPZLVHNKQXPL<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-8561320b88b33860def52c13", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2784, "timestamp_epoch": "1541624770.515975000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "QWPVLQAMQFNZXFK<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-d3b873cd4d35d668dbd5b0b3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2785, "timestamp_epoch": "1541624770.599358000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "QIGPZLVHNKQXPL<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-9c93b0b4c2a36db0b6612715", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2786, "timestamp_epoch": "1541624771.273405000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "IVTQFOQDRO<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-48bff9ef8d58faa05bc7535f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2787, "timestamp_epoch": "1541624771.273573000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "QWPVLQAMQFNZXFK<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-153fc6a9015fca776bc95c58", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2788, "timestamp_epoch": "1541624771.350408000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-545e28f3254c19dc7496135f", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 2866, "timestamp_epoch": "1541624794.578552000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-e9c3645d05ea19b3bd8ffec4", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 3374, "timestamp_epoch": "1541624795.579037000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-63813a267a796359cac48a78", "src_port": null, "tcp_stream": null, "udp_stream": 58, "frame_number": 3437, "timestamp_epoch": "1541624797.584679000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "edbmwhcwe" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-0bf3e7b6ad2fb95b05025cea", "src_port": null, "tcp_stream": null, "udp_stream": 82, "frame_number": 3463, "timestamp_epoch": "1541624800.977277000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "zotwyog" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-267c1b8724a8bccaf0bb3535", "src_port": null, "tcp_stream": null, "udp_stream": 83, "frame_number": 3466, "timestamp_epoch": "1541624800.978119000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "rtelyse" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-938300e036cba4700b8a4f57", "src_port": null, "tcp_stream": null, "udp_stream": 84, "frame_number": 3467, "timestamp_epoch": "1541624800.978381000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "zotwyog" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-35ce85b98b3027c4057c620f", "src_port": null, "tcp_stream": null, "udp_stream": 83, "frame_number": 3468, "timestamp_epoch": "1541624801.073369000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "rtelyse" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-e6a87d71649623d5aed8077e", "src_port": null, "tcp_stream": null, "udp_stream": 84, "frame_number": 3469, "timestamp_epoch": "1541624801.073527000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:2f:d1:6e:52", "dns.qry.name": "edbmwhcwe" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-a15e6316a442dcf93a22aada", "src_port": null, "tcp_stream": null, "udp_stream": 82, "frame_number": 3470, "timestamp_epoch": "1541624801.073712000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "EDBMWHCWE<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-98daea1c91bf42d2ff2a7b6c", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3471, "timestamp_epoch": "1541624801.277287000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "RTELYSE<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-0e02da60611c384925da5800", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3472, "timestamp_epoch": "1541624801.277442000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "ZOTWYOG<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-d0de11723417efcf625d72fd", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3473, "timestamp_epoch": "1541624801.277854000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "ZOTWYOG<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-e52d81be7a8fafca1a4a5998", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3474, "timestamp_epoch": "1541624802.033880000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "RTELYSE<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6b0e0c48601635031b44b8f7", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3475, "timestamp_epoch": "1541624802.034104000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "EDBMWHCWE<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-cd0dcbc7fc3036e4ba60771c", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3476, "timestamp_epoch": "1541624802.034320000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "EDBMWHCWE<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-40290adf0b908e3a67633e75", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3477, "timestamp_epoch": "1541624802.791360000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "RTELYSE<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-9302be6b1b9ed210f939c253", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3478, "timestamp_epoch": "1541624802.791694000" }, { "kind": "identity", "dst_ip": "10.22.15.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:2f:d1:6e:52", "nbns.name": "ZOTWYOG<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-b2959b47b3b99e9282e1cfe1", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3479, "timestamp_epoch": "1541624802.791824000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-d34fff3bf6d1f7739eed37e0", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10165, "timestamp_epoch": "1541625047.867978000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-9a9ef054b8227b4b8877524f", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10166, "timestamp_epoch": "1541625047.868104000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-ed3d4150027a0ef31b3806a4", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10167, "timestamp_epoch": "1541625047.868272000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52", "kerberos.msg_type": "14" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-c2f2f5ad465a18ad9652b574", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10171, "timestamp_epoch": "1541625047.869641000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a", "kerberos.msg_type": "15" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-90b70692af24c82d7242cb6b", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10172, "timestamp_epoch": "1541625047.870228000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-2acc85ad19eb53ca0ebe5acc", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10173, "timestamp_epoch": "1541625047.870670000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-af38cd45a00b88fec217e1ac", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10174, "timestamp_epoch": "1541625047.870829000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-48babf891816c354d29de7e1", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10175, "timestamp_epoch": "1541625047.871218000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-36a80a85fa640592fb7cd338", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10176, "timestamp_epoch": "1541625047.871430000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-8a67eb7870fab9ae2e4ff667", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10178, "timestamp_epoch": "1541625063.834142000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-0f4221be0a0e8d7153585d1a", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10179, "timestamp_epoch": "1541625063.834465000" }, { "kind": "identity", "dst_ip": "10.22.15.2", "fields": { "eth.dst": "00:18:8b:f7:20:6a", "eth.src": "00:11:2f:d1:6e:52" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-b3507f43f2238ca41c0d49fd", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10180, "timestamp_epoch": "1541625063.834712000" }, { "kind": "identity", "dst_ip": "10.22.15.119", "fields": { "eth.dst": "00:11:2f:d1:6e:52", "eth.src": "00:18:8b:f7:20:6a" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-002ff40e75fa04bf7614beaf", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 10181, "timestamp_epoch": "1541625063.834940000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "72.246.64.187", "fields": { "http.host": "www.msftncsi.com", "http.user_agent": "Microsoft NCSI", "http.request.uri": "/ncsi.txt", "http.response_in": "430", "http.request.method": "GET", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-798a2f7f8d5098bc400e5113", "src_port": 49183, "tcp_stream": 27, "udp_stream": null, "frame_number": 428, "timestamp_epoch": "1541623252.666384000" }, { "kind": "http_request", "dst_ip": "46.29.160.132", "fields": { "http.host": "shumbildac.com", "http.request.uri": "/WES/fatog.php?l=ngul5.xap", "http.response_in": "1690", "http.request.method": "GET", "http.request.full_uri": "http://shumbildac.com/WES/fatog.php?l=ngul5.xap" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-25918eadfdea9fcca1a15d27", "src_port": 49208, "tcp_stream": 51, "udp_stream": null, "frame_number": 1247, "timestamp_epoch": "1541623631.752689000" }, { "kind": "http_request", "dst_ip": "192.162.244.171", "fields": { "http.host": "dhsiwyqdlskwsqo.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/Owsg6NXtcG4F/aQTGTFRGYCk/mwdnmTGg8q5u_2/B23I8WXH1qhcd_2BC7kNQ/SplwlVD2F3jUMRCB/dTSK84tk3PapDt7/wErikpmrkQw2_2Bhba/FTtz6Avew/ty3DREXbyq083JlIg3zM/TEYrA_2BNXjAICO93pa/QGJ.avi", "http.response_in": "1936", "http.request.method": "GET", "http.request.full_uri": "http://dhsiwyqdlskwsqo.com/images/Owsg6NXtcG4F/aQTGTFRGYCk/mwdnmTGg8q5u_2/B23I8WXH1qhcd_2BC7kNQ/SplwlVD2F3jUMRCB/dTSK84tk3PapDt7/wErikpmrkQw2_2Bhba/FTtz6Avew/ty3DREXbyq083JlIg3zM/TEYrA_2BNXjAICO93pa/QGJ.avi" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-03c41daa2782c43e31463c9a", "src_port": 49210, "tcp_stream": 53, "udp_stream": null, "frame_number": 1734, "timestamp_epoch": "1541623725.916965000" }, { "kind": "http_request", "dst_ip": "192.162.244.171", "fields": { "http.host": "dhsiwyqdlskwsqo.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/favicon.ico", "http.response_in": "1947", "http.request.method": "GET", "http.request.full_uri": "http://dhsiwyqdlskwsqo.com/favicon.ico" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-09c736e6912ea01ea1934cfe", "src_port": 49210, "tcp_stream": 53, "udp_stream": null, "frame_number": 1939, "timestamp_epoch": "1541623727.157447000" }, { "kind": "http_request", "dst_ip": "192.162.244.171", "fields": { "http.host": "dhsiwyqdlskwsqo.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/oHxu3OjFB6DuXsB336/xwuexjnHY/P5VoU9fs1NStyMFZ_2FZ/6s8umkBGsQOSsZgZiqQ/Jnp65UJ_2B9Qq9qo_2BCxl/LpqyFXF9TVVz_/2BLffdp3/TW_2B64CmxBQ7r03un00c1o/B2mvu2ig9G/7GcZJn_2FNTO8/6Kwy7mw.avi", "http.response_in": "2224", "http.request.method": "GET", "http.request.full_uri": "http://dhsiwyqdlskwsqo.com/images/oHxu3OjFB6DuXsB336/xwuexjnHY/P5VoU9fs1NStyMFZ_2FZ/6s8umkBGsQOSsZgZiqQ/Jnp65UJ_2B9Qq9qo_2BCxl/LpqyFXF9TVVz_/2BLffdp3/TW_2B64CmxBQ7r03un00c1o/B2mvu2ig9G/7GcZJn_2FNTO8/6Kwy7mw.avi" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-2474642d2cd99600d098c7f6", "src_port": 49213, "tcp_stream": 56, "udp_stream": null, "frame_number": 1955, "timestamp_epoch": "1541623728.369908000" }, { "kind": "http_request", "dst_ip": "192.162.244.171", "fields": { "http.host": "dhsiwyqdlskwsqo.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/UIL_2BVxj_2FFv/cAgM9ZivBfYRBhzmpmqE8/gTexqC1Lh_2F0iW2/AATDXP0c4G4qcxV/_2FXAAoF8eHHNZ8c43/RrSntOi0N/4VTdgqIWbPwlUsd3uIxL/BZP_2Bzh085fEx639Yq/B1kvRr_2FOEM0k57tlZ1QS/8lw2Htym.avi", "http.response_in": "2229", "http.request.method": "GET", "http.request.full_uri": "http://dhsiwyqdlskwsqo.com/images/UIL_2BVxj_2FFv/cAgM9ZivBfYRBhzmpmqE8/gTexqC1Lh_2F0iW2/AATDXP0c4G4qcxV/_2FXAAoF8eHHNZ8c43/RrSntOi0N/4VTdgqIWbPwlUsd3uIxL/BZP_2Bzh085fEx639Yq/B1kvRr_2FOEM0k57tlZ1QS/8lw2Htym.avi" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-524b5e8df2d579432c6c86c8", "src_port": 49210, "tcp_stream": 53, "udp_stream": null, "frame_number": 2226, "timestamp_epoch": "1541623730.990957000" }, { "kind": "http_request", "dst_ip": "72.246.64.147", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "http.response_in": "2325", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-97c96265ba348d73dce578b1", "src_port": 49215, "tcp_stream": 58, "udp_stream": null, "frame_number": 2270, "timestamp_epoch": "1541623798.594440000" }, { "kind": "http_request", "dst_ip": "62.149.140.59", "fields": { "http.host": "ferranorga.net", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)", "http.request.uri": "/img/client.rar", "http.response_in": "2557", "http.request.method": "GET", "http.request.full_uri": "http://ferranorga.net/img/client.rar" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-a58a6fdbb893ca9e38c2f6fa", "src_port": 49227, "tcp_stream": 70, "udp_stream": null, "frame_number": 2555, "timestamp_epoch": "1541624403.848059000" }, { "kind": "http_request", "dst_ip": "62.149.140.59", "fields": { "http.host": "www.ferranorga.net", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)", "http.request.uri": "/img/client.rar", "http.response_in": "2566", "http.request.method": "GET", "http.request.full_uri": "http://www.ferranorga.net/img/client.rar" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-ad728356752d51bc1b7aa0a8", "src_port": 49228, "tcp_stream": 71, "udp_stream": null, "frame_number": 2564, "timestamp_epoch": "1541624404.370399000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Google Chrome/67.0.3396.99 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-5e52b9b319c8b4865285d110", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 2696, "timestamp_epoch": "1541624762.197551000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Google Chrome/67.0.3396.99 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-e18b470aeb2d6d2866e5694e", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 2726, "timestamp_epoch": "1541624763.200415000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Google Chrome/67.0.3396.99 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6340e0e0dd94102e95d5906e", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 2739, "timestamp_epoch": "1541624764.215092000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Google Chrome/67.0.3396.99 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-9eccec8f67083877f6235389", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 2740, "timestamp_epoch": "1541624765.218107000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Google Chrome/67.0.3396.99 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-e8c2b2b6865de79fc7035823", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 2824, "timestamp_epoch": "1541624793.957286000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Google Chrome/67.0.3396.99 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-070b4afcfa51d140aa1c82d8", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 3045, "timestamp_epoch": "1541624794.958348000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Google Chrome/67.0.3396.99 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-8e75cac061d4e5ea1d02b49c", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 3435, "timestamp_epoch": "1541624795.958880000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Google Chrome/67.0.3396.99 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-08e0ad01b7b912d843cbc537", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 3436, "timestamp_epoch": "1541624796.959614000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/pages/ucdwelcomepage.aspx", "http.response_in": "4634", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/pages/ucdwelcomepage.aspx" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-1f97e2eec993934ed4cda023", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 4552, "timestamp_epoch": "1541624858.750822000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/corev4Anonymous.css", "http.response_in": "4746", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/corev4Anonymous.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-9a7b0d1a83aafcc2b7f6e8b7", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 4577, "timestamp_epoch": "1541624859.196686000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/bootstrap334/css/bootstrap.min.css", "http.response_in": "4756", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap.min.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-d9771a0fd17af148e93ef02b", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 4581, "timestamp_epoch": "1541624859.201803000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/bootstrap334/css/bootstrap-theme.min.css", "http.response_in": "4614", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap-theme.min.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-c295af87a9ebfc458ff90db3", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 4585, "timestamp_epoch": "1541624859.204941000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.css", "http.response_in": "4674", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-073b76e3acadb59fbdacd9c8", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 4589, "timestamp_epoch": "1541624859.217138000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/responsive/responsiveBase.css", "http.response_in": "4666", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/responsive/responsiveBase.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-23fb0e789b50643a1ca6e043", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 4593, "timestamp_epoch": "1541624859.219621000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/UCDenverTheme.css", "http.response_in": "4793", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/UCDenverTheme.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-24d0b9e21683e6629cb6b2fb", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 4615, "timestamp_epoch": "1541624859.315195000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-app.css", "http.response_in": "4708", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-app.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-061a5c298fd58f6e6473b2e1", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 4636, "timestamp_epoch": "1541624859.381889000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/jquery-1.11.3.min.js", "http.response_in": "4951", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/jquery-1.11.3.min.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-4dbb40a586cf6b926e29321e", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 4668, "timestamp_epoch": "1541624859.440397000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.js", "http.response_in": "5074", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-7924858400e90d93eb7ad0b4", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 4676, "timestamp_epoch": "1541624859.448624000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/bootstrap334/js/bootstrap.min.js", "http.response_in": "4786", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/bootstrap334/js/bootstrap.min.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-d8f380fc38d8109ead1c23f0", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 4710, "timestamp_epoch": "1541624859.497098000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/angular.min.js", "http.response_in": "4932", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/angular.min.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-b65a056d296d301baa00226a", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 4749, "timestamp_epoch": "1541624859.563108000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/angular-animate.min.js", "http.response_in": "4869", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/angular-animate.min.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-ff3004a4ef71d39c85b423ef", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 4768, "timestamp_epoch": "1541624859.568418000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/jquery.jcarousel.min.js", "http.response_in": "4886", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/jquery.jcarousel.min.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-4778542bb3ddb6e3e18923eb", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 4788, "timestamp_epoch": "1541624859.617568000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/responsive/jsBaseResponsive.js", "http.response_in": "4897", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/responsive/jsBaseResponsive.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-b4dbf3eedfbe1e6fbf94f45d", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 4794, "timestamp_epoch": "1541624859.630828000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/UCDJS.js", "http.response_in": "4957", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/UCDJS.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-f680ee08c0233bd4e5d598b4", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 4871, "timestamp_epoch": "1541624859.685949000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/WebResource.axd?d=Rr8OZckqtIG1LFJTmW4ygCZ8tMHeGI9-qww7ZH6tsHUf-5ACqmhwY6jnlnidSHBrgMkq7on6x9smildQ9krSVOW4yk41&t=636271455501517547", "http.response_in": "4992", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/WebResource.axd?d=Rr8OZckqtIG1LFJTmW4ygCZ8tMHeGI9-qww7ZH6tsHUf-5ACqmhwY6jnlnidSHBrgMkq7on6x9smildQ9krSVOW4yk41&t=636271455501517547" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-e65eb95c7a158556e2195b82", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 4888, "timestamp_epoch": "1541624859.741750000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/blank.js?rev=QGOYAJlouiWgFRlhHVlMKA%3D%3D", "http.response_in": "4987", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/blank.js?rev=QGOYAJlouiWgFRlhHVlMKA%3D%3D" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-cf0feb109b0c553720f60403", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 4899, "timestamp_epoch": "1541624859.747203000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/1033/init.js?rev=wgiyW1GQqDQZTITaawvYoA%3D%3D", "http.response_in": "5045", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/1033/init.js?rev=wgiyW1GQqDQZTITaawvYoA%3D%3D" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-f60291716d9dfac245a00b71", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 4947, "timestamp_epoch": "1541624859.774236000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/ScriptResource.axd?d=nDIPXhUC97iGOuHV1bSa3g9PgqtW-xIy12fJV_T8vVy7js2xrAy8ccqwmnXPgF-xNQgkyT7tmsbDKVfT8ifdxCFRXJAu8n8jnliYraK21_he0x3K2sbtAORIu3mC-DFdoxOp3B5OGN3NzbzrPG28T1haK-w1&t=2e2045e2", "http.response_in": "5137", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/ScriptResource.axd?d=nDIPXhUC97iGOuHV1bSa3g9PgqtW-xIy12fJV_T8vVy7js2xrAy8ccqwmnXPgF-xNQgkyT7tmsbDKVfT8ifdxCFRXJAu8n8jnliYraK21_he0x3K2sbtAORIu3mC-DFdoxOp3B5OGN3NzbzrPG28T1haK-w1&t=2e2045e2" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-54051810425722b0578af95e", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 4958, "timestamp_epoch": "1541624859.776150000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/ScriptResource.axd?d=1QDyKS9h_RiM240HMbYjM6ODCJOKhzpWzUoeDZ16t3d487fp531Bj79wvRUTrpe40Sb2WC34BUqekTySkaN5JfKY-KmMcnh1StfQCVLNGKh9bApp04C1q9RX01pYhWwBp5cQe9b_UUDsH1MpnrV6Qpz6c1ILT-tGnGCdfhY6NJVDQZ2p0&t=2e2045e2", "http.response_in": "5006", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/ScriptResource.axd?d=1QDyKS9h_RiM240HMbYjM6ODCJOKhzpWzUoeDZ16t3d487fp531Bj79wvRUTrpe40Sb2WC34BUqekTySkaN5JfKY-KmMcnh1StfQCVLNGKh9bApp04C1q9RX01pYhWwBp5cQe9b_UUDsH1MpnrV6Qpz6c1ILT-tGnGCdfhY6NJVDQZ2p0&t=2e2045e2" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-dae831dc39ced53d79426c0a", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 4975, "timestamp_epoch": "1541624859.779592000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/images/fgimg.png", "http.response_in": "5120", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/images/fgimg.png" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-2609e184cf9854f59b5fdda3", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 4994, "timestamp_epoch": "1541624859.850761000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/SiteCollectionImages/Logos/CUDenver_cuitc-300.png", "http.response_in": "5127", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/SiteCollectionImages/Logos/CUDenver_cuitc-300.png" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-eced64e969f497e4b62aeff5", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 4996, "timestamp_epoch": "1541624859.853521000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/carousel.js", "http.response_in": "5139", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/carousel.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-90db593cc623b275ad22fcf4", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 5123, "timestamp_epoch": "1541624859.966453000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-search-ng.js", "http.response_in": "5156", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-search-ng.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-4b41851aae3909b9544c04b0", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 5129, "timestamp_epoch": "1541624859.971247000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/DDCthemeMain.css", "http.response_in": "5193", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/DDCthemeMain.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-6065f36e47cc29be98f1d395", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 5158, "timestamp_epoch": "1541624860.126535000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/data.js", "http.response_in": "5166", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/data.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-3224ff8c365c21b16c361698", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 5160, "timestamp_epoch": "1541624860.128717000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/UCDLayoutImages/searchButton.png", "http.response_in": "5164", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/UCDLayoutImages/searchButton.png" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-52c16f9cdd8b3c9282757cf9", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 5162, "timestamp_epoch": "1541624860.130512000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_catalog_small.jpg", "http.response_in": "5208", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog_small.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-48bce16450281fb49c6d5611", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 5168, "timestamp_epoch": "1541624860.233813000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_calendar_small.jpg", "http.response_in": "5226", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_calendar_small.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-cbd15157b4c0da1a7631036c", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 5170, "timestamp_epoch": "1541624860.237436000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_apply_small.jpg", "http.response_in": "5256", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply_small.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-45c983232894b3427f564fe9", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 5195, "timestamp_epoch": "1541624860.255371000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_visit_small.jpg", "http.response_in": "5269", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit_small.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-7f030306bd77e3f3e3109788", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 5197, "timestamp_epoch": "1541624860.258241000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_appStatus_small.jpg", "http.response_in": "5219", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_appStatus_small.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-d3bd41c216c11ccb1d80fb0a", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 5199, "timestamp_epoch": "1541624860.259689000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/CUAnschutz.jpg", "http.response_in": "5242", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUAnschutz.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-152d6ca15a3f8edc94059e28", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 5201, "timestamp_epoch": "1541624860.260824000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-regular-webfont.woff2", "http.response_in": "5326", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-regular-webfont.woff2" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-3b1e89e4dc3c7910f877e6df", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 5210, "timestamp_epoch": "1541624860.340649000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/images/shared/icons/QLtab.png", "http.response_in": "5287", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/QLtab.png" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-b0793c3f283c60b7c3144ed4", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 5235, "timestamp_epoch": "1541624860.347934000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/images/shared/icons/searchButton.png", "http.response_in": "5360", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/searchButton.png" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-0d65d04dc11a8dfe28d26e9f", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 5245, "timestamp_epoch": "1541624860.353114000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-bold-webfont.woff2", "http.response_in": "5353", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-bold-webfont.woff2" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-c19c15f87eefa21b227350fa", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 5247, "timestamp_epoch": "1541624860.359313000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/fonts/fontawesome-fontfacekit/fontawesome-webfont.woff2?v=4.3.0", "http.response_in": "5545", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/fonts/fontawesome-fontfacekit/fontawesome-webfont.woff2?v=4.3.0" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-8cd055fb1134cba1b3b1243a", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 5262, "timestamp_epoch": "1541624860.363198000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-light-webfont.woff2", "http.response_in": "5397", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-light-webfont.woff2" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-2c2e6453cbfd3f8e10e117d2", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 5272, "timestamp_epoch": "1541624860.366019000" }, { "kind": "http_request", "dst_ip": "216.58.192.46", "fields": { "http.host": "www.google-analytics.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/ga.js", "http.response_in": "5363", "http.request.method": "GET", "http.request.full_uri": "http://www.google-analytics.com/ga.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-501e868bc44bc1a47dcd5637", "src_port": 49266, "tcp_stream": 109, "udp_stream": null, "frame_number": 5284, "timestamp_epoch": "1541624860.425130000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/CUDenver.jpg", "http.response_in": "5469", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUDenver.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-fd515aec6b8d2233afef68d0", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 5289, "timestamp_epoch": "1541624860.432498000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Documents/WebParts2015Redesign/16HeroImage/images/ResearchRoundupHero.jpg", "http.response_in": "5986", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/16HeroImage/images/ResearchRoundupHero.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-8a5b49a0333da6b79a4b6f92", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 5333, "timestamp_epoch": "1541624860.459487000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/CUSouth.jpg", "http.response_in": "5493", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUSouth.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-9c1a3b8ff934efe30e60d7ce", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 5355, "timestamp_epoch": "1541624860.469628000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/homepage/2015StoryCards/ThreeGuys.jpg", "http.response_in": "5824", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/ThreeGuys.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-97cd697e16e586b083446cb8", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 5385, "timestamp_epoch": "1541624860.481944000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/homepage/2015StoryCards/balancedbudget.jpg", "http.response_in": "5626", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/balancedbudget.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-2a77e15abe5145277c5a40b9", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 5412, "timestamp_epoch": "1541624860.492735000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/homepage/2015StoryCards/whitepines.jpg", "http.response_in": "5836", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/whitepines.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-be5683263df7720c60bb049d", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 5471, "timestamp_epoch": "1541624860.524980000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/homepage/2015StoryCards/StCajetans-ig.jpg", "http.response_in": "5882", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/StCajetans-ig.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-ec636bf957dad2de241128de", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 5495, "timestamp_epoch": "1541624860.570466000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/images/bgximg.png", "http.response_in": "5803", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/images/bgximg.png" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-1efef5ceac5706710191b730", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 5567, "timestamp_epoch": "1541624860.602366000" }, { "kind": "http_request", "dst_ip": "216.58.192.46", "fields": { "http.host": "www.google-analytics.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=362717400&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624860490&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=408037419&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAQE~", "http.response_in": "5690", "http.request.method": "GET", "http.request.full_uri": "http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=362717400&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624860490&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=408037419&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAQE~" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-791e591c3df73d1b90740c37", "src_port": 49266, "tcp_stream": 109, "udp_stream": null, "frame_number": 5617, "timestamp_epoch": "1541624860.618251000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/images/shared/icons/linkedin.png", "http.response_in": "5885", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/linkedin.png" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-e070c2b91ef0889753f3cd5f", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 5642, "timestamp_epoch": "1541624860.627830000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/images/shared/icons/googleplus.png", "http.response_in": "5978", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/googleplus.png" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-bd844836594c1851ac725194", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 5807, "timestamp_epoch": "1541624860.712635000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/images/shared/icons/youtube.png", "http.response_in": "6003", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/youtube.png" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-55c6b57b886009cc7ac59e30", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 5841, "timestamp_epoch": "1541624860.733368000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/images/shared/icons/instagram.png", "http.response_in": "5989", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/instagram.png" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-13635555ed11e6c0ffb8750f", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 5845, "timestamp_epoch": "1541624860.735835000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/images/shared/icons/twitter.png", "http.response_in": "6008", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/twitter.png" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-70596fbcd82f9719225d4d8e", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 5887, "timestamp_epoch": "1541624860.752218000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/images/shared/icons/facebook.png", "http.response_in": "6028", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/facebook.png" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-4698947c79c34cd03a826d28", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 5889, "timestamp_epoch": "1541624860.754925000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_apply.jpg", "http.response_in": "6286", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-040134f732a168d354ed1762", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 5996, "timestamp_epoch": "1541624860.831216000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_visit.jpg", "http.response_in": "6326", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-689b536fda3c5d4cd355d3fc", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 5998, "timestamp_epoch": "1541624860.832935000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_requestInfo.jpg", "http.response_in": "6115", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_requestInfo.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-f0fc2987b5989dba5bf6fd88", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 6000, "timestamp_epoch": "1541624860.835661000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Documents/WebParts2015Redesign/06InfoGraphic/image/factBack3.jpg", "http.response_in": "6396", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/06InfoGraphic/image/factBack3.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-9b14078cd2dbb5420eea94cf", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 6005, "timestamp_epoch": "1541624860.841068000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/images/shared/rightChevron.gif", "http.response_in": "6064", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/rightChevron.gif" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-b8c3cd66d23ff774fc622190", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 6011, "timestamp_epoch": "1541624860.847864000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/images/shared/leftChevron.gif", "http.response_in": "6291", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/leftChevron.gif" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-c4ea061634bfa4921a334348", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 6034, "timestamp_epoch": "1541624860.865620000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/responsive/print.css", "http.response_in": "6304", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/responsive/print.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-8d99c86dc9724a6a66485ad6", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 6074, "timestamp_epoch": "1541624860.952712000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/1033/core.js?rev=Emb5hNX1RZMNXk9oS82yvA%3D%3D", "http.response_in": "6896", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/1033/core.js?rev=Emb5hNX1RZMNXk9oS82yvA%3D%3D" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-0b07bac54f3d1672813f438a", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 6577, "timestamp_epoch": "1541624862.071589000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/sp.core.js?rev=7ByNlH%2BvcgRJg%2BRCctdC0w%3D%3D", "http.response_in": "6593", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/sp.core.js?rev=7ByNlH%2BvcgRJg%2BRCctdC0w%3D%3D" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-581fd54e727f47c54e932197", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 6579, "timestamp_epoch": "1541624862.073012000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/ScriptResx.ashx?culture=en%2Dus&name=SP%2ERes&rev=b6%2FcRx1a6orhAQ%2FcF%2B0ytQ%3D%3D", "http.response_in": "6599", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/ScriptResx.ashx?culture=en%2Dus&name=SP%2ERes&rev=b6%2FcRx1a6orhAQ%2FcF%2B0ytQ%3D%3D" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-6b8f68d2c809db29e4c81374", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 6581, "timestamp_epoch": "1541624862.074280000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/cui.js?rev=OOyJv78CADNBeet%2FvTvniQ%3D%3D", "http.response_in": "6779", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/cui.js?rev=OOyJv78CADNBeet%2FvTvniQ%3D%3D" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-b7509671e062a0220b4ed205", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 6583, "timestamp_epoch": "1541624862.075493000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/favicon.ico", "http.response_in": "6603", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/favicon.ico" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-13d38a196431612043917418", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 6585, "timestamp_epoch": "1541624862.076528000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/sp.ui.dialog.js?rev=Tpcmo1%2FSu6R0yewHowDl5g%3D%3D", "http.response_in": "6740", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/sp.ui.dialog.js?rev=Tpcmo1%2FSu6R0yewHowDl5g%3D%3D" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-9c1bd7234736214162be70ed", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 6601, "timestamp_epoch": "1541624862.185947000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/sp.runtime.js?rev=IGffcZfunndj0247nOxKVg%3D%3D", "http.response_in": "6796", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/sp.runtime.js?rev=IGffcZfunndj0247nOxKVg%3D%3D" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-5280ccb3ec164265e08e27c6", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 6742, "timestamp_epoch": "1541624862.290081000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/sp.js?rev=%2B4ZEyA892P3T0504qi0paw%3D%3D", "http.response_in": "6884", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/sp.js?rev=%2B4ZEyA892P3T0504qi0paw%3D%3D" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-a0a75da40f1f9344360bcf81", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 6798, "timestamp_epoch": "1541624862.397142000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_vti_bin/sites.asmx", "http.response_in": "6898", "http.content_length": "332", "http.request.method": "POST", "http.request.full_uri": "http://www.ucdenver.edu/_vti_bin/sites.asmx" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-d67f0845880e0b610d5e5852", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "body_sha256": "24e819821e2f9afcfed4ad0e8490935378abfb0df723850078e731cfd9ef6edd", "frame_number": 6889, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 332, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 332, "timestamp_epoch": "1541624862.663283000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/academics/degrees/_vti_bin/client.svc/ProcessQuery", "http.response_in": "8048", "http.content_length": "1426", "http.request.method": "POST", "http.request.full_uri": "http://www.ucdenver.edu/academics/degrees/_vti_bin/client.svc/ProcessQuery" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-a3da4bf6daef5d470756b4d4", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "body_sha256": "da725c97aae07686110485c776b5ebb1733fb26674466d07417aa2ee3c0e09a9", "frame_number": 6900, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1426, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1426, "timestamp_epoch": "1541624862.758014000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/mediaplayer.js?rev=Q6vfD9BNL%2B9PvwgrVEcc%2FA%3D%3D", "http.response_in": "6912", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/mediaplayer.js?rev=Q6vfD9BNL%2B9PvwgrVEcc%2FA%3D%3D" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-012b7117caaef7170558b693", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 6903, "timestamp_epoch": "1541624862.769105000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/inplview.js?rev=WB6Gy8a027aeNCq7koVCUg%3D%3D", "http.response_in": "6928", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/inplview.js?rev=WB6Gy8a027aeNCq7koVCUg%3D%3D" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-cfa4637d67a5bff5945a74d2", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 6905, "timestamp_epoch": "1541624862.770720000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/sp.ribbon.js?rev=F%2BUEJ66rbXzSvpf7nN69wQ%3D%3D", "http.response_in": "6985", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/sp.ribbon.js?rev=F%2BUEJ66rbXzSvpf7nN69wQ%3D%3D" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-9ab0d72b6739ddfa35e19f81", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 6930, "timestamp_epoch": "1541624862.896966000" }, { "kind": "http_request", "dst_ip": "216.58.192.46", "fields": { "http.host": "www.google-analytics.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/__utm.gif?utmwv=5.7.2&utms=2&utmn=1279953315&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Degrees%20%26%20Programs)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624866037&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~", "http.response_in": "8061", "http.request.method": "GET", "http.request.full_uri": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=2&utmn=1279953315&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Degrees%20%26%20Programs)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624866037&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-65fd1a7aa45827e9abb4b434", "src_port": 49266, "tcp_stream": 109, "udp_stream": null, "frame_number": 8057, "timestamp_epoch": "1541624866.166359000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/bootstrap334/fonts/glyphicons-halflings-regular.woff2", "http.response_in": "8079", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/bootstrap334/fonts/glyphicons-halflings-regular.woff2" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-25529b825ec297c94c3d4215", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 8059, "timestamp_epoch": "1541624866.169891000" }, { "kind": "http_request", "dst_ip": "216.58.192.46", "fields": { "http.host": "www.google-analytics.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/__utm.gif?utmwv=5.7.2&utms=3&utmn=1832691277&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Bachelor%270s%20Degrees)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624887589&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~", "http.response_in": "8109", "http.request.method": "GET", "http.request.full_uri": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=3&utmn=1832691277&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Bachelor%270s%20Degrees)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624887589&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-3582fd260e086c204116e358", "src_port": 49266, "tcp_stream": 109, "udp_stream": null, "frame_number": 8105, "timestamp_epoch": "1541624887.715261000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/programs/undergraduate", "http.response_in": "8110", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/programs/undergraduate" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-6de0ae5eefd010c4d687eecd", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 8107, "timestamp_epoch": "1541624887.720790000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/programs/undergraduate/Pages/default.aspx", "http.response_in": "8457", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/programs/undergraduate/Pages/default.aspx" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-70851f82c4de16806c2e2405", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 8111, "timestamp_epoch": "1541624887.810832000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/corev4Anonymous.css", "http.response_in": "8150", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/corev4Anonymous.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-ff3e5ca07f7c52635007f33b", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 8121, "timestamp_epoch": "1541624892.838345000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/bootstrap334/css/bootstrap.min.css", "http.response_in": "8132", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap.min.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-2866313608338a2a7d2d0396", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 8123, "timestamp_epoch": "1541624892.840098000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/jquery-1.11.3.min.js", "http.response_in": "8151", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/jquery-1.11.3.min.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-3fdc5785a81093041693edde", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 8125, "timestamp_epoch": "1541624892.841922000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.js", "http.response_in": "8131", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-9aafae1215ab033b436dbc98", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 8127, "timestamp_epoch": "1541624892.845416000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/bootstrap334/js/bootstrap.min.js", "http.response_in": "8147", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/bootstrap334/js/bootstrap.min.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-a18cd3bca71dabca3afb31b1", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 8129, "timestamp_epoch": "1541624892.849579000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/bootstrap334/css/bootstrap-theme.min.css", "http.response_in": "8156", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap-theme.min.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-0cde1571834ea65efc18f623", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 8133, "timestamp_epoch": "1541624892.956106000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.css", "http.response_in": "8159", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-78cc3001526ef4fcf633cacf", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 8135, "timestamp_epoch": "1541624892.958159000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/responsive/responsiveBase.css", "http.response_in": "8177", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/responsive/responsiveBase.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-94b7788e15681dfce4a8aee2", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 8148, "timestamp_epoch": "1541624892.994907000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/BetaUCDenverTheme.css", "http.response_in": "8214", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/BetaUCDenverTheme.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-2b5ffe7d025844c69daf85fe", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 8152, "timestamp_epoch": "1541624893.010022000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/WebResource.axd?d=nK66gdmZPDA-w-JjHyggjO_q5ZVRp7ooiUATeOMUtTMCTlfkvxq8mxRHybfWnA0Swfdbv1YBCieMhY76WgB3McU0Erit7tpi9kGXDOtvazCF8h1BLSyM9r_pT9xkzGtAoB6i_bw2w0dM46xzuwSmUZ9Il-pR8sIBMDjV6n64EKHYbfoJqQA9doUWhsRbzsGCzJ1g7D2-gJrdDaKQJ1H6GipIFEoKwv_UCr3VeSqOsCEXfpiHtt2ZR-Y3UW4oyGmrVOioeA2&t=635701215589701395", "http.response_in": "8187", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/WebResource.axd?d=nK66gdmZPDA-w-JjHyggjO_q5ZVRp7ooiUATeOMUtTMCTlfkvxq8mxRHybfWnA0Swfdbv1YBCieMhY76WgB3McU0Erit7tpi9kGXDOtvazCF8h1BLSyM9r_pT9xkzGtAoB6i_bw2w0dM46xzuwSmUZ9Il-pR8sIBMDjV6n64EKHYbfoJqQA9doUWhsRbzsGCzJ1g7D2-gJrdDaKQJ1H6GipIFEoKwv_UCr3VeSqOsCEXfpiHtt2ZR-Y3UW4oyGmrVOioeA2&t=635701215589701395" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-aee84e2e485bc8dc2c224ef0", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 8154, "timestamp_epoch": "1541624893.012139000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/responsive/jsBaseResponsive.js", "http.response_in": "8180", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/responsive/jsBaseResponsive.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-238d7dfd2044d23ca472da39", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 8157, "timestamp_epoch": "1541624893.057986000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Javascript%20Library/UCDJS.js", "http.response_in": "8181", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Javascript%20Library/UCDJS.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-6495eae193f787bbd3ccc899", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 8160, "timestamp_epoch": "1541624893.060607000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/programs/undergraduate/Documents/Styles_Scripts/local.js", "http.response_in": "8234", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/programs/undergraduate/Documents/Styles_Scripts/local.js" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-cbb52ca9830903d1373d7f82", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 8178, "timestamp_epoch": "1541624893.130675000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/kwizcom.sharepoint.foundation/kwizcom_jsutility.js?v=13.4.81&source=kwizcomsharepointutilities", "http.response_in": "8238", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/kwizcom.sharepoint.foundation/kwizcom_jsutility.js?v=13.4.81&source=kwizcomsharepointutilities" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-dde9124aa20ae6cc53c09982", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 8182, "timestamp_epoch": "1541624893.163167000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/kwizcom.sharepoint.foundation/jquery.js?v=13.4.81&source=kwizcomsharepointutilities", "http.response_in": "8558", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/kwizcom.sharepoint.foundation/jquery.js?v=13.4.81&source=kwizcomsharepointutilities" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-6dd856ed45e18d79ef044bfa", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 8188, "timestamp_epoch": "1541624893.168255000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/kwizcom_aggregator/kwizcom_listaggregator.js?v=12.1.12&source=kwizcomsharepointutilities", "http.response_in": "8264", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/kwizcom_aggregator/kwizcom_listaggregator.js?v=12.1.12&source=kwizcomsharepointutilities" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-e8f5ad30a0594b4474e2e9d5", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 8190, "timestamp_epoch": "1541624893.170050000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/ScriptResource.axd?d=9di2kcBnRer6u7CuZUM7AfDDbzWMOK7upyNjbmE5Pdu3o5BHVtGXRC91MpdMm5XnQKxQdUdYrD0lcXagGlKdOSu2-gvQh1sQkr9VBx5eiph2ui3XCKHywHXzD91UpgfJQscXyag6PMfkkSUAwV5oTxM-pRGaKbplVIquRmAvCsECm7UwxgbHqr5oRifTbuwyorCrDIb3SKMarpQyLWAcwc1HYq01&t=3cb8783c", "http.response_in": "8286", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/ScriptResource.axd?d=9di2kcBnRer6u7CuZUM7AfDDbzWMOK7upyNjbmE5Pdu3o5BHVtGXRC91MpdMm5XnQKxQdUdYrD0lcXagGlKdOSu2-gvQh1sQkr9VBx5eiph2ui3XCKHywHXzD91UpgfJQscXyag6PMfkkSUAwV5oTxM-pRGaKbplVIquRmAvCsECm7UwxgbHqr5oRifTbuwyorCrDIb3SKMarpQyLWAcwc1HYq01&t=3cb8783c" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-ea114c32b6cf2810d35590f8", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 8216, "timestamp_epoch": "1541624893.192548000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/ScriptResource.axd?d=kbtxWN87DQ1VIylVprHAWnyKaGLTA4pXlXTHlCuJIMsMYgKaYAHacVcYWnfHdzexemLANVUTb9RCqYHuFVYEeMMivsq9U8GpgkkDFsA3RU3W-vDHMWw2gDPk5jSrhT-rAV4PHKkL432QiTzOJMscy2b0-_w-jLBdS2fQZi5KQMX9r-i8Y6ucvvNoN81ML1rcIiQZneq5Y7wGC-UMWsKoXE1IejlZ1LpGQdWma9ut0iUIFPwY0&t=3cb8783c", "http.response_in": "8488", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/ScriptResource.axd?d=kbtxWN87DQ1VIylVprHAWnyKaGLTA4pXlXTHlCuJIMsMYgKaYAHacVcYWnfHdzexemLANVUTb9RCqYHuFVYEeMMivsq9U8GpgkkDFsA3RU3W-vDHMWw2gDPk5jSrhT-rAV4PHKkL432QiTzOJMscy2b0-_w-jLBdS2fQZi5KQMX9r-i8Y6ucvvNoN81ML1rcIiQZneq5Y7wGC-UMWsKoXE1IejlZ1LpGQdWma9ut0iUIFPwY0&t=3cb8783c" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-0cec19911a5ad72dd6263283", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 8235, "timestamp_epoch": "1541624893.271519000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_catalog_small.jpg", "http.response_in": "8527", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog_small.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-2dd4f664d23ec1e1edae76e5", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 8405, "timestamp_epoch": "1541624893.492068000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_calendar_small.jpg", "http.response_in": "8528", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_calendar_small.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-a275709f61b196e91dcf6c33", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 8407, "timestamp_epoch": "1541624893.493619000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_apply_small.jpg", "http.response_in": "8560", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply_small.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-4c7534fc57283bc6696daec9", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 8529, "timestamp_epoch": "1541624893.648687000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_visit_small.jpg", "http.response_in": "8561", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit_small.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-3f6f41b5fe892e706d8f8c25", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 8531, "timestamp_epoch": "1541624893.650403000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/DDCthemes/DDCthemeMain.css", "http.response_in": "8572", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/DDCthemes/DDCthemeMain.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-2ca47f2a86570980f363bd8f", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 8566, "timestamp_epoch": "1541624893.915915000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_appStatus_small.jpg", "http.response_in": "8574", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_appStatus_small.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-f74c19e15365b4541bdd0b29", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 8568, "timestamp_epoch": "1541624893.918735000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/CUAnschutz.jpg", "http.response_in": "8573", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUAnschutz.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-07356710b9b8ad94c8ca293e", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 8570, "timestamp_epoch": "1541624893.920995000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/CUDenver.jpg", "http.response_in": "8618", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUDenver.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-63238513b5bbb866c3bc0459", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 8575, "timestamp_epoch": "1541624894.025495000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/CUSouth.jpg", "http.response_in": "8611", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUSouth.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-0ad87aa8a50e7df7840f054b", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 8577, "timestamp_epoch": "1541624894.026539000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/Testimonial/48_testimonial_klimper.jpg", "http.response_in": "8643", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/Testimonial/48_testimonial_klimper.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-692ad746ef2e43f57c279205", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 8579, "timestamp_epoch": "1541624894.027821000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/Testimonial/48_testimonial_kliese.jpg", "http.response_in": "8607", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/Testimonial/48_testimonial_kliese.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-3fe1ecb26945d808b2e16e51", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 8581, "timestamp_epoch": "1541624894.029046000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/programs/undergraduate/Pages/_layouts/images/minus.gif", "http.response_in": "8587", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/programs/undergraduate/Pages/_layouts/images/minus.gif" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-4d0fb0d59756a79865993e17", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 8583, "timestamp_epoch": "1541624894.030037000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/_layouts/KWizCom_Aggregator/loading.gif", "http.response_in": "8617", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/_layouts/KWizCom_Aggregator/loading.gif" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-9ccb9755f4f76e587abe5ea4", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 8585, "timestamp_epoch": "1541624894.031664000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-regular-webfont.woff2", "http.response_in": "8672", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-regular-webfont.woff2" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-e0345d6b04aa80e64387360c", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 8588, "timestamp_epoch": "1541624894.114920000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-bold-webfont.woff2", "http.response_in": "8675", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-bold-webfont.woff2" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-007ab4014d9b10ff2ffd3674", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 8609, "timestamp_epoch": "1541624894.127435000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-light-webfont.woff2", "http.response_in": "8679", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-light-webfont.woff2" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-e935548e282810c984dc2e3f", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 8612, "timestamp_epoch": "1541624894.130411000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/Hero/48_hero.jpg", "http.response_in": "8924", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/Hero/48_hero.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-cb1199832d2842a0b1a5fe04", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 8621, "timestamp_epoch": "1541624894.136456000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_apply.jpg", "http.response_in": "8680", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-044089fa40746762401725d3", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 8629, "timestamp_epoch": "1541624894.139813000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/cta-triple-buttons/cta2.jpg", "http.response_in": "8990", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/cta-triple-buttons/cta2.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-19286fe9327dda7e0c38d6cd", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 8645, "timestamp_epoch": "1541624894.149518000" }, { "kind": "http_request", "dst_ip": "216.58.192.46", "fields": { "http.host": "www.google-analytics.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/__utm.gif?utmwv=5.7.2&utms=4&utmn=1892096743&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x446&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Bachelor%27s%20degrees%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=326256236&utmr=0&utmp=%2Fprograms%2Fundergraduate%2FPages%2Fdefault.aspx&utmht=1541624894067&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~", "http.response_in": "8678", "http.request.method": "GET", "http.request.full_uri": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=4&utmn=1892096743&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x446&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Bachelor%27s%20degrees%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=326256236&utmr=0&utmp=%2Fprograms%2Fundergraduate%2FPages%2Fdefault.aspx&utmht=1541624894067&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-2931fdc6fcd645de05d248da", "src_port": 49266, "tcp_stream": 109, "udp_stream": null, "frame_number": 8669, "timestamp_epoch": "1541624894.195169000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/PublishingImages/CriticalPath/CTA/cta_catalog.jpg", "http.response_in": "8848", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog.jpg" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-ca3fabea660502d8d75fb405", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 8673, "timestamp_epoch": "1541624894.206873000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/Style%20Library/responsive/print.css", "http.response_in": "8849", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/Style%20Library/responsive/print.css" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-5c2394bdfbaa8be35bfe2ff7", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 8676, "timestamp_epoch": "1541624894.214024000" }, { "kind": "http_request", "dst_ip": "132.194.7.45", "fields": { "http.host": "www.ucdenver.edu", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "http.request.uri": "/academics/colleges/CLAS/Departments/english/Programs/BachelorOfArts/BAEnglish/Pages/CreativeWriting.aspx", "http.response_in": "9026", "http.request.method": "GET", "http.request.full_uri": "http://www.ucdenver.edu/academics/colleges/CLAS/Departments/english/Programs/BachelorOfArts/BAEnglish/Pages/CreativeWriting.aspx" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-5a1c2ef3dfd6595b041d7abb", "src_port": 49262, "tcp_stream": 105, "udp_stream": null, "frame_number": 9022, "timestamp_epoch": "1541624906.875946000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Google Chrome/67.0.3396.99 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-b42b3bce9467cd77be87d3fb", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 9898, "timestamp_epoch": "1541624913.892827000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Google Chrome/67.0.3396.99 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-8dfee09795caf6ae77b6c2ee", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 9904, "timestamp_epoch": "1541624914.893631000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Google Chrome/67.0.3396.99 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-c19d423d63625177480361e0", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 9905, "timestamp_epoch": "1541624915.895001000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Google Chrome/67.0.3396.99 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-ef0b546911f2d7e64c97406f", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 9906, "timestamp_epoch": "1541624916.896692000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "428", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "72.246.64.187", "dst_port": 49183, "event_id": "evt-42877ff3d7e093022b097aac", "src_port": 80, "tcp_stream": 27, "udp_stream": null, "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "frame_number": 430, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1541623252.682499000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "1247", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "439808" }, "src_ip": "46.29.160.132", "dst_port": 49208, "event_id": "evt-61ac2a1f9d7f429d2a5aacf5", "src_port": 80, "tcp_stream": 51, "udp_stream": null, "body_sha256": "97f149f146b0ec63c32abff204ae27638f0310536172b0f718f1a91a5672fe71", "frame_number": 1690, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 439808, "timestamp_epoch": "1541623636.522208000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "1734", "http.content_type": "text/html", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "192.162.244.171", "dst_port": 49210, "event_id": "evt-a3333a3689610006bbd37102", "src_port": 80, "tcp_stream": 53, "udp_stream": null, "body_sha256": "bd9ea8a38face9cb05cb209900b16b09b3bda1c247ddd7d2e2c95a82a3615cd3", "frame_number": 1936, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 213772, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 213772, "timestamp_epoch": "1541623727.126684000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "1939", "http.content_type": "image/vnd.microsoft.icon", "http.response.code": "200", "http.content_length": "5430" }, "src_ip": "192.162.244.171", "dst_port": 49210, "event_id": "evt-de25950913ed23381fd4fb83", "src_port": 80, "tcp_stream": 53, "udp_stream": null, "body_sha256": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "frame_number": 1947, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5430, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5430, "timestamp_epoch": "1541623727.325082000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "1955", "http.content_type": "text/html", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "192.162.244.171", "dst_port": 49213, "event_id": "evt-20713e722cf28b76687dbfa2", "src_port": 80, "tcp_stream": 56, "udp_stream": null, "body_sha256": "6f7307aed5e6e60222ef7d66e258362e1df71eabd5f7af0f33afa0fc6b8f65dd", "frame_number": 2224, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 271796, "timestamp_epoch": "1541623729.751578000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "2226", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "1793", "http.content_encoding": "gzip" }, "src_ip": "192.162.244.171", "dst_port": 49210, "event_id": "evt-16701db0e93fc71b4e93dc48", "src_port": 80, "tcp_stream": 53, "udp_stream": null, "body_sha256": "2e2e544728c5e5f5cfdc9ad2faf6063af99088e1c3edc32e5074e7ad541c18a0", "frame_number": 2229, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2320, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2320, "timestamp_epoch": "1541623731.191064000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "2270", "http.content_type": "application/vnd.ms-cab-compressed", "http.response.code": "200", "http.content_length": "55583" }, "src_ip": "72.246.64.147", "dst_port": 49215, "event_id": "evt-fb15110d949de65e11f79d31", "src_port": 80, "tcp_stream": 58, "udp_stream": null, "body_sha256": "9c086d962c942cff645dbd48b700191e96e3371b3d006e4eb3c7ac3c842057c9", "frame_number": 2325, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 55583, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 55583, "timestamp_epoch": "1541623798.652766000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "2555", "http.content_type": "text/html; charset=iso-8859-1", "http.response.code": "301", "http.content_length": "248" }, "src_ip": "62.149.140.59", "dst_port": 49227, "event_id": "evt-ac57854f8637a342b66a68cb", "src_port": 80, "tcp_stream": 70, "udp_stream": null, "body_sha256": "f9985bf8754e921e90a0c63e3458daf79c492f25bbaf3cf13bb14d18ca27fd5a", "frame_number": 2557, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 248, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 248, "timestamp_epoch": "1541624404.004624000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "2564", "http.content_type": "application/x-rar-compressed", "http.response.code": "200", "http.content_length": "773" }, "src_ip": "62.149.140.59", "dst_port": 49228, "event_id": "evt-8cf643d1bd12119efc2cfeb0", "src_port": 80, "tcp_stream": 71, "udp_stream": null, "body_sha256": "f099877e9778681f5ca0c77b7f18b5aa675caa6d5cd50abc28dfe6136ac3b8ac", "frame_number": 2566, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 773, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 773, "timestamp_epoch": "1541624404.525560000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4585", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "3349", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-000bdeb0d3aba4c8fce4edbb", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "2453e31f9c5e0dbee528d11f97a85edf897ed93406954ce8e475f0244abf249a", "frame_number": 4614, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19963, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 19963, "timestamp_epoch": "1541624859.312516000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4552", "http.content_type": "text/html; charset=utf-8", "http.response.code": "200", "http.content_length": "29013", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-bc96a6d37f8e6c98471bb760", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "65f5df3cd45f3b8bf27731651a76b32bdef821fdb79451fa160ee55ff30467e2", "frame_number": 4634, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 100612, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 100612, "timestamp_epoch": "1541624859.379202000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4593", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "8796", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-4d7ea2cc1948a14a50b53599", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "body_sha256": "9145ac411c9596c70f7a57d91ddf00f4888aae4d852209ed6efdf99afad1f904", "frame_number": 4666, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 42618, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 42618, "timestamp_epoch": "1541624859.438210000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4589", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "9470", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-a0d2edaa835a93e1328c6298", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "550ceb9559bb4237527909ff21e719804f6b9df337f741f756821c0c9963392b", "frame_number": 4674, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 30163, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 30163, "timestamp_epoch": "1541624859.446677000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4636", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "2366", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-136fff11bcd3d69b8ce2482b", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "1519c5e27fa45f1ceb90ae78923c474e3f5597d45e6a8c61ad73367a432333b8", "frame_number": 4708, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 8091, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 8091, "timestamp_epoch": "1541624859.494550000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4577", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "41296", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-a75ba5abed7c55c418e16f51", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "158494850d445b90585ee2d25e2969b3218808ccb0897c79ca240f7c3556d92b", "frame_number": 4746, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 191641, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 191641, "timestamp_epoch": "1541624859.561103000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4581", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "27078", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-92befbb0a9c2a8006356f8f3", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5", "frame_number": 4756, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 117305, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 117305, "timestamp_epoch": "1541624859.566371000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4710", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "12658", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-493d780055f22337768ac897", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8", "frame_number": 4786, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 35951, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 35951, "timestamp_epoch": "1541624859.615717000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4615", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "21894", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-8c11ad423e485a53226a5ed2", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "05d5af0ab07517396f53c3e161f0ebc23c09242eae0c2372d7da26dd5786953e", "frame_number": 4793, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 87318, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 87318, "timestamp_epoch": "1541624859.629177000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4768", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "10705", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-d39baaf1b39b784bc1e7163d", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "190a90d96675f28bb6ab1bab072f3b61ec321af3a8c3843a70248d9bb71bcdfe", "frame_number": 4869, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23337, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 23337, "timestamp_epoch": "1541624859.683638000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4788", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "6953", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-b012425a524bb8cc023c5113", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "4935fdc24e4a4873c078817732e45651c05091b946eff4fb774476a31d52e769", "frame_number": 4886, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 18123, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 18123, "timestamp_epoch": "1541624859.738226000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4794", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "6926", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-89f6533777890f72d15e9767", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "10570ac15a02224c4743309c48c8b8eefeaa931d9f1db7238edd7b3fa6cd2ff7", "frame_number": 4897, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 24410, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 24410, "timestamp_epoch": "1541624859.745550000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4749", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "61030", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-3909a07336978642262b2909", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "79ff1591234ea9434d7f96516781130625b1880ba4fa8eb965b278337e11f8ae", "frame_number": 4932, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 125496, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 125496, "timestamp_epoch": "1541624859.772005000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4668", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "44652", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-3d26871abf1668ceaee872bd", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "body_sha256": "ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8", "frame_number": 4951, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 95957, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 95957, "timestamp_epoch": "1541624859.774463000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4871", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "715", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-1d8996bcd72e487c30a9327f", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "61f39b4c6a88443103c0260f69dfc9484012f6bddad680b567c3ababcf416b4e", "frame_number": 4957, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1451, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1451, "timestamp_epoch": "1541624859.775508000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4899", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "120" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-ec23a9437400fb74607b441d", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "7bacd1e07f7de2e51fcd1eafbcd9ec0aaad5c16ac4c4d846a86a5654a00506b4", "frame_number": 4987, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 120, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 120, "timestamp_epoch": "1541624859.846811000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4888", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "5392", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-0956ee96e72b7e3124b223bc", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "0ba2f6756001669bdf934f9d79e8fd1ccf2028130c33a0510279581ec9dfd73a", "frame_number": 4992, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 20794, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 20794, "timestamp_epoch": "1541624859.849039000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4975", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "8840", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-2a06c838f22e9a1b580cd70f", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "0c6da6b5d4f5db2accb9c1847cd2686c683d0875750b069f14339c5f75c93029", "frame_number": 5006, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 32257, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 32257, "timestamp_epoch": "1541624859.872855000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4947", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "41125", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-dd37c86e897873a3b79fa22a", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "3c19c9d085f085252c974a1ae0637fa809cf09d3c461c64cbae6a011f7d0b78a", "frame_number": 5045, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 118049, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 118049, "timestamp_epoch": "1541624859.891622000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4676", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "88948", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-80265bab935cd482728f98f5", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "c4d8dbe77feb63e5a61bee0bead4e5f66e8fa6a927599bd1b74aced52467273c", "frame_number": 5074, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 240427, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 240427, "timestamp_epoch": "1541624859.896150000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4994", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "20115" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-81ceeb14bc641b0f2314b0bc", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "4004293f081201ead3df6f86daa9d3974bde048ae8187cda602dffb256324124", "frame_number": 5120, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 20115, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 20115, "timestamp_epoch": "1541624859.963866000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4996", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "4805" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-91c0b7fb72ce60d4c32f3ba8", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "72c3d8a0ee2408bcb595f51ec68806252c9b60a6be25b091f1d0a88655517f12", "frame_number": 5127, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4805, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 4805, "timestamp_epoch": "1541624859.968498000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "4958", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "27466", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-9233ff6e5b113fd9cc61cc41", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "body_sha256": "20f3807f724bf5bb6c8a2cf7f62bc8003717104ef480c7dfd1b8dab767144bbc", "frame_number": 5137, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 99507, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 99507, "timestamp_epoch": "1541624860.005347000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5123", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "882" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-49e5d35a61e284d5de88225f", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "9557385d62733e77c3bb5b473d9bb2fa29bd51f8b010d221cbefe8297a454291", "frame_number": 5139, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 882, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 882, "timestamp_epoch": "1541624860.081286000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5129", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "18021", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-1da7263a2f489dde3d3ac0a1", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "ff8619dad2bbbf61330224649844a7ff7665785c3f174913729961d77ba5facc", "frame_number": 5156, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 134598, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 134598, "timestamp_epoch": "1541624860.111568000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5162", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "629" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-14cc9475b6da89894dce778f", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "body_sha256": "56bbf5dbefa7919f0b8666d9cfc272b0ddbc9e920a373c1ab701d960dc09ce3a", "frame_number": 5164, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 629, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 629, "timestamp_epoch": "1541624860.228247000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5160", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "1099", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-42ab6ff9c8265590ba78f3ee", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "8ba51e69c99c8a2fee83d5cd85f86d044a51c9979f845ca6abf75901ad83f84c", "frame_number": 5166, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2281, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2281, "timestamp_epoch": "1541624860.232646000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5158", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "22156", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-a1d75e95014bd63015fc00bc", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "e1f409fdaac72c188fa638ac4be1958322f1dfe8b2b7b076c4ff95f026f47a4f", "frame_number": 5193, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 103489, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 103489, "timestamp_epoch": "1541624860.247618000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5168", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "5780" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-d9bc497fe44a2104d4e7ba30", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "body_sha256": "a417a78e9d645ffa38f11bbcd1e4bdd0295bb71e5a7dfd692b3495dac2ef4107", "frame_number": 5208, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5780, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5780, "timestamp_epoch": "1541624860.338508000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5199", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "7600" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-505e26b009ea59750472cd2a", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "c8e9a8b2cf530cc873941944744e8d053a34d2759194dae198e579c9e17399a2", "frame_number": 5219, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 7600, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 7600, "timestamp_epoch": "1541624860.345543000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5170", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "5604" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-56d8636108432fe00e5087ff", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "fb229f5700cae4392b42fe23e328ba5e697a7c84f4678670791a22ead70a9d09", "frame_number": 5226, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5604, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5604, "timestamp_epoch": "1541624860.346397000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5201", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "13648" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-2e7fbf7ba8bec8e7854d1e3c", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "19fda88c2df63d85b7762799904408d0703f7efe7d6956d70c776458075747f3", "frame_number": 5242, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 13648, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 13648, "timestamp_epoch": "1541624860.348400000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5195", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "7687" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-f77500df3d742a0f5e7f9a85", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "ff7d32dd7321a2b3c5597c69caae82409019ac22e11ecc4530188d4e3b144302", "frame_number": 5256, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 7687, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 7687, "timestamp_epoch": "1541624860.361632000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5197", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "8672" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-d5edfeefada1c226823875ab", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "022d0a09ef989821ccf3e8bd48be89355052024fc688fe3c4c84c3da00a6e082", "frame_number": 5269, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 8672, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 8672, "timestamp_epoch": "1541624860.363711000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5235", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1319" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-664b649e7933c22ed145e591", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "bfedb831c9a4afb407a127b04080c8f649d2134e713d4a1f810d9f670295cf7d", "frame_number": 5287, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1319, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1319, "timestamp_epoch": "1541624860.429149000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5210", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "23752" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-51b958d047861a8f56900fb2", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "body_sha256": "b24190e46072d124308b908776b21a50d4cefa396934bf5fb788bf26c2e67c33", "frame_number": 5326, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23752, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 23752, "timestamp_epoch": "1541624860.457981000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5247", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "23508" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-f449650f03eb3bae9b8e7228", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "3cd1a2527c206665892f1e9837f4e7cff960d7e5fa9df017c7b49e84845c0097", "frame_number": 5353, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23508, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 23508, "timestamp_epoch": "1541624860.466467000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5245", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1198" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-499670de47f217035c374b87", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "9be5b65b630c074027b64f5544e24575e36aba498ee43b12167e82b40872e01f", "frame_number": 5360, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1198, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1198, "timestamp_epoch": "1541624860.473040000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5284", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "17168", "http.content_encoding": "gzip" }, "src_ip": "216.58.192.46", "dst_port": 49266, "event_id": "evt-f37f00cfdfccc0a8c6b357cf", "src_port": 80, "tcp_stream": 109, "udp_stream": null, "body_sha256": "1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f", "frame_number": 5363, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 46274, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 46274, "timestamp_epoch": "1541624860.473093000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5272", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "23668" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-7d5f19253e4189db73cd8b26", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "ac508fa266db568a28c4e52d7dd1fcc85dbfdc38f97e39892e60f94d904e11d5", "frame_number": 5397, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23668, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 23668, "timestamp_epoch": "1541624860.489496000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5289", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "11926" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-b511a246debb7cd7ee71ec99", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "b2aba18ac53e4abc1a631c98959e5411fc64efe761dbe216e1f559b1e2d7aef2", "frame_number": 5469, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 11926, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 11926, "timestamp_epoch": "1541624860.522124000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5355", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "10826" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-e0a478f6b8a804ef36acc51c", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "7df7e6f7c22f1938c2313beb743eb60040f607f2a703a5134c8842ce7e7946ab", "frame_number": 5493, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 10826, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 10826, "timestamp_epoch": "1541624860.564825000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5262", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "56780" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-96d80d1082fd94996c82608a", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c", "frame_number": 5545, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 56780, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 56780, "timestamp_epoch": "1541624860.596966000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5412", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "30137" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-09f27f2fd6fa6d4cbc1db47c", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "02717a94a92b22f6715c10f1483a4b252f61bd705675ae250af5411ff01de437", "frame_number": 5626, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 30137, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 30137, "timestamp_epoch": "1541624860.625043000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5617", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "302", "http.content_length": "368" }, "src_ip": "216.58.192.46", "dst_port": 49266, "event_id": "evt-fe6160b5c5b39b1a15d80ed2", "src_port": 80, "tcp_stream": 109, "udp_stream": null, "body_sha256": "ca0405f6832d0b1aaf7e5c00aa3241cccf19859dc47ca15ab3a90a9ffcbdf150", "frame_number": 5690, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 368, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 368, "timestamp_epoch": "1541624860.656109000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5567", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1770" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-f316a1733e4435723f686dba", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "561ffc13ce19398e938a84992b3791d95e9d6f7b904e3f79c9728dc0c23a8297", "frame_number": 5803, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1770, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1770, "timestamp_epoch": "1541624860.710360000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5385", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "55028" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-a814c89cb570ede052421f81", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "2976d80beac91eed779d1f204cb2e1be813c53bb2e1dfe03334f2c30b4f995be", "frame_number": 5824, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 55028, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 55028, "timestamp_epoch": "1541624860.729673000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5471", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "67070" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-ad617aef62fa521b7a2d7374", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "b729bb6d682bc3df8fb04c7a940b3da0140284811d168a92929cfec7232237be", "frame_number": 5836, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 67070, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 67070, "timestamp_epoch": "1541624860.731343000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5495", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "76601" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-3cc149a39c450ff66d71c4e2", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "36d8e52a141bc54658ed41dde1654343bbd008af29f889f6e0a2f41441457ba6", "frame_number": 5882, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 76601, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 76601, "timestamp_epoch": "1541624860.748749000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5642", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1830" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-95d4bd1e7b534afeb2bb736e", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "25d7dc2c15716821face8630fbf2c166969dc0852e19c822e07982ea512da981", "frame_number": 5885, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1830, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1830, "timestamp_epoch": "1541624860.750367000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5807", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "2012" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-7bee5800537c137cc8b6c3f5", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "46868c166bdd75230bd20064033f281d2d6ca30a512eee717871dac9da416955", "frame_number": 5978, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2012, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2012, "timestamp_epoch": "1541624860.824571000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5333", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "160555" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-89bcafb3357ab6d81e2da7e6", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "body_sha256": "5fedc714f715123098edf3d8ceffcc6f6c1d503513e3dee6077c0fb3a6fcdbec", "frame_number": 5986, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 160555, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 160555, "timestamp_epoch": "1541624860.826062000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5845", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1844" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-16b0288866b4b79feaff1b68", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "4e3d1cd476ae289fb9a9f4ce26b781659410914c81d11b4befc7735f4c71b2b1", "frame_number": 5989, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1844, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1844, "timestamp_epoch": "1541624860.826336000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5841", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "2133" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-4a9286b885abec63e454c9a6", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "9d7c79b24ac12a185212ccab8741f4acdbd7ab160099e719bedd682806886ac9", "frame_number": 6003, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2133, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2133, "timestamp_epoch": "1541624860.838021000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5887", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1761" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-c39eb2ca131752a3c76d751b", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "6cba436e9e5adbe296a382ece4309eb469ec3a0d37d3b14058800f9fd57338ab", "frame_number": 6008, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1761, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1761, "timestamp_epoch": "1541624860.845286000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5889", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1524" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-fd4eb398ab36405233332d4e", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "b943dd2830226be743c9bfcb5ffa4eec591e55d09a736ffecdfd3d8b6581da31", "frame_number": 6028, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1524, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1524, "timestamp_epoch": "1541624860.860307000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6011", "http.content_type": "image/gif", "http.response.code": "200", "http.content_length": "4217" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-ad266284cd4c850d0d85d409", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "eac280b1fd4d84b2b386d93b51f9193c42f10fe9c3cb0dd1e67ebff66fd31952", "frame_number": 6064, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4217, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 4217, "timestamp_epoch": "1541624860.948095000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6000", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "45067" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-555c46688e50832e56643f3b", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "7796b5c1eb8d9c8a896b17db41ae969690f2924a8690439ac4d5511935b236c3", "frame_number": 6115, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 45067, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 45067, "timestamp_epoch": "1541624860.973636000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5996", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "42810" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-09ccc5edf052c19a41b110b1", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "body_sha256": "71ea89144415bcb2ea2585d7a5ca95b27ab2a10d7f826647bee8c9e78922c5a5", "frame_number": 6286, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 42810, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 42810, "timestamp_epoch": "1541624861.016108000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6034", "http.content_type": "image/gif", "http.response.code": "200", "http.content_length": "4229" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-c4be01af547fa3ef1f944a80", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "86a4c543d749c972e930c08df70d17f81c7eae19ea9854476eda897fd33fbfc5", "frame_number": 6291, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4229, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 4229, "timestamp_epoch": "1541624861.016855000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6074", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "705" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-a613bf3946f815a9ada5ab5f", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "d60aea1fe282db3ac579713c98d24d46850375db28ccfec0793d10f275b860a5", "frame_number": 6304, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 705, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 705, "timestamp_epoch": "1541624861.051671000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "5998", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "75852" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-9137fe5bc64a3d4534a38175", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "d7db23ac49a03eb060bc6a928b5a9044218bed6c7add87406b8867f95938aef5", "frame_number": 6326, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 75852, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 75852, "timestamp_epoch": "1541624861.085307000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6005", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "111343" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-e8ed197136fd022bcb4893a9", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "d78b0583ff00e0b8e6caac5c236fdf795fd447208cfea7f23abd528a26a57674", "frame_number": 6396, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 111343, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 111343, "timestamp_epoch": "1541624861.119966000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6579", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "4100", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-95774d8686a155c6f3aab115", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "ea99682af1f2ca9bb54887a9cc1ced7c09b2f6d7feb277f2c3d6f3b57af25fc1", "frame_number": 6593, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12352, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12352, "timestamp_epoch": "1541624862.175771000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6581", "http.content_type": "application/x-javascript; charset=utf-8", "http.response.code": "200", "http.content_length": "6160", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-2ec494b4aef010aa98874204", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "ec8202663864f3744450858c1e5a51826427b7b7b082b5d182d7be0dc47f2c4e", "frame_number": 6599, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14312, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14312, "timestamp_epoch": "1541624862.179847000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6585", "http.content_type": "image/x-icon", "http.response.code": "200", "http.content_length": "1150" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-dcbdfc3520f92954de68234f", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "body_sha256": "d2e3bd61e7e0d4f908192813267d98927cc31043d84387b1a941e3b5b15f9134", "frame_number": 6603, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1150, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1150, "timestamp_epoch": "1541624862.196154000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6601", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "10284", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-1c2f76170a92ac4e0eeeeca4", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "517319eb8ff3d0b11dc60d148babdc714087e386977101e1d76428cdbff6b9c7", "frame_number": 6740, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 34270, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 34270, "timestamp_epoch": "1541624862.281126000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6583", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "95566", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-f7bbd61ee0c8339d5b379929", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "b74056eea98bad621835b90b80499dad886c07ef70b5213bcde0408e63908c6f", "frame_number": 6779, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 352107, "timestamp_epoch": "1541624862.362097000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6742", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "18804", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-9336e57f240a5c38cb4c4e03", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "185f2b901d68c7451a492d90ed38aa2c1de840061735a06836c2587f958ed31c", "frame_number": 6796, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 68791, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 68791, "timestamp_epoch": "1541624862.387413000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6798", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "71060", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-aaf6b9ceabfeb832ac8bcce3", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "009d4cdb69f30688198c7a19b25ef0667c5f7b172d65b2273ed2274bc8eb5425", "frame_number": 6884, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 390757, "timestamp_epoch": "1541624862.621094000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6577", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "82322", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-9da41aeb40b2a920ce2b50b9", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "5b107e17113a4c5a547d98a30bcd47aa3ad52317856828c762a67fda9f34baa0", "frame_number": 6896, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 239740, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 239740, "timestamp_epoch": "1541624862.701500000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6889", "http.content_type": "text/xml; charset=utf-8", "http.response.code": "200", "http.content_length": "575" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-e2afcc02f1b29b4618d20517", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "58c778f59b121390544d07cc4ff6948eb35045eafe376247ef285d4f72cfe167", "frame_number": 6898, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 575, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 575, "timestamp_epoch": "1541624862.749001000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6903", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "5739", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-4a7c0ef76c2276f79cfc6541", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "7e0baff43a753a2dce0e85dbbd562a503c9f558f846784f3626c0b5d31c9d6d3", "frame_number": 6912, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 16377, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 16377, "timestamp_epoch": "1541624862.871996000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6905", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "14231", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-64af11732f6b48d337548445", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "b43e75f48fa68b71ee6e66751c0c3822314ca6dc592fce9309495baada78de54", "frame_number": 6928, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 39575, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 39575, "timestamp_epoch": "1541624862.891822000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6930", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "55449", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-5abc64afee762e33c628bceb", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "cbf768030ad75e8aec0263d9d2286c2b0106cf7ac4daa17396129b172a93d1a9", "frame_number": 6985, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 212665, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 212665, "timestamp_epoch": "1541624863.046602000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "6900", "http.content_type": "application/json", "http.response.code": "200", "http.content_length": "1029395" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-39a28cf6b52e3bc244931e9d", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "ea34443271cb87b667af587dc8b344c211458dc0616abdf48a49b14c4fde9b1a", "frame_number": 8048, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1029395, "timestamp_epoch": "1541624864.402572000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8057", "http.content_type": "image/gif", "http.response.code": "200", "http.content_length": "35" }, "src_ip": "216.58.192.46", "dst_port": 49266, "event_id": "evt-def46a96b1af57435312cf1e", "src_port": 80, "tcp_stream": 109, "udp_stream": null, "body_sha256": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015", "frame_number": 8061, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 35, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 35, "timestamp_epoch": "1541624866.185609000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8059", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "18028" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-966dddf6a2cb65f869a23b94", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c", "frame_number": 8079, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 18028, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 18028, "timestamp_epoch": "1541624866.268090000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8105", "http.content_type": "image/gif", "http.response.code": "200", "http.content_length": "35" }, "src_ip": "216.58.192.46", "dst_port": 49266, "event_id": "evt-ecc7cb7885e72dd57f521b10", "src_port": 80, "tcp_stream": 109, "udp_stream": null, "body_sha256": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015", "frame_number": 8109, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 35, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 35, "timestamp_epoch": "1541624887.735089000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8107", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "302", "http.content_length": "188" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-a630e3b70081d5dd3a147ca9", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "a630dac9b5b0fbea3974ad09401522aeda12f11bbe5344508829d575c03cd644", "frame_number": 8110, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 188, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 188, "timestamp_epoch": "1541624887.806709000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8127", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-02f6cd20b13d933fee4fcc50", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "frame_number": 8131, "timestamp_epoch": "1541624892.953159000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8123", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-f0df710d91cb23938ae4faea", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "frame_number": 8132, "timestamp_epoch": "1541624892.954412000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8129", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-73d01e7ae108bd186ec8898a", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "frame_number": 8147, "timestamp_epoch": "1541624892.991862000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8121", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-b36bacf8d8124346a88711b3", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "frame_number": 8150, "timestamp_epoch": "1541624893.007048000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8125", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-d70aca3c74bf0a4cb22d03b0", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "frame_number": 8151, "timestamp_epoch": "1541624893.007136000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8133", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-bb782a057d07a7b321085416", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "frame_number": 8156, "timestamp_epoch": "1541624893.055602000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8135", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-69e54415bf232eac0e018d1f", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "frame_number": 8159, "timestamp_epoch": "1541624893.058190000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8148", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-5c3efdadd233ce1ea4476c25", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "frame_number": 8177, "timestamp_epoch": "1541624893.128043000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8157", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-6eb2933c578edaa604dade67", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "frame_number": 8180, "timestamp_epoch": "1541624893.159414000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8160", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-d66b2a9fa855724f0184f2d3", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "frame_number": 8181, "timestamp_epoch": "1541624893.161124000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8154", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "3349", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-06638d713df7e586dd170200", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "body_sha256": "b5fcfa087b1cc0b1f61c17437c0a533c027dd68bb1e42898682bad189bacdf67", "frame_number": 8187, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 9556, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 9556, "timestamp_epoch": "1541624893.166127000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8152", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "21894", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-b936f1a88d22d5d8304a94e8", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "05d5af0ab07517396f53c3e161f0ebc23c09242eae0c2372d7da26dd5786953e", "frame_number": 8214, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 87318, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 87318, "timestamp_epoch": "1541624893.190877000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8178", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "416", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-72f39f51c2e5d297c7548427", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "9a4e9990d71244aaa68b4bff6d5910665e7df9051cd4ee030e61b8e7f16180c1", "frame_number": 8234, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1085, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1085, "timestamp_epoch": "1541624893.267488000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8182", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "2349", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-3ec35e5552d4a4ae60dfa6d6", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "f4fbf7d12ec5db69f6a21a8323602fe7e8aa8c4f59baea6115fe1323c3e1358f", "frame_number": 8238, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6037, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 6037, "timestamp_epoch": "1541624893.272991000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8190", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_length": "1702", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-45be0a7c7fce38672373b1ff", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "body_sha256": "8768d73b262d33c7dceaedcbf83576d31129c8bef0d03be58e92a57a65bd81c2", "frame_number": 8264, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4286, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 4286, "timestamp_epoch": "1541624893.330062000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8216", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "15053", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-bb0abdcae069bb64364edddf", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "8b6eb285d3afcd5e4d485846c70b442f4b6df4a636533493a6b45ff4808c8364", "frame_number": 8286, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 52214, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 52214, "timestamp_epoch": "1541624893.372436000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8111", "http.content_type": "text/html; charset=utf-8", "http.response.code": "200", "http.content_length": "90719", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-58a229bb0263031f87d2cf98", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "c4e63117b5fac36c75799cae97f4f0464bd9d6978b442fe6cf28078d0be7ac31", "frame_number": 8457, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 280766, "timestamp_epoch": "1541624893.515979000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8235", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "92667", "http.content_encoding": "gzip" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-15fa20d495c31db37c64d1be", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "d9f5dfcc2555a6e6c530c190b3c6f1cac2a0af97b3689547713dc28bece0e7cd", "frame_number": 8488, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 395537, "timestamp_epoch": "1541624893.626297000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8405", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-ec77e9b970da97d50aa96cd8", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "frame_number": 8527, "timestamp_epoch": "1541624893.645155000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8407", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-08d8d831f18e55f63665fc9d", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "frame_number": 8528, "timestamp_epoch": "1541624893.646237000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8188", "http.content_type": "application/x-javascript", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-fe0262982e312f25ffc29a99", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "body_sha256": "e2f4ebe008e4e29b0695a4cf033f5bc45d5ab70ca43bf0873580a7c4fd500b96", "frame_number": 8558, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 367729, "timestamp_epoch": "1541624893.743490000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8529", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-95b8cb872d4cf0cef5fb47dd", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "frame_number": 8560, "timestamp_epoch": "1541624893.783192000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8531", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-dc50f52465c4b928102b91fe", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "frame_number": 8561, "timestamp_epoch": "1541624893.783968000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8566", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-9a811b0742ce74a61f5e667c", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "frame_number": 8572, "timestamp_epoch": "1541624894.015499000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8570", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-6d7f5feab60de63ef295034c", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "frame_number": 8573, "timestamp_epoch": "1541624894.020663000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8568", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-5ae8f6599afe86cd7f6ddc21", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "frame_number": 8574, "timestamp_epoch": "1541624894.021649000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8583", "http.content_type": "image/gif", "http.response.code": "200", "http.content_length": "185" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-82f5072abab5b75f734d5476", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "37e9250c18e218e58fb1818a608e9ad463a4b4743ebf3c08ca738001cc8970e0", "frame_number": 8587, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 185, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 185, "timestamp_epoch": "1541624894.112629000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8581", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "16805" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-fb3a036a5c42bdf23536dd8e", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "398cea3dc83051c117a65a9897bd17c84dace5d700ecd01943d1e47af57b5490", "frame_number": 8607, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 16805, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 16805, "timestamp_epoch": "1541624894.125401000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8577", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-879481fc7a7ec351f22867c3", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "frame_number": 8611, "timestamp_epoch": "1541624894.128714000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8585", "http.content_type": "image/gif", "http.response.code": "200", "http.content_length": "4565" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-6b4a1e8b5e7dde31ce52dcf8", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "11065daca98f9840f58be03dd0fa78c710b9509ad517857acacf715c491de6d6", "frame_number": 8617, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4565, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 4565, "timestamp_epoch": "1541624894.134686000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8575", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-61a28e3a4a6d25b832138a28", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "frame_number": 8618, "timestamp_epoch": "1541624894.134698000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8579", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "19117" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-ad3321e5363f8daa199b9f0d", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "198f44920d0d51bc49281f580acc760fd88a96e2422c8784114df6dab93ecc09", "frame_number": 8643, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19117, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 19117, "timestamp_epoch": "1541624894.144652000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8588", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-b10febf94eb5e26a90f14782", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "frame_number": 8672, "timestamp_epoch": "1541624894.204286000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8609", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-390c36cff26b63175efe60fb", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "frame_number": 8675, "timestamp_epoch": "1541624894.208866000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8669", "http.content_type": "image/gif", "http.response.code": "200", "http.content_length": "35" }, "src_ip": "216.58.192.46", "dst_port": 49266, "event_id": "evt-8676af8f3ce9b6d428079bc0", "src_port": 80, "tcp_stream": 109, "udp_stream": null, "body_sha256": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015", "frame_number": 8678, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 35, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 35, "timestamp_epoch": "1541624894.215314000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8612", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49261, "event_id": "evt-1e895e0508dccd568dba556a", "src_port": 80, "tcp_stream": 104, "udp_stream": null, "frame_number": 8679, "timestamp_epoch": "1541624894.231645000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8629", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49264, "event_id": "evt-f00bdca118bad328a91c8c93", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "frame_number": 8680, "timestamp_epoch": "1541624894.244124000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8673", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "36669" }, "src_ip": "132.194.7.45", "dst_port": 49265, "event_id": "evt-a406da37d698e833609ac015", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "80bad0ee862dd92912bbecb161c17ce3d072b22aef1d48c3ab4c90f55939acae", "frame_number": 8848, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 36669, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 36669, "timestamp_epoch": "1541624894.307603000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8676", "http.response.code": "304", "http.content_length": "0" }, "src_ip": "132.194.7.45", "dst_port": 49263, "event_id": "evt-598d64ba60b8b7ecf47cc2d4", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "frame_number": 8849, "timestamp_epoch": "1541624894.307653000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8621", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "118604" }, "src_ip": "132.194.7.45", "dst_port": 49260, "event_id": "evt-d4218d4ddfe7e53653ae85b5", "src_port": 80, "tcp_stream": 103, "udp_stream": null, "body_sha256": "833aae2efa9e7eb97334c8596c07bd22c09ffa2e771dc64fadcfa66d2ed2330e", "frame_number": 8924, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 118604, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 118604, "timestamp_epoch": "1541624894.392289000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "8645", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "136688" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-1b3c42b81e0813fc7d578d0d", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "9c16b72304e8dbf5ddce0e0614934eac07d641ef12c654398eda8df088f3c296", "frame_number": 8990, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 136688, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 136688, "timestamp_epoch": "1541624894.483208000" }, { "kind": "http_response", "dst_ip": "10.22.15.119", "fields": { "http.request_in": "9022", "http.content_type": "text/html; charset=utf-8", "http.response.code": "302", "http.content_length": "157" }, "src_ip": "132.194.7.45", "dst_port": 49262, "event_id": "evt-06a0009037983d31a9fda088", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "5c9486d0aa62b50180e77e62b15f9977b3b0fd3f7d9b1f797de4c41b7da02b7d", "frame_number": 9026, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 157, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 157, "timestamp_epoch": "1541624907.086642000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "74.6.141.28", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "imap.aol.com" }, "src_ip": "10.22.15.119", "dst_port": 993, "event_id": "evt-00da91ecf773a288412571ba", "src_port": 49201, "tcp_stream": 44, "udp_stream": null, "frame_number": 689, "timestamp_epoch": "1541623305.152933000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.141.28", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "imap.aol.com" }, "src_ip": "10.22.15.119", "dst_port": 993, "event_id": "evt-b2969f5a9f58001f33ec6f43", "src_port": 49202, "tcp_stream": 45, "udp_stream": null, "frame_number": 717, "timestamp_epoch": "1541623306.028695000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.141.50", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "smtp.aol.com" }, "src_ip": "10.22.15.119", "dst_port": 465, "event_id": "evt-46cc8e89f744dab8218a08fe", "src_port": 49205, "tcp_stream": 48, "udp_stream": null, "frame_number": 1033, "timestamp_epoch": "1541623379.090748000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.141.28", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "imap.aol.com" }, "src_ip": "10.22.15.119", "dst_port": 993, "event_id": "evt-7493204df6084d3882a51dcb", "src_port": 49206, "tcp_stream": 49, "udp_stream": null, "frame_number": 1131, "timestamp_epoch": "1541623531.994660000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.141.50", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "smtp.aol.com" }, "src_ip": "10.22.15.119", "dst_port": 465, "event_id": "evt-f3be02ffab13a5154d62f546", "src_port": 49207, "tcp_stream": 50, "udp_stream": null, "frame_number": 1190, "timestamp_epoch": "1541623552.063814000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-6897ec30b19ffee853bd158a", "src_port": 49214, "tcp_stream": 57, "udp_stream": null, "frame_number": 2256, "timestamp_epoch": "1541623798.099564000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-90917241e8e75fc1be34d8c4", "src_port": 49216, "tcp_stream": 59, "udp_stream": null, "frame_number": 2335, "timestamp_epoch": "1541623799.430172000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-eae5492cf4aa31afc66f158e", "src_port": 49217, "tcp_stream": 60, "udp_stream": null, "frame_number": 2354, "timestamp_epoch": "1541623810.459537000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-b77b32c88f5d87ede4a1cf99", "src_port": 49218, "tcp_stream": 61, "udp_stream": null, "frame_number": 2380, "timestamp_epoch": "1541623999.415441000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-0c3aad19e41b4fd201e0aafe", "src_port": 49219, "tcp_stream": 62, "udp_stream": null, "frame_number": 2395, "timestamp_epoch": "1541624000.439640000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-132ef934dc9464bb0c583ddd", "src_port": 49221, "tcp_stream": 64, "udp_stream": null, "frame_number": 2440, "timestamp_epoch": "1541624200.447606000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-86cf955d0a164842da5d2247", "src_port": 49222, "tcp_stream": 65, "udp_stream": null, "frame_number": 2455, "timestamp_epoch": "1541624201.459241000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-45876a121a33979434583079", "src_port": 49223, "tcp_stream": 66, "udp_stream": null, "frame_number": 2472, "timestamp_epoch": "1541624212.416891000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-871b3cade61f55e0d6d45216", "src_port": 49224, "tcp_stream": 67, "udp_stream": null, "frame_number": 2495, "timestamp_epoch": "1541624223.761992000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-f44a2c85c4cf45209d568e95", "src_port": 49225, "tcp_stream": 68, "udp_stream": null, "frame_number": 2523, "timestamp_epoch": "1541624401.469751000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-af663f04b114c1a200fcde98", "src_port": 49226, "tcp_stream": 69, "udp_stream": null, "frame_number": 2538, "timestamp_epoch": "1541624402.562901000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-0fcd95d145ddc4c7dbb7715f", "src_port": 49229, "tcp_stream": 72, "udp_stream": null, "frame_number": 2573, "timestamp_epoch": "1541624414.707664000" }, { "kind": "tls_client_hello", "dst_ip": "95.181.198.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tmencedfur.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-09399e7d99036b451ed417e9", "src_port": 49230, "tcp_stream": 73, "udp_stream": null, "frame_number": 2600, "timestamp_epoch": "1541624425.693132000" }, { "kind": "tls_client_hello", "dst_ip": "46.229.214.92", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "link.sandwseafood.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-e33c19279f6c76b735a0f583", "src_port": 49231, "tcp_stream": 74, "udp_stream": null, "frame_number": 2632, "timestamp_epoch": "1541624602.665026000" }, { "kind": "tls_client_hello", "dst_ip": "46.229.214.92", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "link.sandwseafood.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-70a016ed2ae357e83fd07f51", "src_port": 49232, "tcp_stream": 75, "udp_stream": null, "frame_number": 2654, "timestamp_epoch": "1541624603.809458000" }, { "kind": "tls_client_hello", "dst_ip": "46.229.214.92", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "link.sandwseafood.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-9c38f208a39541475a716981", "src_port": 49233, "tcp_stream": 76, "udp_stream": null, "frame_number": 2673, "timestamp_epoch": "1541624614.990563000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.35", "fields": { "tls.handshake.ja3": "656854b0e07f676ae44f8d559744be60", "tls.handshake.extensions_server_name": "clientservices.googleapis.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-d09a1dbfeb1403d5143d241b", "src_port": 49234, "tcp_stream": 77, "udp_stream": null, "frame_number": 2705, "timestamp_epoch": "1541624762.900485000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.45", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "accounts.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-e2aca0dc144c45bae4e7bcd1", "src_port": 49235, "tcp_stream": 78, "udp_stream": null, "frame_number": 2723, "timestamp_epoch": "1541624763.173519000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.2.68", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-6965198a8f21e8e9f553e2d3", "src_port": 49236, "tcp_stream": 79, "udp_stream": null, "frame_number": 2747, "timestamp_epoch": "1541624767.495250000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.42", "fields": { "tls.handshake.ja3": "656854b0e07f676ae44f8d559744be60", "tls.handshake.extensions_server_name": "translate.googleapis.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-9c77fd311cf5097f43135c57", "src_port": 49237, "tcp_stream": 80, "udp_stream": null, "frame_number": 2794, "timestamp_epoch": "1541624778.242052000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.35", "fields": { "tls.handshake.ja3": "656854b0e07f676ae44f8d559744be60", "tls.handshake.extensions_server_name": "clientservices.googleapis.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-e627b26a04715d325a04b889", "src_port": 49238, "tcp_stream": 81, "udp_stream": null, "frame_number": 2828, "timestamp_epoch": "1541624794.379580000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.45", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "accounts.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-311d80ff25c561745a18de1e", "src_port": 49239, "tcp_stream": 82, "udp_stream": null, "frame_number": 2840, "timestamp_epoch": "1541624794.508880000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.2.68", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-3b764f845da3766ef622931c", "src_port": 49240, "tcp_stream": 83, "udp_stream": null, "frame_number": 2844, "timestamp_epoch": "1541624794.519353000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.35", "fields": { "tls.handshake.ja3": "656854b0e07f676ae44f8d559744be60", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-c79a6d5692ec6657e719376c", "src_port": 49241, "tcp_stream": 84, "udp_stream": null, "frame_number": 2966, "timestamp_epoch": "1541624794.830765000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.35", "fields": { "tls.handshake.ja3": "bd05542435b3f44f31461cdd7ddc94b8", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-3b23a73814314d0dd65a4379", "src_port": 49242, "tcp_stream": 85, "udp_stream": null, "frame_number": 2980, "timestamp_epoch": "1541624794.886781000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.3.67", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "ssl.gstatic.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-76142e9b7a331d3b89d549ce", "src_port": 49244, "tcp_stream": 87, "udp_stream": null, "frame_number": 3036, "timestamp_epoch": "1541624794.952834000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.35", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "www.gstatic.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-55ab6ba1666f8f9585b9731d", "src_port": 49243, "tcp_stream": 86, "udp_stream": null, "frame_number": 3040, "timestamp_epoch": "1541624794.954277000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.2.68", "fields": { "tls.handshake.ja3": "e25044a54b6fbc8ba81f95563dd201c3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-980c4aec7e5051cede5b790e", "src_port": 49245, "tcp_stream": 88, "udp_stream": null, "frame_number": 3048, "timestamp_epoch": "1541624794.961269000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.46", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "apis.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-b6b89c7e0e4f856e9d51e632", "src_port": 49246, "tcp_stream": 89, "udp_stream": null, "frame_number": 3306, "timestamp_epoch": "1541624795.471389000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.3.66", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "adservice.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-4c71259a3478a1f284e2ec89", "src_port": 49247, "tcp_stream": 90, "udp_stream": null, "frame_number": 3422, "timestamp_epoch": "1541624795.684426000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.2.68", "fields": { "tls.handshake.ja3": "e25044a54b6fbc8ba81f95563dd201c3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-b96319a4592291457b636aca", "src_port": 49248, "tcp_stream": 91, "udp_stream": null, "frame_number": 3576, "timestamp_epoch": "1541624810.118090000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.2.68", "fields": { "tls.handshake.ja3": "e25044a54b6fbc8ba81f95563dd201c3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-f56691873a8aa80d0e0e4ef6", "src_port": 49249, "tcp_stream": 92, "udp_stream": null, "frame_number": 3590, "timestamp_epoch": "1541624810.149072000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.67", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "id.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-09650970c5b07b7cf0a2d88e", "src_port": 49250, "tcp_stream": 93, "udp_stream": null, "frame_number": 3711, "timestamp_epoch": "1541624810.915240000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.46", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "encrypted-tbn0.gstatic.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-2ab46ccb5a107a90a479415c", "src_port": 49253, "tcp_stream": 96, "udp_stream": null, "frame_number": 3841, "timestamp_epoch": "1541624811.316700000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.46", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "encrypted-tbn0.gstatic.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-83005aeb8d5d3ff5badbe0c6", "src_port": 49252, "tcp_stream": 95, "udp_stream": null, "frame_number": 3848, "timestamp_epoch": "1541624811.318524000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.46", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "encrypted-tbn0.gstatic.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-320c807d0c36d41d74ca7f2e", "src_port": 49251, "tcp_stream": 94, "udp_stream": null, "frame_number": 3850, "timestamp_epoch": "1541624811.318892000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.46", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "encrypted-tbn0.gstatic.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-1aa24673af016aef6a323e8c", "src_port": 49254, "tcp_stream": 97, "udp_stream": null, "frame_number": 3852, "timestamp_epoch": "1541624811.319555000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.46", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "encrypted-tbn0.gstatic.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-3e555b9bc499bc27b13410bf", "src_port": 49255, "tcp_stream": 98, "udp_stream": null, "frame_number": 3854, "timestamp_epoch": "1541624811.319863000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.46", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "encrypted-tbn0.gstatic.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-dc9f6bf18e36f437cbed9bbc", "src_port": 49256, "tcp_stream": 99, "udp_stream": null, "frame_number": 3858, "timestamp_epoch": "1541624811.322264000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.2.68", "fields": { "tls.handshake.ja3": "e25044a54b6fbc8ba81f95563dd201c3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-d62892e460012fc5dcc61bf2", "src_port": 49257, "tcp_stream": 100, "udp_stream": null, "frame_number": 4467, "timestamp_epoch": "1541624844.620256000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.35", "fields": { "tls.handshake.ja3": "656854b0e07f676ae44f8d559744be60", "tls.handshake.extensions_server_name": "www.gstatic.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-966e457fa43238616af2b28a", "src_port": 49258, "tcp_stream": 101, "udp_stream": null, "frame_number": 4489, "timestamp_epoch": "1541624853.888354000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.46", "fields": { "tls.handshake.ja3": "656854b0e07f676ae44f8d559744be60", "tls.handshake.extensions_server_name": "clients4.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-736c6f3d24f7fe40c9ec67a8", "src_port": 49259, "tcp_stream": 102, "udp_stream": null, "frame_number": 4505, "timestamp_epoch": "1541624853.969898000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.38", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "8895986.fls.doubleclick.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-3d26a506e5adca3b24a6e970", "src_port": 49267, "tcp_stream": 110, "udp_stream": null, "frame_number": 5280, "timestamp_epoch": "1541624860.423381000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.46", "fields": { "tls.handshake.ja3": "656854b0e07f676ae44f8d559744be60", "tls.handshake.extensions_server_name": "clients1.google.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-6520d3893b7dd2cfb678817f", "src_port": 49268, "tcp_stream": 111, "udp_stream": null, "frame_number": 5485, "timestamp_epoch": "1541624860.563916000" }, { "kind": "tls_client_hello", "dst_ip": "54.86.197.0", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "insight.adsrvr.org" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-800363a83e32025b6693b12d", "src_port": 49269, "tcp_stream": 112, "udp_stream": null, "frame_number": 5843, "timestamp_epoch": "1541624860.734280000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.193.155", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "stats.g.doubleclick.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-c95675e7244db5c166603511", "src_port": 49270, "tcp_stream": 113, "udp_stream": null, "frame_number": 5895, "timestamp_epoch": "1541624860.759852000" }, { "kind": "tls_client_hello", "dst_ip": "209.15.36.22", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "pixel-a.basis.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-a5877b8fec086b0ef35e3838", "src_port": 49271, "tcp_stream": 114, "udp_stream": null, "frame_number": 5923, "timestamp_epoch": "1541624860.790028000" }, { "kind": "tls_client_hello", "dst_ip": "209.15.36.22", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "pixel-a.basis.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-adbe3feba4689b52a1cbc5dc", "src_port": 49272, "tcp_stream": 115, "udp_stream": null, "frame_number": 5936, "timestamp_epoch": "1541624860.797458000" }, { "kind": "tls_client_hello", "dst_ip": "50.116.194.23", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "d.turn.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-3537d31b24958d274e77df29", "src_port": 49273, "tcp_stream": 116, "udp_stream": null, "frame_number": 5994, "timestamp_epoch": "1541624860.828547000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.15.194", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-47820eb4035e77f0d7e76689", "src_port": 49274, "tcp_stream": 117, "udp_stream": null, "frame_number": 6052, "timestamp_epoch": "1541624860.926710000" }, { "kind": "tls_client_hello", "dst_ip": "209.15.36.22", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "pixel.sitescout.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-c527ef4332514d75b39ce228", "src_port": 49275, "tcp_stream": 118, "udp_stream": null, "frame_number": 6312, "timestamp_epoch": "1541624861.082125000" }, { "kind": "tls_client_hello", "dst_ip": "209.15.36.22", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "pixel.sitescout.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-7cca63041ae29eccdb8e3816", "src_port": 49276, "tcp_stream": 119, "udp_stream": null, "frame_number": 6317, "timestamp_epoch": "1541624861.082743000" }, { "kind": "tls_client_hello", "dst_ip": "34.192.39.141", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "match.adsrvr.org" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-afac920ad073a65fbfc3b3d1", "src_port": 49277, "tcp_stream": 120, "udp_stream": null, "frame_number": 6400, "timestamp_epoch": "1541624861.137244000" }, { "kind": "tls_client_hello", "dst_ip": "23.56.194.57", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "dsum-sec.casalemedia.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-4fdb0483c8fdb541ae5160dc", "src_port": 49278, "tcp_stream": 121, "udp_stream": null, "frame_number": 6453, "timestamp_epoch": "1541624861.343026000" }, { "kind": "tls_client_hello", "dst_ip": "34.227.43.215", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "bcp.crwdcntrl.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-5884d18d0873cd5b3e0ab75d", "src_port": 49280, "tcp_stream": 123, "udp_stream": null, "frame_number": 6464, "timestamp_epoch": "1541624861.384572000" }, { "kind": "tls_client_hello", "dst_ip": "107.178.246.49", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "pixel.tapad.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-cb78e1a243ae610a80c93337", "src_port": 49283, "tcp_stream": 126, "udp_stream": null, "frame_number": 6468, "timestamp_epoch": "1541624861.391564000" }, { "kind": "tls_client_hello", "dst_ip": "52.207.122.163", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "sync.teads.tv" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-c6299566a43bbc012971bff1", "src_port": 49282, "tcp_stream": 125, "udp_stream": null, "frame_number": 6478, "timestamp_epoch": "1541624861.417726000" }, { "kind": "tls_client_hello", "dst_ip": "63.251.240.12", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "loadm.exelator.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-9fbf728828dd44ef2ef7a7b5", "src_port": 49281, "tcp_stream": 124, "udp_stream": null, "frame_number": 6484, "timestamp_epoch": "1541624861.422233000" }, { "kind": "tls_client_hello", "dst_ip": "52.214.151.124", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "dpm.demdex.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-6f1f9a6cd546881df149126d", "src_port": 49279, "tcp_stream": 122, "udp_stream": null, "frame_number": 6499, "timestamp_epoch": "1541624861.460273000" }, { "kind": "tls_client_hello", "dst_ip": "132.194.39.10", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "clas.ucdenver.edu" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-d981066e2db038b792284a09", "src_port": 49284, "tcp_stream": 127, "udp_stream": null, "frame_number": 9034, "timestamp_epoch": "1541624907.199832000" }, { "kind": "tls_client_hello", "dst_ip": "93.184.216.182", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "fast.fonts.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-8325243c62ff3efd62e6b6ed", "src_port": 49290, "tcp_stream": 133, "udp_stream": null, "frame_number": 9074, "timestamp_epoch": "1541624907.838644000" }, { "kind": "tls_client_hello", "dst_ip": "132.194.39.10", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "clas.ucdenver.edu" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-0f154beb9b21752fecc8ea28", "src_port": 49287, "tcp_stream": 130, "udp_stream": null, "frame_number": 9081, "timestamp_epoch": "1541624907.845875000" }, { "kind": "tls_client_hello", "dst_ip": "132.194.39.10", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "clas.ucdenver.edu" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-de3fa851f2980ad2e690048a", "src_port": 49285, "tcp_stream": 128, "udp_stream": null, "frame_number": 9084, "timestamp_epoch": "1541624907.846160000" }, { "kind": "tls_client_hello", "dst_ip": "132.194.39.10", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "clas.ucdenver.edu" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-16f1cdbb841ed6df0ae11e69", "src_port": 49288, "tcp_stream": 131, "udp_stream": null, "frame_number": 9086, "timestamp_epoch": "1541624907.846496000" }, { "kind": "tls_client_hello", "dst_ip": "132.194.39.10", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "clas.ucdenver.edu" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-81f1b636fb02a8b3cf8367bf", "src_port": 49289, "tcp_stream": 132, "udp_stream": null, "frame_number": 9097, "timestamp_epoch": "1541624907.861241000" }, { "kind": "tls_client_hello", "dst_ip": "132.194.39.10", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "clas.ucdenver.edu" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-1f9add5575168f3ecfe051dd", "src_port": 49286, "tcp_stream": 129, "udp_stream": null, "frame_number": 9106, "timestamp_epoch": "1541624907.867635000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.192.46", "fields": { "tls.handshake.ja3": "14eff09463c9d6dc6e14e954eba239c2", "tls.handshake.extensions_server_name": "www.google-analytics.com" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-4e22a94b618d7e2a16493268", "src_port": 49291, "tcp_stream": 134, "udp_stream": null, "frame_number": 9350, "timestamp_epoch": "1541624908.366512000" }, { "kind": "tls_client_hello", "dst_ip": "93.184.216.182", "fields": { "tls.handshake.ja3": "656854b0e07f676ae44f8d559744be60", "tls.handshake.extensions_server_name": "fast.fonts.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-9f21b041e712011bc0753b9f", "src_port": 49293, "tcp_stream": 136, "udp_stream": null, "frame_number": 9359, "timestamp_epoch": "1541624908.372161000" }, { "kind": "tls_client_hello", "dst_ip": "93.184.216.182", "fields": { "tls.handshake.ja3": "656854b0e07f676ae44f8d559744be60", "tls.handshake.extensions_server_name": "fast.fonts.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-dcf04b07eda62a5fed1162d8", "src_port": 49296, "tcp_stream": 139, "udp_stream": null, "frame_number": 9364, "timestamp_epoch": "1541624908.372476000" }, { "kind": "tls_client_hello", "dst_ip": "93.184.216.182", "fields": { "tls.handshake.ja3": "656854b0e07f676ae44f8d559744be60", "tls.handshake.extensions_server_name": "fast.fonts.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-279b7a5e6d581b641294aa88", "src_port": 49292, "tcp_stream": 135, "udp_stream": null, "frame_number": 9366, "timestamp_epoch": "1541624908.372709000" }, { "kind": "tls_client_hello", "dst_ip": "93.184.216.182", "fields": { "tls.handshake.ja3": "656854b0e07f676ae44f8d559744be60", "tls.handshake.extensions_server_name": "fast.fonts.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-0dda3fcc9f8e067a899cd8f5", "src_port": 49294, "tcp_stream": 137, "udp_stream": null, "frame_number": 9368, "timestamp_epoch": "1541624908.372911000" }, { "kind": "tls_client_hello", "dst_ip": "93.184.216.182", "fields": { "tls.handshake.ja3": "656854b0e07f676ae44f8d559744be60", "tls.handshake.extensions_server_name": "fast.fonts.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-b348427cc0957a515e1e21b8", "src_port": 49295, "tcp_stream": 138, "udp_stream": null, "frame_number": 9370, "timestamp_epoch": "1541624908.373123000" }, { "kind": "tls_client_hello", "dst_ip": "46.229.214.92", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "link.sandwseafood.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-f2b79de5490db8ad399d6991", "src_port": 49298, "tcp_stream": 141, "udp_stream": null, "frame_number": 10188, "timestamp_epoch": "1541625603.803940000" }, { "kind": "tls_client_hello", "dst_ip": "46.229.214.92", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "link.sandwseafood.net" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-e7a2d0d79bd09f2fbff26d33", "src_port": 49299, "tcp_stream": 142, "udp_stream": null, "frame_number": 10203, "timestamp_epoch": "1541625614.954030000" } ], "unclassified_tcp": [ { "kind": "unclassified_tcp", "dst_ip": "216.58.192.35", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-bca8e61c2a6abecdfaf8f5e0", "src_port": 49238, "tcp_stream": 81, "udp_stream": null, "frame_number": 4335, "timestamp_epoch": "1541624839.567726000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.45", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-09869d0d12e1d040cc1ee948", "src_port": 49239, "tcp_stream": 82, "udp_stream": null, "frame_number": 4336, "timestamp_epoch": "1541624839.613331000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.35", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-83eb40d7107c6652bdb5038e", "src_port": 49241, "tcp_stream": 84, "udp_stream": null, "frame_number": 4337, "timestamp_epoch": "1541624839.926447000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.3.67", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-0de596e1bd274b73298c8f8b", "src_port": 49244, "tcp_stream": 87, "udp_stream": null, "frame_number": 4341, "timestamp_epoch": "1541624840.034479000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.35", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-57a1ee2d4f9c690527dbf0a5", "src_port": 49243, "tcp_stream": 86, "udp_stream": null, "frame_number": 4344, "timestamp_epoch": "1541624840.362315000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-182cd832c4d78065e02ae09d", "src_port": 49246, "tcp_stream": 89, "udp_stream": null, "frame_number": 4345, "timestamp_epoch": "1541624840.581159000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.67", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-6f8f495b478636edd50482e5", "src_port": 49250, "tcp_stream": 93, "udp_stream": null, "frame_number": 4525, "timestamp_epoch": "1541624856.002271000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-081e9b72951c23950283a0be", "src_port": 49252, "tcp_stream": 95, "udp_stream": null, "frame_number": 4526, "timestamp_epoch": "1541624856.407973000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-35c28f7c3ca3f674cd65e97f", "src_port": 49254, "tcp_stream": 97, "udp_stream": null, "frame_number": 4527, "timestamp_epoch": "1541624856.408100000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-12ca5d2d3170295187c93349", "src_port": 49251, "tcp_stream": 94, "udp_stream": null, "frame_number": 4528, "timestamp_epoch": "1541624856.408162000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-9c24f94bec04cb05778643d8", "src_port": 49253, "tcp_stream": 96, "udp_stream": null, "frame_number": 4529, "timestamp_epoch": "1541624856.408216000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-1e332448213fdc01b3f86051", "src_port": 49255, "tcp_stream": 98, "udp_stream": null, "frame_number": 4530, "timestamp_epoch": "1541624856.408265000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-31ac1ed67c4658cbdfb3168c", "src_port": 49256, "tcp_stream": 99, "udp_stream": null, "frame_number": 4531, "timestamp_epoch": "1541624856.408321000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.35", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-ba6fc0e4ca1672361f8e29c3", "src_port": 49238, "tcp_stream": 81, "udp_stream": null, "frame_number": 8093, "timestamp_epoch": "1541624884.573257000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.45", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-4057960eb0976ca8680507e0", "src_port": 49239, "tcp_stream": 82, "udp_stream": null, "frame_number": 8095, "timestamp_epoch": "1541624884.619833000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.35", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-2d400666727b77ed11063e11", "src_port": 49241, "tcp_stream": 84, "udp_stream": null, "frame_number": 8097, "timestamp_epoch": "1541624884.932725000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.3.67", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-62d76f7771cb0aae5b745ad7", "src_port": 49244, "tcp_stream": 87, "udp_stream": null, "frame_number": 8099, "timestamp_epoch": "1541624885.041509000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.35", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-5d0338f180ee104c97577fb1", "src_port": 49243, "tcp_stream": 86, "udp_stream": null, "frame_number": 8101, "timestamp_epoch": "1541624885.368178000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-ef7ac6f2dffbd2e0583c4e37", "src_port": 49246, "tcp_stream": 89, "udp_stream": null, "frame_number": 8103, "timestamp_epoch": "1541624885.586971000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.35", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-980722d67486a8b4ee39c9d6", "src_port": 49258, "tcp_stream": 101, "udp_stream": null, "frame_number": 8996, "timestamp_epoch": "1541624898.992889000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-5a8663f0c00da517e4a92e0e", "src_port": 49259, "tcp_stream": 102, "udp_stream": null, "frame_number": 8997, "timestamp_epoch": "1541624899.070605000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.67", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-ee5573c46969f149fc8d7691", "src_port": 49250, "tcp_stream": 93, "udp_stream": null, "frame_number": 8998, "timestamp_epoch": "1541624901.004275000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-16c7f7a9bba2172ff5494dba", "src_port": 49252, "tcp_stream": 95, "udp_stream": null, "frame_number": 9000, "timestamp_epoch": "1541624901.407437000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-0a727d6f190fc921feca3401", "src_port": 49251, "tcp_stream": 94, "udp_stream": null, "frame_number": 9001, "timestamp_epoch": "1541624901.407509000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-8f2c35bef18a4da63d5d01bc", "src_port": 49255, "tcp_stream": 98, "udp_stream": null, "frame_number": 9003, "timestamp_epoch": "1541624901.407564000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-9927262c828b420da31b3982", "src_port": 49256, "tcp_stream": 99, "udp_stream": null, "frame_number": 9004, "timestamp_epoch": "1541624901.407596000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-a95062862c635d529e038567", "src_port": 49254, "tcp_stream": 97, "udp_stream": null, "frame_number": 9008, "timestamp_epoch": "1541624901.414317000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-83ed728b726f20d81a0eeb17", "src_port": 49253, "tcp_stream": 96, "udp_stream": null, "frame_number": 9009, "timestamp_epoch": "1541624901.414396000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.2.68", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-4a6345849a3462f55723888c", "src_port": 49245, "tcp_stream": 88, "udp_stream": null, "frame_number": 9012, "timestamp_epoch": "1541624903.618901000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.38", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-61e6664b3d0dbb71f35bde12", "src_port": 49267, "tcp_stream": 110, "udp_stream": null, "frame_number": 9013, "timestamp_epoch": "1541624905.602215000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.3.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-8a883fcdfa5444bcc4a52cf4", "src_port": 49247, "tcp_stream": 90, "udp_stream": null, "frame_number": 9014, "timestamp_epoch": "1541624905.862286000" }, { "kind": "unclassified_tcp", "dst_ip": "54.86.197.0", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-90bd4ffcbcb9e40d4fd51dbd", "src_port": 49269, "tcp_stream": 112, "udp_stream": null, "frame_number": 9015, "timestamp_epoch": "1541624905.871517000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.193.155", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-8672a848f9d76f7efb4ee458", "src_port": 49270, "tcp_stream": 113, "udp_stream": null, "frame_number": 9016, "timestamp_epoch": "1541624905.892442000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.2.68", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-cab35a99c51f117bd211e7bb", "src_port": 49240, "tcp_stream": 83, "udp_stream": null, "frame_number": 9017, "timestamp_epoch": "1541624905.942474000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.15.194", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-84f68f3de779f3474a56279b", "src_port": 49274, "tcp_stream": 117, "udp_stream": null, "frame_number": 9018, "timestamp_epoch": "1541624906.060510000" }, { "kind": "unclassified_tcp", "dst_ip": "34.192.39.141", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-1f04f9fe1db1ed9c071314da", "src_port": 49277, "tcp_stream": 120, "udp_stream": null, "frame_number": 9019, "timestamp_epoch": "1541624906.270676000" }, { "kind": "unclassified_tcp", "dst_ip": "107.178.246.49", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-5c9b90e248792bee762de708", "src_port": 49283, "tcp_stream": 126, "udp_stream": null, "frame_number": 9020, "timestamp_epoch": "1541624906.504887000" }, { "kind": "unclassified_tcp", "dst_ip": "52.207.122.163", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-9882a327d7c5b1538ad2a10c", "src_port": 49282, "tcp_stream": 125, "udp_stream": null, "frame_number": 9021, "timestamp_epoch": "1541624906.569567000" }, { "kind": "unclassified_tcp", "dst_ip": "52.214.151.124", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-73ac2869b3a824696d3ea18b", "src_port": 49279, "tcp_stream": 122, "udp_stream": null, "frame_number": 9024, "timestamp_epoch": "1541624906.887837000" }, { "kind": "unclassified_tcp", "dst_ip": "23.56.194.57", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-3e5c275d92073109837c3d56", "src_port": 49278, "tcp_stream": 121, "udp_stream": null, "frame_number": 9025, "timestamp_epoch": "1541624907.055442000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.35", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-957ceccdea7d8e4a4f1d5d08", "src_port": 49238, "tcp_stream": 81, "udp_stream": null, "frame_number": 9921, "timestamp_epoch": "1541624929.574362000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.45", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-36637675a13f548ae26bdd74", "src_port": 49239, "tcp_stream": 82, "udp_stream": null, "frame_number": 9923, "timestamp_epoch": "1541624929.637079000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.35", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-e1213e9eb309b195574c96ce", "src_port": 49241, "tcp_stream": 84, "udp_stream": null, "frame_number": 9925, "timestamp_epoch": "1541624929.933551000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.3.67", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-6f44fa69ef0b91085df89a54", "src_port": 49244, "tcp_stream": 87, "udp_stream": null, "frame_number": 9927, "timestamp_epoch": "1541624930.058113000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.35", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-dd019b7ee4ef8b728cc03992", "src_port": 49243, "tcp_stream": 86, "udp_stream": null, "frame_number": 9929, "timestamp_epoch": "1541624930.385209000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-f4d7979d70ae683c5b5cb7ef", "src_port": 49246, "tcp_stream": 89, "udp_stream": null, "frame_number": 9931, "timestamp_epoch": "1541624930.587722000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-503706b14b6036b0d45d6e05", "src_port": 49268, "tcp_stream": 111, "udp_stream": null, "frame_number": 9933, "timestamp_epoch": "1541624939.199329000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-96874bd7bb79ce7d7a0e611a", "src_port": 49266, "tcp_stream": 109, "udp_stream": null, "frame_number": 9934, "timestamp_epoch": "1541624939.230362000" }, { "kind": "unclassified_tcp", "dst_ip": "132.194.7.45", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-98ad0201bd937420ad6470f1", "src_port": 49261, "tcp_stream": 104, "udp_stream": null, "frame_number": 9935, "timestamp_epoch": "1541624939.230499000" }, { "kind": "unclassified_tcp", "dst_ip": "132.194.7.45", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-058f1bdb25d5b8b6811a4510", "src_port": 49264, "tcp_stream": 107, "udp_stream": null, "frame_number": 9936, "timestamp_epoch": "1541624939.245705000" }, { "kind": "unclassified_tcp", "dst_ip": "132.194.7.45", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-5660b65322158f78f0efc1d3", "src_port": 49263, "tcp_stream": 106, "udp_stream": null, "frame_number": 9937, "timestamp_epoch": "1541624939.324652000" }, { "kind": "unclassified_tcp", "dst_ip": "132.194.7.45", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-ede25bf7d6f97f60a2c72379", "src_port": 49265, "tcp_stream": 108, "udp_stream": null, "frame_number": 9938, "timestamp_epoch": "1541624939.324760000" }, { "kind": "unclassified_tcp", "dst_ip": "132.194.7.45", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 80, "event_id": "evt-ce4eec36b5fffda7e83a6479", "src_port": 49260, "tcp_stream": 103, "udp_stream": null, "frame_number": 9939, "timestamp_epoch": "1541624939.402131000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.35", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-55344a2be4bf34393696c8d3", "src_port": 49258, "tcp_stream": 101, "udp_stream": null, "frame_number": 9940, "timestamp_epoch": "1541624944.003738000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-9c8871d139e32ec58e41de4d", "src_port": 49259, "tcp_stream": 102, "udp_stream": null, "frame_number": 9942, "timestamp_epoch": "1541624944.082390000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.67", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-2996bf6fdfb2ee4df65df424", "src_port": 49250, "tcp_stream": 93, "udp_stream": null, "frame_number": 9944, "timestamp_epoch": "1541624946.017248000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-5c6cc017ed8b1b4781411f2b", "src_port": 49254, "tcp_stream": 97, "udp_stream": null, "frame_number": 9946, "timestamp_epoch": "1541624946.406648000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-d29ddbfc1f20ab6a479fa516", "src_port": 49253, "tcp_stream": 96, "udp_stream": null, "frame_number": 9947, "timestamp_epoch": "1541624946.406754000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-1f2539ab4146cf42c1cc5716", "src_port": 49252, "tcp_stream": 95, "udp_stream": null, "frame_number": 9950, "timestamp_epoch": "1541624946.422196000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-dc6bda20a88cc55ae578ab7a", "src_port": 49251, "tcp_stream": 94, "udp_stream": null, "frame_number": 9951, "timestamp_epoch": "1541624946.422305000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-da5f8a2fb0cf99ce1aa68b67", "src_port": 49255, "tcp_stream": 98, "udp_stream": null, "frame_number": 9953, "timestamp_epoch": "1541624946.422383000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-a764c46a54790f62fa6a0755", "src_port": 49256, "tcp_stream": 99, "udp_stream": null, "frame_number": 9955, "timestamp_epoch": "1541624946.422435000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.2.68", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-69ec162c39b820f0cf9c27db", "src_port": 49245, "tcp_stream": 88, "udp_stream": null, "frame_number": 9958, "timestamp_epoch": "1541624948.621784000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.192.38", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-d8f859965ea8ad21d57d55b0", "src_port": 49267, "tcp_stream": 110, "udp_stream": null, "frame_number": 9960, "timestamp_epoch": "1541624950.598510000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.3.66", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-85657ec342c7d10cb4ba4758", "src_port": 49247, "tcp_stream": 90, "udp_stream": null, "frame_number": 9962, "timestamp_epoch": "1541624950.858604000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.193.155", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-07e2a8966316be449624b50e", "src_port": 49270, "tcp_stream": 113, "udp_stream": null, "frame_number": 9964, "timestamp_epoch": "1541624950.888561000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.2.68", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-1c602aa1f1e3233699fb64ba", "src_port": 49240, "tcp_stream": 83, "udp_stream": null, "frame_number": 9966, "timestamp_epoch": "1541624950.938565000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.15.194", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-f72f13b91f2e037dc19f14af", "src_port": 49274, "tcp_stream": 117, "udp_stream": null, "frame_number": 9968, "timestamp_epoch": "1541624951.074060000" }, { "kind": "unclassified_tcp", "dst_ip": "107.178.246.49", "fields": { "tcp.payload": "00" }, "src_ip": "10.22.15.119", "dst_port": 443, "event_id": "evt-baf53f70811409efa0934827", "src_port": 49283, "tcp_stream": 126, "udp_stream": null, "frame_number": 9970, "timestamp_epoch": "1541624951.511309000" } ], "directory_service": [ { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-7f24dbeed908e6c5b1601b0e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 61, "timestamp_epoch": "1541623247.300187000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-db83da9618f8b09551411243", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 62, "timestamp_epoch": "1541623247.300468000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-c5df1bd3d70a3fece3705ee4", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 63, "timestamp_epoch": "1541623247.300750000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-6169d75d9563968e158ee9f3", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 64, "timestamp_epoch": "1541623247.301811000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-62fbfdebff0fe4386dbffc96", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 65, "timestamp_epoch": "1541623247.302018000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-ca8f6285715ea193773dc01d", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 66, "timestamp_epoch": "1541623247.302289000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-7fc96e4708ef3ce3690f5329", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 67, "timestamp_epoch": "1541623247.302447000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-352aa314d2f190cf6f01d6b1", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 68, "timestamp_epoch": "1541623247.302590000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-af53b391fbf3651fbd2cad25", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 147, "timestamp_epoch": "1541623247.416749000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-e956c58d99fb4ba07e33e489", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 149, "timestamp_epoch": "1541623247.417034000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-2de4493b3e2cc62e923ebc14", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 164, "timestamp_epoch": "1541623247.423078000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-ead4b132c6dafeb99ec38b85", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 166, "timestamp_epoch": "1541623247.423783000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": {}, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6ead72ea8809ddf0146f071f", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 167, "timestamp_epoch": "1541623247.424536000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": {}, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-110bf1cec0ed682686da7ea0", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 168, "timestamp_epoch": "1541623247.424722000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": {}, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-a694395af7db3512da60e39b", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 169, "timestamp_epoch": "1541623247.425107000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": {}, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-51757c3bd9272784e28adde8", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 170, "timestamp_epoch": "1541623247.426163000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": {}, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-baa264903a0d9ebcc79a6ee9", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 183, "timestamp_epoch": "1541623247.538622000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": {}, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-5b26ef72d5363987d717b7c2", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 186, "timestamp_epoch": "1541623247.539052000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-19a6067477faa02fb3ae3ed2", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 194, "timestamp_epoch": "1541623247.569921000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-c1b5662ffc3217b227687b6e", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 196, "timestamp_epoch": "1541623247.570215000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-fbc44531a32736d18f86222c", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 211, "timestamp_epoch": "1541623247.575919000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-5eec967710dc0ba3f9820cf0", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 213, "timestamp_epoch": "1541623247.576569000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-2b19ead0cb9546c7d9e35b60", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 214, "timestamp_epoch": "1541623247.577899000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": {}, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-09f50b2dcda739c44a244dcf", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 227, "timestamp_epoch": "1541623247.638130000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": {}, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-cf4bb580d8380f64117c4e1f", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 229, "timestamp_epoch": "1541623247.638522000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": {}, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-0ba53da75871a88643d5f6fc", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 236, "timestamp_epoch": "1541623247.640319000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": {}, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-8f9a17b3d543f9a66d39ae69", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 237, "timestamp_epoch": "1541623247.640616000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": {}, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-692291583eaecaca1ee925ea", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 243, "timestamp_epoch": "1541623247.643164000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": {}, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-8dfe3e1f8b7ed018f5b77dee", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 245, "timestamp_epoch": "1541623247.643477000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": {}, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-abc855914699e6ac02065cf7", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 246, "timestamp_epoch": "1541623247.643759000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": {}, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-a8811f2ae6d541a72623c890", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 247, "timestamp_epoch": "1541623247.644020000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": {}, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-30824dfeb61b69634560d497", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 248, "timestamp_epoch": "1541623247.644406000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-c39e27daad25a30179820ce9", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 265, "timestamp_epoch": "1541623247.900943000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-ed6ea6e322cfde2a174229b5", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 266, "timestamp_epoch": "1541623247.901170000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-502f832a2efd1d9e76232863", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 267, "timestamp_epoch": "1541623247.901756000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-3ffb0bd104423d847861d8ac", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 268, "timestamp_epoch": "1541623247.902082000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-678090750eea0a7a6f101ea4", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 269, "timestamp_epoch": "1541623247.903079000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-69bbcd9b9f0084725545e14a", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 270, "timestamp_epoch": "1541623247.903375000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-1ae22ebeb173869e2d55dcb2", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 271, "timestamp_epoch": "1541623247.903721000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-dc96315c1764122f5f75042c", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 272, "timestamp_epoch": "1541623247.903899000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-e08e2c28327f4e542b90cf49", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 284, "timestamp_epoch": "1541623248.499043000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-fdb7a231b1cd19a990adf41c", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 286, "timestamp_epoch": "1541623248.499338000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6f94ac508a343e5b656c03cf", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 289, "timestamp_epoch": "1541623248.500775000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-e99ced48ad7d03c81c59e206", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 291, "timestamp_epoch": "1541623248.502017000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=geeographic,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-dd89cef9bde55a299e24d0eb", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 304, "timestamp_epoch": "1541623248.537407000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-65e44dd462bca841a2aaf3ee", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 305, "timestamp_epoch": "1541623248.538089000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-f01280f1a5c0442d380c70e4", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 323, "timestamp_epoch": "1541623248.542803000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-4c0bbf1b9caa09d73b2d128d", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 332, "timestamp_epoch": "1541623248.543707000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-0993eb6cf653eef292c91e5b", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 334, "timestamp_epoch": "1541623248.544217000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-861481a6171837eec3bbacba", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 335, "timestamp_epoch": "1541623248.544345000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=geeographic,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-0cc98f2cae49dad4ccd7ecdc", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 339, "timestamp_epoch": "1541623248.544835000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-55838d861a41e5992523d9a0", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 340, "timestamp_epoch": "1541623248.545400000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=geeographic,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-8195f34f4595a1d4333d03f7", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 341, "timestamp_epoch": "1541623248.545742000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-9f1216548215caee1dafdf81", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 342, "timestamp_epoch": "1541623248.546504000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-faa85d203186670cb4ddc88e", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 389, "timestamp_epoch": "1541623248.562719000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-1db12358309c40bbfd360b3b", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 393, "timestamp_epoch": "1541623248.904903000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6dd77cb5dcabfcdd19db3bf7", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 442, "timestamp_epoch": "1541623257.815083000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-3adb70acac2e1384f7deaf82", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 444, "timestamp_epoch": "1541623257.815328000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-6e6927888dbbf5033fb5b88f", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 447, "timestamp_epoch": "1541623257.817209000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-059fef10ffdeb431f6fc7dd9", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 449, "timestamp_epoch": "1541623257.818427000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-4c51319eba385dcb08e490a0", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 450, "timestamp_epoch": "1541623257.820362000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-9ab7ebf917032ec454791f80", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 451, "timestamp_epoch": "1541623257.820563000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-13567f5a71a3302a871c617f", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 452, "timestamp_epoch": "1541623257.820766000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-e564b82b5eb30b6a51b16dfe", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 453, "timestamp_epoch": "1541623257.820976000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=GEEOGRAPHIC-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=geeographic,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-016bd9dd125ac6e0f255378e", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 454, "timestamp_epoch": "1541623257.821158000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-f2313dca686e9f32f933e3ee", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 455, "timestamp_epoch": "1541623257.821674000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=geeographic,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-e37a5dbc00192e861a473031", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 456, "timestamp_epoch": "1541623257.821851000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-0fa9c192e5967a7722453dbd", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 457, "timestamp_epoch": "1541623257.823006000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-f88fb1dc2716b9a238ce6e8c", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 462, "timestamp_epoch": "1541623257.837420000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-78848294861631a6095e9b52", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 464, "timestamp_epoch": "1541623257.838139000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-acbb98ebb9e9e5ffc19211f2", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 465, "timestamp_epoch": "1541623257.838599000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-30b28fe00b83d120c7c1ddb5", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 466, "timestamp_epoch": "1541623257.838794000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=geeographic,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-856f6740cf0911ece9c01750", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 497, "timestamp_epoch": "1541623257.865990000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-cec93388475ab8257948d609", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 498, "timestamp_epoch": "1541623257.866736000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-516ddc440c89493306d98f1d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 499, "timestamp_epoch": "1541623257.866978000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-2b32ace61ebe4635306da7ea", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 501, "timestamp_epoch": "1541623257.867426000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-93ec7a5d8bbe25cfa861b6bf", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 582, "timestamp_epoch": "1541623290.695364000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-c1798c5bb1eb5782ce1b3cd5", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 583, "timestamp_epoch": "1541623290.695588000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-ecca800305c824712b193b1a", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 584, "timestamp_epoch": "1541623290.695797000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-b47d4478e0926d738245254b", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 585, "timestamp_epoch": "1541623290.696840000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-3d450011a38c1f4af7cd30f7", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 586, "timestamp_epoch": "1541623290.696999000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-2d0f7d60f88bd523bf6c8b42", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 587, "timestamp_epoch": "1541623290.697274000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-3ca8c2df91e6ef03de811845", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 588, "timestamp_epoch": "1541623290.697408000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-c87bd56bc483a7a10de49455", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 589, "timestamp_epoch": "1541623290.697564000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-28a44e346f4eeb96f63b2c88", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 612, "timestamp_epoch": "1541623291.234957000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-716aaa23594bc6f5a6ae5ffc", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 614, "timestamp_epoch": "1541623291.235665000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=geeographic,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-ceb89acbf525543e08a4c423", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 615, "timestamp_epoch": "1541623291.237701000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-b5805bbd1fd189a5f5a9b842", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 616, "timestamp_epoch": "1541623291.238225000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-929f6838291fa9e72bfa2d72", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 621, "timestamp_epoch": "1541623291.241809000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-4fe9c629ea68fab83ecd8eb2", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 623, "timestamp_epoch": "1541623291.242484000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-baf6557036dbee66b864fdf9", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 624, "timestamp_epoch": "1541623291.242910000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-f07b62da9072afd1aee65fc7", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 625, "timestamp_epoch": "1541623291.243091000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=geeographic,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-422548c34fa817fddeff2ea7", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 626, "timestamp_epoch": "1541623291.243349000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-3fabcaff28f10290ba532983", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 627, "timestamp_epoch": "1541623291.243975000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=geeographic,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-789cc907bbf0392adb0483fc", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 628, "timestamp_epoch": "1541623291.244283000" }, { "kind": "directory_service", "dst_ip": "10.22.15.119", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.22.15.2", "dst_port": null, "event_id": "evt-a3256eb4c17e90648603cc4a", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 629, "timestamp_epoch": "1541623291.245124000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-22b784103c55ba65e539383d", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 670, "timestamp_epoch": "1541623291.255387000" }, { "kind": "directory_service", "dst_ip": "10.22.15.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.22.15.119", "dst_port": null, "event_id": "evt-1821ffa74696d4cdff8c9d8b", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 676, "timestamp_epoch": "1541623291.771562000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 10231, "interface_ids": [], "source_sha256": "79f9a39e2cb38303a7f2e8363d984f727347537a87473679d9c081e79cde527f", "captured_bytes": 7573642, "protocol_counts": { "ip": 10231, "dns": 172, "eth": 10231, "ntp": 6, "png": 12, "smb": 3, "tcp": 9942, "tls": 1759, "udp": 278, "xml": 3, "data": 77, "dhcp": 6, "http": 262, "igmp": 22, "json": 1, "ldap": 78, "mdns": 6, "nbns": 48, "nbss": 84, "ocsp": 7, "smb2": 81, "ssdp": 12, "cldap": 12, "llmnr": 16, "media": 4, "dcerpc": 68, "pkcs-1": 21, "spnego": 46, "x509ce": 864, "gss-api": 76, "x509sat": 1108, "kerberos": 48, "ethertype": 10231, "image-gif": 7, "image-jfif": 22, "spnego-krb5": 139, "pkix1explicit": 76, "pkix1implicit": 106, "data-text-lines": 54 }, "duration_seconds": 2476.61435, "last_packet_epoch": "1541625723.650355", "source_size_bytes": 7737362, "first_packet_epoch": "1541623247.036005", "encapsulation_types": [ 1 ] }, "summary": "Decoded 10231 packets across 43 IP endpoints and 251 transport flows. Observed 172 DNS events, 143 HTTP requests, 79 TLS ClientHello events, and 106 recovered file/message object(s). Deterministic rules produced 33 finding(s): 0 high, 29 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [ "Conflicting TCP overlap: fallback extraction rejected this direction" ], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 172, "truncated": false }, "dhcp": { "returned": 6, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 224, "truncated": false }, "http_request": { "returned": 143, "truncated": false }, "http_response": { "returned": 131, "truncated": false }, "tls_client_hello": { "returned": 79, "truncated": false }, "unclassified_tcp": { "returned": 69, "truncated": false }, "directory_service": { "returned": 98, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 7594694, "export_status": "completed", "unique_hashes": 106, "hashed_objects": 109, "compact_objects": 0, "detailed_objects": 106, "exported_objects": 109, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 106 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": false, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/img/client.rar", "source": "62.149.140.59", "destination": "10.22.15.119", "content_type": "text/html; charset=iso-8859-1", "response_count": 1, "declared_body_bytes": 248 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 70, "frame_number": 2555, "display_filter": "frame.number == 2555", "timestamp_epoch": "1541624403.848059000" }, { "tcp_stream": 70, "frame_number": 2557, "display_filter": "frame.number == 2557", "timestamp_epoch": "1541624404.004624000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-6c7000d53e402fddbdfc6b5b", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/img/client.rar", "source": "62.149.140.59", "destination": "10.22.15.119", "content_type": "application/x-rar-compressed", "response_count": 1, "declared_body_bytes": 773 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 71, "frame_number": 2564, "display_filter": "frame.number == 2564", "timestamp_epoch": "1541624404.370399000" }, { "tcp_stream": 71, "frame_number": 2566, "display_filter": "frame.number == 2566", "timestamp_epoch": "1541624404.525560000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-11c4ed4cefde9b87b0c877a5", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Javascript%20Library/jquery-1.11.3.min.js", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 44652 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 107, "frame_number": 4668, "display_filter": "frame.number == 4668", "timestamp_epoch": "1541624859.440397000" }, { "tcp_stream": 107, "frame_number": 4951, "display_filter": "frame.number == 4951", "timestamp_epoch": "1541624859.774463000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-56eaccd041ce430de5097878", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.js", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 88948 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 105, "frame_number": 4676, "display_filter": "frame.number == 4676", "timestamp_epoch": "1541624859.448624000" }, { "tcp_stream": 105, "frame_number": 5074, "display_filter": "frame.number == 5074", "timestamp_epoch": "1541624859.896150000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-aa21768809964f4b28d931af", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Style%20Library/bootstrap334/js/bootstrap.min.js", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 12658 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 103, "frame_number": 4710, "display_filter": "frame.number == 4710", "timestamp_epoch": "1541624859.497098000" }, { "tcp_stream": 103, "frame_number": 4786, "display_filter": "frame.number == 4786", "timestamp_epoch": "1541624859.615717000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-d7da9087c62463793d9d6302", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Javascript%20Library/angular.min.js", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 61030 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 106, "frame_number": 4749, "display_filter": "frame.number == 4749", "timestamp_epoch": "1541624859.563108000" }, { "tcp_stream": 106, "frame_number": 4932, "display_filter": "frame.number == 4932", "timestamp_epoch": "1541624859.772005000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-cc0dd00bb9ad2570403ef7f5", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Javascript%20Library/angular-animate.min.js", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 10705 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 108, "frame_number": 4768, "display_filter": "frame.number == 4768", "timestamp_epoch": "1541624859.568418000" }, { "tcp_stream": 108, "frame_number": 4869, "display_filter": "frame.number == 4869", "timestamp_epoch": "1541624859.683638000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-2b18c3304884b1e75fa07f27", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Javascript%20Library/jquery.jcarousel.min.js", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 6953 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 103, "frame_number": 4788, "display_filter": "frame.number == 4788", "timestamp_epoch": "1541624859.617568000" }, { "tcp_stream": 103, "frame_number": 4886, "display_filter": "frame.number == 4886", "timestamp_epoch": "1541624859.738226000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-30e5ebe1af18ae0fc127da02", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Javascript%20Library/responsive/jsBaseResponsive.js", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 6926 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 104, "frame_number": 4794, "display_filter": "frame.number == 4794", "timestamp_epoch": "1541624859.630828000" }, { "tcp_stream": 104, "frame_number": 4897, "display_filter": "frame.number == 4897", "timestamp_epoch": "1541624859.745550000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-ea9cf0bb761e806e0eef1598", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Javascript%20Library/UCDJS.js", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 715 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 108, "frame_number": 4871, "display_filter": "frame.number == 4871", "timestamp_epoch": "1541624859.685949000" }, { "tcp_stream": 108, "frame_number": 4957, "display_filter": "frame.number == 4957", "timestamp_epoch": "1541624859.775508000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-66f4de3bef819e3b8721df4a", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/blank.js?rev=QGOYAJlouiWgFRlhHVlMKA%3D%3D", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 120 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 104, "frame_number": 4899, "display_filter": "frame.number == 4899", "timestamp_epoch": "1541624859.747203000" }, { "tcp_stream": 104, "frame_number": 4987, "display_filter": "frame.number == 4987", "timestamp_epoch": "1541624859.846811000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-a51cd93bc70d19306248e493", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/1033/init.js?rev=wgiyW1GQqDQZTITaawvYoA%3D%3D", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 41125 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 106, "frame_number": 4947, "display_filter": "frame.number == 4947", "timestamp_epoch": "1541624859.774236000" }, { "tcp_stream": 106, "frame_number": 5045, "display_filter": "frame.number == 5045", "timestamp_epoch": "1541624859.891622000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-951ab7e76d7019e3b8496816", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/carousel.js", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 882 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 104, "frame_number": 5123, "display_filter": "frame.number == 5123", "timestamp_epoch": "1541624859.966453000" }, { "tcp_stream": 104, "frame_number": 5139, "display_filter": "frame.number == 5139", "timestamp_epoch": "1541624860.081286000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-9a760475ec2282e6c902c0fb", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-search-ng.js", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 18021 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 103, "frame_number": 5129, "display_filter": "frame.number == 5129", "timestamp_epoch": "1541624859.971247000" }, { "tcp_stream": 103, "frame_number": 5156, "display_filter": "frame.number == 5156", "timestamp_epoch": "1541624860.111568000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-7c6bc4a7221d1e166387aea2", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/data.js", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 1099 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 104, "frame_number": 5160, "display_filter": "frame.number == 5160", "timestamp_epoch": "1541624860.128717000" }, { "tcp_stream": 104, "frame_number": 5166, "display_filter": "frame.number == 5166", "timestamp_epoch": "1541624860.232646000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-26636f3b01b11dc22d8bf738", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/ga.js", "source": "216.58.192.46", "destination": "10.22.15.119", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 17168 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 109, "frame_number": 5284, "display_filter": "frame.number == 5284", "timestamp_epoch": "1541624860.425130000" }, { "tcp_stream": 109, "frame_number": 5363, "display_filter": "frame.number == 5363", "timestamp_epoch": "1541624860.473093000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-cf12beec20ab49594b63b728", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/1033/core.js?rev=Emb5hNX1RZMNXk9oS82yvA%3D%3D", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 82322 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 104, "frame_number": 6577, "display_filter": "frame.number == 6577", "timestamp_epoch": "1541624862.071589000" }, { "tcp_stream": 104, "frame_number": 6896, "display_filter": "frame.number == 6896", "timestamp_epoch": "1541624862.701500000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-d9b4784364d7ba6af0d934a1", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/sp.core.js?rev=7ByNlH%2BvcgRJg%2BRCctdC0w%3D%3D", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 4100 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 103, "frame_number": 6579, "display_filter": "frame.number == 6579", "timestamp_epoch": "1541624862.073012000" }, { "tcp_stream": 103, "frame_number": 6593, "display_filter": "frame.number == 6593", "timestamp_epoch": "1541624862.175771000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-c583d058164c184ece16e7db", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/cui.js?rev=OOyJv78CADNBeet%2FvTvniQ%3D%3D", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 95566 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 105, "frame_number": 6583, "display_filter": "frame.number == 6583", "timestamp_epoch": "1541624862.075493000" }, { "tcp_stream": 105, "frame_number": 6779, "display_filter": "frame.number == 6779", "timestamp_epoch": "1541624862.362097000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-16f9c9dec659732b24138abc", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/sp.ui.dialog.js?rev=Tpcmo1%2FSu6R0yewHowDl5g%3D%3D", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 10284 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 108, "frame_number": 6601, "display_filter": "frame.number == 6601", "timestamp_epoch": "1541624862.185947000" }, { "tcp_stream": 108, "frame_number": 6740, "display_filter": "frame.number == 6740", "timestamp_epoch": "1541624862.281126000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-2074dc07d31fd4fcc84cb1d0", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/sp.runtime.js?rev=IGffcZfunndj0247nOxKVg%3D%3D", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 18804 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 108, "frame_number": 6742, "display_filter": "frame.number == 6742", "timestamp_epoch": "1541624862.290081000" }, { "tcp_stream": 108, "frame_number": 6796, "display_filter": "frame.number == 6796", "timestamp_epoch": "1541624862.387413000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-1a2f73725e41fe5acbf44c82", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/sp.js?rev=%2B4ZEyA892P3T0504qi0paw%3D%3D", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 71060 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 108, "frame_number": 6798, "display_filter": "frame.number == 6798", "timestamp_epoch": "1541624862.397142000" }, { "tcp_stream": 108, "frame_number": 6884, "display_filter": "frame.number == 6884", "timestamp_epoch": "1541624862.621094000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-db95b17aaa84c84e27e494ba", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/mediaplayer.js?rev=Q6vfD9BNL%2B9PvwgrVEcc%2FA%3D%3D", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 5739 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 104, "frame_number": 6903, "display_filter": "frame.number == 6903", "timestamp_epoch": "1541624862.769105000" }, { "tcp_stream": 104, "frame_number": 6912, "display_filter": "frame.number == 6912", "timestamp_epoch": "1541624862.871996000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-e64811e9887f404c7c5ef860", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/inplview.js?rev=WB6Gy8a027aeNCq7koVCUg%3D%3D", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 14231 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 105, "frame_number": 6905, "display_filter": "frame.number == 6905", "timestamp_epoch": "1541624862.770720000" }, { "tcp_stream": 105, "frame_number": 6928, "display_filter": "frame.number == 6928", "timestamp_epoch": "1541624862.891822000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-f6222acc85a75e6c8147ff4a", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/sp.ribbon.js?rev=F%2BUEJ66rbXzSvpf7nN69wQ%3D%3D", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 55449 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 105, "frame_number": 6930, "display_filter": "frame.number == 6930", "timestamp_epoch": "1541624862.896966000" }, { "tcp_stream": 105, "frame_number": 6985, "display_filter": "frame.number == 6985", "timestamp_epoch": "1541624863.046602000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-4bada970304b4abdd4161deb", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/programs/undergraduate/Documents/Styles_Scripts/local.js", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 416 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 106, "frame_number": 8178, "display_filter": "frame.number == 8178", "timestamp_epoch": "1541624893.130675000" }, { "tcp_stream": 106, "frame_number": 8234, "display_filter": "frame.number == 8234", "timestamp_epoch": "1541624893.267488000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-a740bcc4525a3dfc898fb716", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/kwizcom.sharepoint.foundation/kwizcom_jsutility.js?v=13.4.81&source=kwizcomsharepointutilities", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 2349 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 103, "frame_number": 8182, "display_filter": "frame.number == 8182", "timestamp_epoch": "1541624893.163167000" }, { "tcp_stream": 103, "frame_number": 8238, "display_filter": "frame.number == 8238", "timestamp_epoch": "1541624893.272991000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-1db38ffc2a89fd193ad4bdb2", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/kwizcom.sharepoint.foundation/jquery.js?v=13.4.81&source=kwizcomsharepointutilities", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 0 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 104, "frame_number": 8188, "display_filter": "frame.number == 8188", "timestamp_epoch": "1541624893.168255000" }, { "tcp_stream": 104, "frame_number": 8558, "display_filter": "frame.number == 8558", "timestamp_epoch": "1541624893.743490000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-d08ff1cdf302193557710a7a", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/_layouts/kwizcom_aggregator/kwizcom_listaggregator.js?v=12.1.12&source=kwizcomsharepointutilities", "source": "132.194.7.45", "destination": "10.22.15.119", "content_type": "application/x-javascript", "response_count": 1, "declared_body_bytes": 1702 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 107, "frame_number": 8190, "display_filter": "frame.number == 8190", "timestamp_epoch": "1541624893.170050000" }, { "tcp_stream": 107, "frame_number": 8264, "display_filter": "frame.number == 8264", "timestamp_epoch": "1541624893.330062000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-b548ac6871cfb79badd894e5", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.22.15.119", "protocol": "drsuapi", "destination": "10.22.15.2", "event_count": 12, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 1, "frame_number": 61, "display_filter": "frame.number == 61", "timestamp_epoch": "1541623247.300187000" }, { "tcp_stream": 1, "frame_number": 63, "display_filter": "frame.number == 63", "timestamp_epoch": "1541623247.300750000" }, { "tcp_stream": 1, "frame_number": 65, "display_filter": "frame.number == 65", "timestamp_epoch": "1541623247.302018000" }, { "tcp_stream": 1, "frame_number": 67, "display_filter": "frame.number == 67", "timestamp_epoch": "1541623247.302447000" }, { "tcp_stream": 1, "frame_number": 265, "display_filter": "frame.number == 265", "timestamp_epoch": "1541623247.900943000" }, { "tcp_stream": 1, "frame_number": 267, "display_filter": "frame.number == 267", "timestamp_epoch": "1541623247.901756000" }, { "tcp_stream": 1, "frame_number": 269, "display_filter": "frame.number == 269", "timestamp_epoch": "1541623247.903079000" }, { "tcp_stream": 1, "frame_number": 271, "display_filter": "frame.number == 271", "timestamp_epoch": "1541623247.903721000" }, { "tcp_stream": 1, "frame_number": 582, "display_filter": "frame.number == 582", "timestamp_epoch": "1541623290.695364000" }, { "tcp_stream": 1, "frame_number": 584, "display_filter": "frame.number == 584", "timestamp_epoch": "1541623290.695797000" }, { "tcp_stream": 1, "frame_number": 586, "display_filter": "frame.number == 586", "timestamp_epoch": "1541623290.696999000" }, { "tcp_stream": 1, "frame_number": 588, "display_filter": "frame.number == 588", "timestamp_epoch": "1541623290.697408000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-dfc586f419e9b125803d0905", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.22.15.119", "protocol": "ldap", "destination": "10.22.15.2", "event_count": 41, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 11, "frame_number": 147, "display_filter": "frame.number == 147", "timestamp_epoch": "1541623247.416749000" }, { "tcp_stream": 11, "frame_number": 164, "display_filter": "frame.number == 164", "timestamp_epoch": "1541623247.423078000" }, { "tcp_stream": 11, "frame_number": 167, "display_filter": "frame.number == 167", "timestamp_epoch": "1541623247.424536000" }, { "tcp_stream": 11, "frame_number": 169, "display_filter": "frame.number == 169", "timestamp_epoch": "1541623247.425107000" }, { "tcp_stream": 11, "frame_number": 183, "display_filter": "frame.number == 183", "timestamp_epoch": "1541623247.538622000" }, { "tcp_stream": 14, "frame_number": 194, "display_filter": "frame.number == 194", "timestamp_epoch": "1541623247.569921000" }, { "tcp_stream": 14, "frame_number": 211, "display_filter": "frame.number == 211", "timestamp_epoch": "1541623247.575919000" }, { "tcp_stream": 14, "frame_number": 214, "display_filter": "frame.number == 214", "timestamp_epoch": "1541623247.577899000" }, { "tcp_stream": 11, "frame_number": 227, "display_filter": "frame.number == 227", "timestamp_epoch": "1541623247.638130000" }, { "tcp_stream": 11, "frame_number": 236, "display_filter": "frame.number == 236", "timestamp_epoch": "1541623247.640319000" }, { "tcp_stream": 11, "frame_number": 243, "display_filter": "frame.number == 243", "timestamp_epoch": "1541623247.643164000" }, { "tcp_stream": 11, "frame_number": 246, "display_filter": "frame.number == 246", "timestamp_epoch": "1541623247.643759000" }, { "tcp_stream": 11, "frame_number": 248, "display_filter": "frame.number == 248", "timestamp_epoch": "1541623247.644406000" }, { "tcp_stream": 19, "frame_number": 284, "display_filter": "frame.number == 284", "timestamp_epoch": "1541623248.499043000" }, { "tcp_stream": 19, "frame_number": 289, "display_filter": "frame.number == 289", "timestamp_epoch": "1541623248.500775000" }, { "tcp_stream": 19, "frame_number": 304, "display_filter": "frame.number == 304", "timestamp_epoch": "1541623248.537407000" }, { "tcp_stream": 22, "frame_number": 323, "display_filter": "frame.number == 323", "timestamp_epoch": "1541623248.542803000" }, { "tcp_stream": 22, "frame_number": 334, "display_filter": "frame.number == 334", "timestamp_epoch": "1541623248.544217000" }, { "tcp_stream": 22, "frame_number": 339, "display_filter": "frame.number == 339", "timestamp_epoch": "1541623248.544835000" }, { "tcp_stream": 19, "frame_number": 341, "display_filter": "frame.number == 341", "timestamp_epoch": "1541623248.545742000" }, { "tcp_stream": 22, "frame_number": 389, "display_filter": "frame.number == 389", "timestamp_epoch": "1541623248.562719000" }, { "tcp_stream": 19, "frame_number": 393, "display_filter": "frame.number == 393", "timestamp_epoch": "1541623248.904903000" }, { "tcp_stream": 28, "frame_number": 442, "display_filter": "frame.number == 442", "timestamp_epoch": "1541623257.815083000" }, { "tcp_stream": 28, "frame_number": 447, "display_filter": "frame.number == 447", "timestamp_epoch": "1541623257.817209000" }, { "tcp_stream": 28, "frame_number": 450, "display_filter": "frame.number == 450", "timestamp_epoch": "1541623257.820362000" }, { "tcp_stream": 28, "frame_number": 452, "display_filter": "frame.number == 452", "timestamp_epoch": "1541623257.820766000" }, { "tcp_stream": 28, "frame_number": 454, "display_filter": "frame.number == 454", "timestamp_epoch": "1541623257.821158000" }, { "tcp_stream": 28, "frame_number": 456, "display_filter": "frame.number == 456", "timestamp_epoch": "1541623257.821851000" }, { "tcp_stream": 29, "frame_number": 462, "display_filter": "frame.number == 462", "timestamp_epoch": "1541623257.837420000" }, { "tcp_stream": 29, "frame_number": 465, "display_filter": "frame.number == 465", "timestamp_epoch": "1541623257.838599000" }, { "tcp_stream": 29, "frame_number": 497, "display_filter": "frame.number == 497", "timestamp_epoch": "1541623257.865990000" }, { "tcp_stream": 29, "frame_number": 499, "display_filter": "frame.number == 499", "timestamp_epoch": "1541623257.866978000" }, { "tcp_stream": 28, "frame_number": 501, "display_filter": "frame.number == 501", "timestamp_epoch": "1541623257.867426000" }, { "tcp_stream": 38, "frame_number": 612, "display_filter": "frame.number == 612", "timestamp_epoch": "1541623291.234957000" }, { "tcp_stream": 38, "frame_number": 615, "display_filter": "frame.number == 615", "timestamp_epoch": "1541623291.237701000" }, { "tcp_stream": 40, "frame_number": 621, "display_filter": "frame.number == 621", "timestamp_epoch": "1541623291.241809000" }, { "tcp_stream": 40, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1541623291.242910000" }, { "tcp_stream": 40, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1541623291.243349000" }, { "tcp_stream": 38, "frame_number": 628, "display_filter": "frame.number == 628", "timestamp_epoch": "1541623291.244283000" }, { "tcp_stream": 40, "frame_number": 670, "display_filter": "frame.number == 670", "timestamp_epoch": "1541623291.255387000" }, { "tcp_stream": 38, "frame_number": 676, "display_filter": "frame.number == 676", "timestamp_epoch": "1541623291.771562000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-1ea50b65536223054ef04b50", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.22.15.2", "protocol": "drsuapi", "destination": "10.22.15.119", "event_count": 12, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 1, "frame_number": 62, "display_filter": "frame.number == 62", "timestamp_epoch": "1541623247.300468000" }, { "tcp_stream": 1, "frame_number": 64, "display_filter": "frame.number == 64", "timestamp_epoch": "1541623247.301811000" }, { "tcp_stream": 1, "frame_number": 66, "display_filter": "frame.number == 66", "timestamp_epoch": "1541623247.302289000" }, { "tcp_stream": 1, "frame_number": 68, "display_filter": "frame.number == 68", "timestamp_epoch": "1541623247.302590000" }, { "tcp_stream": 1, "frame_number": 266, "display_filter": "frame.number == 266", "timestamp_epoch": "1541623247.901170000" }, { "tcp_stream": 1, "frame_number": 268, "display_filter": "frame.number == 268", "timestamp_epoch": "1541623247.902082000" }, { "tcp_stream": 1, "frame_number": 270, "display_filter": "frame.number == 270", "timestamp_epoch": "1541623247.903375000" }, { "tcp_stream": 1, "frame_number": 272, "display_filter": "frame.number == 272", "timestamp_epoch": "1541623247.903899000" }, { "tcp_stream": 1, "frame_number": 583, "display_filter": "frame.number == 583", "timestamp_epoch": "1541623290.695588000" }, { "tcp_stream": 1, "frame_number": 585, "display_filter": "frame.number == 585", "timestamp_epoch": "1541623290.696840000" }, { "tcp_stream": 1, "frame_number": 587, "display_filter": "frame.number == 587", "timestamp_epoch": "1541623290.697274000" }, { "tcp_stream": 1, "frame_number": 589, "display_filter": "frame.number == 589", "timestamp_epoch": "1541623290.697564000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-9b7bbddfa6eb4449d36eab65", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.22.15.2", "protocol": "ldap", "destination": "10.22.15.119", "event_count": 33, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 11, "frame_number": 149, "display_filter": "frame.number == 149", "timestamp_epoch": "1541623247.417034000" }, { "tcp_stream": 11, "frame_number": 166, "display_filter": "frame.number == 166", "timestamp_epoch": "1541623247.423783000" }, { "tcp_stream": 11, "frame_number": 168, "display_filter": "frame.number == 168", "timestamp_epoch": "1541623247.424722000" }, { "tcp_stream": 11, "frame_number": 170, "display_filter": "frame.number == 170", "timestamp_epoch": "1541623247.426163000" }, { "tcp_stream": 11, "frame_number": 186, "display_filter": "frame.number == 186", "timestamp_epoch": "1541623247.539052000" }, { "tcp_stream": 14, "frame_number": 196, "display_filter": "frame.number == 196", "timestamp_epoch": "1541623247.570215000" }, { "tcp_stream": 14, "frame_number": 213, "display_filter": "frame.number == 213", "timestamp_epoch": "1541623247.576569000" }, { "tcp_stream": 11, "frame_number": 229, "display_filter": "frame.number == 229", "timestamp_epoch": "1541623247.638522000" }, { "tcp_stream": 11, "frame_number": 237, "display_filter": "frame.number == 237", "timestamp_epoch": "1541623247.640616000" }, { "tcp_stream": 11, "frame_number": 245, "display_filter": "frame.number == 245", "timestamp_epoch": "1541623247.643477000" }, { "tcp_stream": 11, "frame_number": 247, "display_filter": "frame.number == 247", "timestamp_epoch": "1541623247.644020000" }, { "tcp_stream": 19, "frame_number": 286, "display_filter": "frame.number == 286", "timestamp_epoch": "1541623248.499338000" }, { "tcp_stream": 19, "frame_number": 291, "display_filter": "frame.number == 291", "timestamp_epoch": "1541623248.502017000" }, { "tcp_stream": 19, "frame_number": 305, "display_filter": "frame.number == 305", "timestamp_epoch": "1541623248.538089000" }, { "tcp_stream": 22, "frame_number": 332, "display_filter": "frame.number == 332", "timestamp_epoch": "1541623248.543707000" }, { "tcp_stream": 22, "frame_number": 335, "display_filter": "frame.number == 335", "timestamp_epoch": "1541623248.544345000" }, { "tcp_stream": 22, "frame_number": 340, "display_filter": "frame.number == 340", "timestamp_epoch": "1541623248.545400000" }, { "tcp_stream": 19, "frame_number": 342, "display_filter": "frame.number == 342", "timestamp_epoch": "1541623248.546504000" }, { "tcp_stream": 28, "frame_number": 444, "display_filter": "frame.number == 444", "timestamp_epoch": "1541623257.815328000" }, { "tcp_stream": 28, "frame_number": 449, "display_filter": "frame.number == 449", "timestamp_epoch": "1541623257.818427000" }, { "tcp_stream": 28, "frame_number": 451, "display_filter": "frame.number == 451", "timestamp_epoch": "1541623257.820563000" }, { "tcp_stream": 28, "frame_number": 453, "display_filter": "frame.number == 453", "timestamp_epoch": "1541623257.820976000" }, { "tcp_stream": 28, "frame_number": 455, "display_filter": "frame.number == 455", "timestamp_epoch": "1541623257.821674000" }, { "tcp_stream": 28, "frame_number": 457, "display_filter": "frame.number == 457", "timestamp_epoch": "1541623257.823006000" }, { "tcp_stream": 29, "frame_number": 464, "display_filter": "frame.number == 464", "timestamp_epoch": "1541623257.838139000" }, { "tcp_stream": 29, "frame_number": 466, "display_filter": "frame.number == 466", "timestamp_epoch": "1541623257.838794000" }, { "tcp_stream": 29, "frame_number": 498, "display_filter": "frame.number == 498", "timestamp_epoch": "1541623257.866736000" }, { "tcp_stream": 38, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1541623291.235665000" }, { "tcp_stream": 38, "frame_number": 616, "display_filter": "frame.number == 616", "timestamp_epoch": "1541623291.238225000" }, { "tcp_stream": 40, "frame_number": 623, "display_filter": "frame.number == 623", "timestamp_epoch": "1541623291.242484000" }, { "tcp_stream": 40, "frame_number": 625, "display_filter": "frame.number == 625", "timestamp_epoch": "1541623291.243091000" }, { "tcp_stream": 40, "frame_number": 627, "display_filter": "frame.number == 627", "timestamp_epoch": "1541623291.243975000" }, { "tcp_stream": 38, "frame_number": 629, "display_filter": "frame.number == 629", "timestamp_epoch": "1541623291.245124000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-82744eb117c1a168c9ad8b47", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "0d7a18ff70d35c8ae1806363ccd862d9", "sha1": "069089c8c5d61b646f1cdb8ecb26b28b2a181dd4", "type": "http-exported-object", "sha256": "97f149f146b0ec63c32abff204ae27638f0310536172b0f718f1a91a5672fe71", "evidence": [ { "tcp_stream": 51, "frame_number": 1690, "display_filter": "frame.number == 1690", "timestamp_epoch": "1541623636.522208000" } ], "filename": "fatog.php%3fl=ngul5.xap", "filenames": [ "fatog.php%3fl=ngul5.xap" ], "transfers": [ { "url": "http://shumbildac.com/WES/fatog.php?l=ngul5.xap", "client_ip": "10.22.15.119", "server_ip": "46.29.160.132", "tcp_stream": 51, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1247, "response_frame": 1690 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 439808, "artifact_id": "artifact-00bacaef7d553f0b0ecce2ab", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "ee0077f443c296f57b4f87714ab8e5bd", "sha1": "43059e8a73310bccc741da1bdc8cbae7a3784e5c", "type": "http-exported-object", "sha256": "d9f5dfcc2555a6e6c530c190b3c6f1cac2a0af97b3689547713dc28bece0e7cd", "evidence": [ { "tcp_stream": 106, "frame_number": 8488, "display_filter": "frame.number == 8488", "timestamp_epoch": "1541624893.626297000" } ], "filename": "ScriptResource.axd%3fd=kbtxWN87DQ1VIylVprHAWnyKaGLTA4pXlXTHlCuJIMsMYgKaYAHacVcYWnfHdzexemLANVUTb9RCqYHuFVYEeMMivsq9U8GpgkkDFsA3RU3W-vDHMWw2gDPk5jSrhT-rAV4PHKkL432QiTzOJMscy2b0-_w-jLBdS2fQZi5KQMX9r-i8Y6ucvvNoN81ML1rcIiQZneq5Y7wGC-UMWsKoXE1IejlZ1LpGQdWma9ut", "filenames": [ "ScriptResource.axd%3fd=kbtxWN87DQ1VIylVprHAWnyKaGLTA4pXlXTHlCuJIMsMYgKaYAHacVcYWnfHdzexemLANVUTb9RCqYHuFVYEeMMivsq9U8GpgkkDFsA3RU3W-vDHMWw2gDPk5jSrhT-rAV4PHKkL432QiTzOJMscy2b0-_w-jLBdS2fQZi5KQMX9r-i8Y6ucvvNoN81ML1rcIiQZneq5Y7wGC-UMWsKoXE1IejlZ1LpGQdWma9ut" ], "transfers": [ { "url": "http://www.ucdenver.edu/ScriptResource.axd?d=kbtxWN87DQ1VIylVprHAWnyKaGLTA4pXlXTHlCuJIMsMYgKaYAHacVcYWnfHdzexemLANVUTb9RCqYHuFVYEeMMivsq9U8GpgkkDFsA3RU3W-vDHMWw2gDPk5jSrhT-rAV4PHKkL432QiTzOJMscy2b0-_w-jLBdS2fQZi5KQMX9r-i8Y6ucvvNoN81ML1rcIiQZneq5Y7wGC-UMWsKoXE1IejlZ1LpGQdWma9ut0iUIFPwY0&t=3cb8783c", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 8235, "response_frame": 8488 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 395537, "artifact_id": "artifact-924319499894c4f242db0ca2", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 6988, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "38ec89bfbf0200334179eb7fbd3be789", "sha1": "7e7046e27f4293826af66ad614821318619bec1c", "type": "http-exported-object", "sha256": "b74056eea98bad621835b90b80499dad886c07ef70b5213bcde0408e63908c6f", "evidence": [ { "tcp_stream": 105, "frame_number": 6779, "display_filter": "frame.number == 6779", "timestamp_epoch": "1541624862.362097000" } ], "filename": "cui.js%3frev=OOyJv78CADNBeet%2FvTvniQ%3D%3D", "filenames": [ "cui.js%3frev=OOyJv78CADNBeet%2FvTvniQ%3D%3D" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/cui.js?rev=OOyJv78CADNBeet%2FvTvniQ%3D%3D", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6583, "response_frame": 6779 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 352107, "artifact_id": "artifact-32d505e404114a4a375f6b43", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 6393, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1266f984d5f545930d5e4f684bcdb2bc", "sha1": "1e685f7667344b7a062a0d0a78c427b5571f32cf", "type": "http-exported-object", "sha256": "5b107e17113a4c5a547d98a30bcd47aa3ad52317856828c762a67fda9f34baa0", "evidence": [ { "tcp_stream": 104, "frame_number": 6896, "display_filter": "frame.number == 6896", "timestamp_epoch": "1541624862.701500000" } ], "filename": "core.js%3frev=Emb5hNX1RZMNXk9oS82yvA%3D%3D", "filenames": [ "core.js%3frev=Emb5hNX1RZMNXk9oS82yvA%3D%3D" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/1033/core.js?rev=Emb5hNX1RZMNXk9oS82yvA%3D%3D", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6577, "response_frame": 6896 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 239740, "artifact_id": "artifact-7f65290f1b0c87032b7ab72b", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 239740, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 49984, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 239740, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "17e50427aeab6d7cd2be97fb9cdebdc1", "sha1": "f763b752439699f99c18b63ed9b41e86f87f7720", "type": "http-exported-object", "sha256": "cbf768030ad75e8aec0263d9d2286c2b0106cf7ac4daa17396129b172a93d1a9", "evidence": [ { "tcp_stream": 105, "frame_number": 6985, "display_filter": "frame.number == 6985", "timestamp_epoch": "1541624863.046602000" } ], "filename": "sp.ribbon.js%3frev=F%2BUEJ66rbXzSvpf7nN69wQ%3D%3D", "filenames": [ "sp.ribbon.js%3frev=F%2BUEJ66rbXzSvpf7nN69wQ%3D%3D" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/sp.ribbon.js?rev=F%2BUEJ66rbXzSvpf7nN69wQ%3D%3D", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6930, "response_frame": 6985 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 212665, "artifact_id": "artifact-bf20cc53ac8b9d5cc38b6c94", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 212665, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 19039, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 212665, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b1137641dbb512a60e83d673f7e2d98f", "sha1": "979143a6b10532413aefba462844d59df29fb2c1", "type": "http-exported-object", "sha256": "79ff1591234ea9434d7f96516781130625b1880ba4fa8eb965b278337e11f8ae", "evidence": [ { "tcp_stream": 106, "frame_number": 4932, "display_filter": "frame.number == 4932", "timestamp_epoch": "1541624859.772005000" } ], "filename": "angular.min.js", "filenames": [ "angular.min.js" ], "transfers": [ { "url": "http://www.ucdenver.edu/Javascript%20Library/angular.min.js", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4749, "response_frame": 4932 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 125496, "artifact_id": "artifact-a1f49e39f9d9d64ff55b55a5", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 125496, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 59828, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 125496, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c208b25b5190a834194c84da6b0bd8a0", "sha1": "922108175799fd47cc5fe1a2ca38be4f9e7087a8", "type": "http-exported-object", "sha256": "3c19c9d085f085252c974a1ae0637fa809cf09d3c461c64cbae6a011f7d0b78a", "evidence": [ { "tcp_stream": 106, "frame_number": 5045, "display_filter": "frame.number == 5045", "timestamp_epoch": "1541624859.891622000" } ], "filename": "init.js%3frev=wgiyW1GQqDQZTITaawvYoA%3D%3D", "filenames": [ "init.js%3frev=wgiyW1GQqDQZTITaawvYoA%3D%3D" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/1033/init.js?rev=wgiyW1GQqDQZTITaawvYoA%3D%3D", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4947, "response_frame": 5045 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 118049, "artifact_id": "artifact-a0ba3b87eeda048788fa5fb2", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 118049, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 1560, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 118049, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2eb6bcc2c4ba5640b3ff52ec7b4bc754", "sha1": "166c78fb3f2613db7638ddf89cacbd0680851004", "type": "http-exported-object", "sha256": "65f5df3cd45f3b8bf27731651a76b32bdef821fdb79451fa160ee55ff30467e2", "evidence": [ { "tcp_stream": 103, "frame_number": 4634, "display_filter": "frame.number == 4634", "timestamp_epoch": "1541624859.379202000" } ], "filename": "ucdwelcomepage.aspx", "filenames": [ "ucdwelcomepage.aspx" ], "transfers": [ { "url": "http://www.ucdenver.edu/pages/ucdwelcomepage.aspx", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4552, "response_frame": 4634 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 100612, "artifact_id": "artifact-942374974e9fd16f07b9d17f", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 100612, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 91238, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 100612, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "194f1c9a31ff997e04633db4b1915ea7", "sha1": "489529fbd74b8446b3dddfc9ae3cd0d3667f8247", "type": "http-exported-object", "sha256": "20f3807f724bf5bb6c8a2cf7f62bc8003717104ef480c7dfd1b8dab767144bbc", "evidence": [ { "tcp_stream": 107, "frame_number": 5137, "display_filter": "frame.number == 5137", "timestamp_epoch": "1541624860.005347000" } ], "filename": "ScriptResource.axd%3fd=nDIPXhUC97iGOuHV1bSa3g9PgqtW-xIy12fJV_T8vVy7js2xrAy8ccqwmnXPgF-xNQgkyT7tmsbDKVfT8ifdxCFRXJAu8n8jnliYraK21_he0x3K2sbtAORIu3mC-DFdoxOp3B5OGN3NzbzrPG28T1haK-w1&t=2e2045e2", "filenames": [ "ScriptResource.axd%3fd=nDIPXhUC97iGOuHV1bSa3g9PgqtW-xIy12fJV_T8vVy7js2xrAy8ccqwmnXPgF-xNQgkyT7tmsbDKVfT8ifdxCFRXJAu8n8jnliYraK21_he0x3K2sbtAORIu3mC-DFdoxOp3B5OGN3NzbzrPG28T1haK-w1&t=2e2045e2" ], "transfers": [ { "url": "http://www.ucdenver.edu/ScriptResource.axd?d=nDIPXhUC97iGOuHV1bSa3g9PgqtW-xIy12fJV_T8vVy7js2xrAy8ccqwmnXPgF-xNQgkyT7tmsbDKVfT8ifdxCFRXJAu8n8jnliYraK21_he0x3K2sbtAORIu3mC-DFdoxOp3B5OGN3NzbzrPG28T1haK-w1&t=2e2045e2", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 107, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4958, "response_frame": 5137 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 99507, "artifact_id": "artifact-1849005ea6b7a7ea22d69a38", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 99507, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 19484, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 99507, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2067df7197ee9e7763d36e3b9cec4a56", "sha1": "31b4432149e18697d245b9bf725f98266a9a2487", "type": "http-exported-object", "sha256": "185f2b901d68c7451a492d90ed38aa2c1de840061735a06836c2587f958ed31c", "evidence": [ { "tcp_stream": 108, "frame_number": 6796, "display_filter": "frame.number == 6796", "timestamp_epoch": "1541624862.387413000" } ], "filename": "sp.runtime.js%3frev=IGffcZfunndj0247nOxKVg%3D%3D", "filenames": [ "sp.runtime.js%3frev=IGffcZfunndj0247nOxKVg%3D%3D" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/sp.runtime.js?rev=IGffcZfunndj0247nOxKVg%3D%3D", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6742, "response_frame": 6796 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 68791, "artifact_id": "artifact-002005f8e082a6493581d4d8", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 68791, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 35580, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 68791, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "581e86cbc6b4dbb69e342abb92854252", "sha1": "e169cf57d95e184c7a2665bbdf50a60278fe4910", "type": "http-exported-object", "sha256": "b43e75f48fa68b71ee6e66751c0c3822314ca6dc592fce9309495baada78de54", "evidence": [ { "tcp_stream": 105, "frame_number": 6928, "display_filter": "frame.number == 6928", "timestamp_epoch": "1541624862.891822000" } ], "filename": "inplview.js%3frev=WB6Gy8a027aeNCq7koVCUg%3D%3D", "filenames": [ "inplview.js%3frev=WB6Gy8a027aeNCq7koVCUg%3D%3D" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/inplview.js?rev=WB6Gy8a027aeNCq7koVCUg%3D%3D", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6905, "response_frame": 6928 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 39575, "artifact_id": "artifact-6fd9779c7163416988e2d6e1", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 39575, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 3531, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 39575, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8f8b70b1e74c8d1175669cd683908cce", "sha1": "842c122b22a28e3e548b7abdf3136bdfc115535d", "type": "http-exported-object", "sha256": "0c6da6b5d4f5db2accb9c1847cd2686c683d0875750b069f14339c5f75c93029", "evidence": [ { "tcp_stream": 108, "frame_number": 5006, "display_filter": "frame.number == 5006", "timestamp_epoch": "1541624859.872855000" } ], "filename": "ScriptResource.axd%3fd=1QDyKS9h_RiM240HMbYjM6ODCJOKhzpWzUoeDZ16t3d487fp531Bj79wvRUTrpe40Sb2WC34BUqekTySkaN5JfKY-KmMcnh1StfQCVLNGKh9bApp04C1q9RX01pYhWwBp5cQe9b_UUDsH1MpnrV6Qpz6c1ILT-tGnGCdfhY6NJVDQZ2p0&t=2e2045e2", "filenames": [ "ScriptResource.axd%3fd=1QDyKS9h_RiM240HMbYjM6ODCJOKhzpWzUoeDZ16t3d487fp531Bj79wvRUTrpe40Sb2WC34BUqekTySkaN5JfKY-KmMcnh1StfQCVLNGKh9bApp04C1q9RX01pYhWwBp5cQe9b_UUDsH1MpnrV6Qpz6c1ILT-tGnGCdfhY6NJVDQZ2p0&t=2e2045e2" ], "transfers": [ { "url": "http://www.ucdenver.edu/ScriptResource.axd?d=1QDyKS9h_RiM240HMbYjM6ODCJOKhzpWzUoeDZ16t3d487fp531Bj79wvRUTrpe40Sb2WC34BUqekTySkaN5JfKY-KmMcnh1StfQCVLNGKh9bApp04C1q9RX01pYhWwBp5cQe9b_UUDsH1MpnrV6Qpz6c1ILT-tGnGCdfhY6NJVDQZ2p0&t=2e2045e2", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4975, "response_frame": 5006 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 32257, "artifact_id": "artifact-209a3b950a736c1a362d5e01", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 32257, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 24025, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 32257, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "3821071717e97ef12ee581c3ade0bd0b", "sha1": "39fc350d7882fa5ecbfaa2efbaa362bb79feb459", "type": "http-exported-object", "sha256": "8768d73b262d33c7dceaedcbf83576d31129c8bef0d03be58e92a57a65bd81c2", "evidence": [ { "tcp_stream": 107, "frame_number": 8264, "display_filter": "frame.number == 8264", "timestamp_epoch": "1541624893.330062000" } ], "filename": "kwizcom_listaggregator.js%3fv=12.1.12&source=kwizcomsharepointutilities", "filenames": [ "kwizcom_listaggregator.js%3fv=12.1.12&source=kwizcomsharepointutilities" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/kwizcom_aggregator/kwizcom_listaggregator.js?v=12.1.12&source=kwizcomsharepointutilities", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 107, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 8190, "response_frame": 8264 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 4286, "artifact_id": "artifact-78274029e3e24563c9ce90f4", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4286, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 2442, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 4286, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "578b5f38fa9421b75ccf3e389123fec8", "sha1": "b8b5065cde744e3ded6e3046f69d2c6c4a8f2051", "type": "http-exported-object", "sha256": "ea34443271cb87b667af587dc8b344c211458dc0616abdf48a49b14c4fde9b1a", "evidence": [ { "tcp_stream": 108, "frame_number": 8048, "display_filter": "frame.number == 8048", "timestamp_epoch": "1541624864.402572000" } ], "filename": "ProcessQuery(1)", "filenames": [ "ProcessQuery(1)" ], "transfers": [ { "url": "http://www.ucdenver.edu/academics/degrees/_vti_bin/client.svc/ProcessQuery", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6900, "response_frame": 8048 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1029395, "artifact_id": "artifact-0feb0c61bed8312ade60af81", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "fb8644c80f3dd8fdd3d39d38aa2d296b", "sha1": "cb31a3a636846eb98219eae2b139681b36f685de", "type": "http-exported-object", "sha256": "009d4cdb69f30688198c7a19b25ef0667c5f7b172d65b2273ed2274bc8eb5425", "evidence": [ { "tcp_stream": 108, "frame_number": 6884, "display_filter": "frame.number == 6884", "timestamp_epoch": "1541624862.621094000" } ], "filename": "sp.js%3frev=%2B4ZEyA892P3T0504qi0paw%3D%3D", "filenames": [ "sp.js%3frev=%2B4ZEyA892P3T0504qi0paw%3D%3D" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/sp.js?rev=%2B4ZEyA892P3T0504qi0paw%3D%3D", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6798, "response_frame": 6884 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 390757, "artifact_id": "artifact-2206844bb988d34629ea8b0c", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "685f18142f2c3ebeea24931e52f65611", "sha1": "af8a56df21aea636ec85909e897f667da0adc1d6", "type": "http-exported-object", "sha256": "e2f4ebe008e4e29b0695a4cf033f5bc45d5ab70ca43bf0873580a7c4fd500b96", "evidence": [ { "tcp_stream": 104, "frame_number": 8558, "display_filter": "frame.number == 8558", "timestamp_epoch": "1541624893.743490000" } ], "filename": "jquery.js%3fv=13.4.81&source=kwizcomsharepointutilities", "filenames": [ "jquery.js%3fv=13.4.81&source=kwizcomsharepointutilities" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/kwizcom.sharepoint.foundation/jquery.js?v=13.4.81&source=kwizcomsharepointutilities", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 8188, "response_frame": 8558 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 367729, "artifact_id": "artifact-c0538faf42b83ebca4c8aee0", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "3b5dbf2790a764887324092e720da8db", "sha1": "a23b33289aa3fb5d524099dd6418953e6d9981f2", "type": "http-exported-object", "sha256": "c4e63117b5fac36c75799cae97f4f0464bd9d6978b442fe6cf28078d0be7ac31", "evidence": [ { "tcp_stream": 108, "frame_number": 8457, "display_filter": "frame.number == 8457", "timestamp_epoch": "1541624893.515979000" } ], "filename": "default.aspx", "filenames": [ "default.aspx" ], "transfers": [ { "url": "http://www.ucdenver.edu/programs/undergraduate/Pages/default.aspx", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 8111, "response_frame": 8457 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 280766, "artifact_id": "artifact-2ede682620f3e635803d6883", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cbf1955b2515491ea790263c051ee833", "sha1": "5b8ea12d5a17179398a73c4fee9c4c39c85e590a", "type": "http-exported-object", "sha256": "6f7307aed5e6e60222ef7d66e258362e1df71eabd5f7af0f33afa0fc6b8f65dd", "evidence": [ { "tcp_stream": 56, "frame_number": 2224, "display_filter": "frame.number == 2224", "timestamp_epoch": "1541623729.751578000" } ], "filename": "6Kwy7mw.avi", "filenames": [ "6Kwy7mw.avi" ], "transfers": [ { "url": "http://dhsiwyqdlskwsqo.com/images/oHxu3OjFB6DuXsB336/xwuexjnHY/P5VoU9fs1NStyMFZ_2FZ/6s8umkBGsQOSsZgZiqQ/Jnp65UJ_2B9Qq9qo_2BCxl/LpqyFXF9TVVz_/2BLffdp3/TW_2B64CmxBQ7r03un00c1o/B2mvu2ig9G/7GcZJn_2FNTO8/6Kwy7mw.avi", "client_ip": "10.22.15.119", "server_ip": "192.162.244.171", "tcp_stream": 56, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1955, "response_frame": 2224 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "video/x-msvideo", "size_bytes": 271796, "artifact_id": "artifact-e6bc5be71697c348e44423da", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d935d506ae9c8dd9e0f96706fbb91f65", "sha1": "7f650ee30c6a4d3eea04032039b20ff72997559b", "type": "http-exported-object", "sha256": "c4d8dbe77feb63e5a61bee0bead4e5f66e8fa6a927599bd1b74aced52467273c", "evidence": [ { "tcp_stream": 105, "frame_number": 5074, "display_filter": "frame.number == 5074", "timestamp_epoch": "1541624859.896150000" } ], "filename": "jquery-ui.min.js", "filenames": [ "jquery-ui.min.js" ], "transfers": [ { "url": "http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.js", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4676, "response_frame": 5074 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 240427, "artifact_id": "artifact-adde97474c1f02d9d8a1058c", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 240427, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 240427, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "bbcb25743f038ae385e6784df64a92dd", "sha1": "e89e806ed86afd326360d344393e49b8f2d6a292", "type": "http-exported-object", "sha256": "bd9ea8a38face9cb05cb209900b16b09b3bda1c247ddd7d2e2c95a82a3615cd3", "evidence": [ { "tcp_stream": 53, "frame_number": 1936, "display_filter": "frame.number == 1936", "timestamp_epoch": "1541623727.126684000" } ], "filename": "QGJ.avi", "filenames": [ "QGJ.avi" ], "transfers": [ { "url": "http://dhsiwyqdlskwsqo.com/images/Owsg6NXtcG4F/aQTGTFRGYCk/mwdnmTGg8q5u_2/B23I8WXH1qhcd_2BC7kNQ/SplwlVD2F3jUMRCB/dTSK84tk3PapDt7/wErikpmrkQw2_2Bhba/FTtz6Avew/ty3DREXbyq083JlIg3zM/TEYrA_2BNXjAICO93pa/QGJ.avi", "client_ip": "10.22.15.119", "server_ip": "192.162.244.171", "tcp_stream": 53, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1734, "response_frame": 1936 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "video/x-msvideo", "size_bytes": 213772, "artifact_id": "artifact-3ded3c964efe67396c9c11df", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 213772, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 213772, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "941e520a7bfa69987b3a5dd2e4467c75", "sha1": "4ec960b513f24005f682caea8cd860a2d010e284", "type": "http-exported-object", "sha256": "158494850d445b90585ee2d25e2969b3218808ccb0897c79ca240f7c3556d92b", "evidence": [ { "tcp_stream": 106, "frame_number": 4746, "display_filter": "frame.number == 4746", "timestamp_epoch": "1541624859.561103000" } ], "filename": "corev4Anonymous.css", "filenames": [ "corev4Anonymous.css" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/corev4Anonymous.css", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4577, "response_frame": 4746 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 191641, "artifact_id": "artifact-beb170b4ced00c2f6648c68c", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 191641, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 191641, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e182f3e055d8ece50cffe7949b99def3", "sha1": "f440922d300ca0cc6920f610cbdec7945868fd73", "type": "http-exported-object", "sha256": "5fedc714f715123098edf3d8ceffcc6f6c1d503513e3dee6077c0fb3a6fcdbec", "evidence": [ { "tcp_stream": 107, "frame_number": 5986, "display_filter": "frame.number == 5986", "timestamp_epoch": "1541624860.826062000" } ], "filename": "ResearchRoundupHero.jpg", "filenames": [ "ResearchRoundupHero.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/16HeroImage/images/ResearchRoundupHero.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 107, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5333, "response_frame": 5986 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 160555, "artifact_id": "artifact-11875993d36a7d2ce9407980", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 160555, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 160555, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c551699eb0b74235d61fdf3b0b894cea", "sha1": "06c7a45073c727f6cce113501a8c5c4a09a03bb1", "type": "http-exported-object", "sha256": "9c16b72304e8dbf5ddce0e0614934eac07d641ef12c654398eda8df088f3c296", "evidence": [ { "tcp_stream": 105, "frame_number": 8990, "display_filter": "frame.number == 8990", "timestamp_epoch": "1541624894.483208000" } ], "filename": "cta2.jpg", "filenames": [ "cta2.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/cta-triple-buttons/cta2.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8645, "response_frame": 8990 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 136688, "artifact_id": "artifact-ff7c2c84c807dd3e4706b43e", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 136688, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 136688, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2178dd0b8e1e170216ca88fa2b392d6a", "sha1": "a24362d14498169bba661a640e205e24c18b652a", "type": "http-exported-object", "sha256": "ff8619dad2bbbf61330224649844a7ff7665785c3f174913729961d77ba5facc", "evidence": [ { "tcp_stream": 103, "frame_number": 5156, "display_filter": "frame.number == 5156", "timestamp_epoch": "1541624860.111568000" } ], "filename": "degree-search-ng.js", "filenames": [ "degree-search-ng.js" ], "transfers": [ { "url": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-search-ng.js", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 5129, "response_frame": 5156 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 134598, "artifact_id": "artifact-1523124b73bd9f9aed192cb1", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 134598, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 134598, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "511141c05e0007a91f2d5c607a3dab40", "sha1": "b9732a1ac524e256d1b47cd143f569a6974b6bf4", "type": "http-exported-object", "sha256": "833aae2efa9e7eb97334c8596c07bd22c09ffa2e771dc64fadcfa66d2ed2330e", "evidence": [ { "tcp_stream": 103, "frame_number": 8924, "display_filter": "frame.number == 8924", "timestamp_epoch": "1541624894.392289000" } ], "filename": "48_hero.jpg", "filenames": [ "48_hero.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/Hero/48_hero.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8621, "response_frame": 8924 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 118604, "artifact_id": "artifact-dc5676629e0590a0e90df020", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 118604, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 118604, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "eedf9ee80c2faa4e1b9ab9017cdfcb88", "sha1": "ed29315e0ffb3f14382431f2724235bf67f44eb3", "type": "http-exported-object", "sha256": "f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5", "evidence": [ { "tcp_stream": 108, "frame_number": 4756, "display_filter": "frame.number == 4756", "timestamp_epoch": "1541624859.566371000" } ], "filename": "bootstrap.min.css", "filenames": [ "bootstrap.min.css" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap.min.css", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4581, "response_frame": 4756 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 117305, "artifact_id": "artifact-d97f69311c233d1f0c26b85f", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 117305, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 117305, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b569e44adb642079d0290bff71aa4dfc", "sha1": "340eeb822811b2d3a55fe85ce1754f1c36885925", "type": "http-exported-object", "sha256": "d78b0583ff00e0b8e6caac5c236fdf795fd447208cfea7f23abd528a26a57674", "evidence": [ { "tcp_stream": 104, "frame_number": 6396, "display_filter": "frame.number == 6396", "timestamp_epoch": "1541624861.119966000" } ], "filename": "factBack3.jpg", "filenames": [ "factBack3.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/06InfoGraphic/image/factBack3.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6005, "response_frame": 6396 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 111343, "artifact_id": "artifact-a2cc60c82dd60b43d9929b8b", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 111343, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 111343, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f8b24fe0f24cbf5407d78ce2a2319bb6", "sha1": "b98bb1668188a8b195b024656f7d3519b82eece0", "type": "http-exported-object", "sha256": "e1f409fdaac72c188fa638ac4be1958322f1dfe8b2b7b076c4ff95f026f47a4f", "evidence": [ { "tcp_stream": 103, "frame_number": 5193, "display_filter": "frame.number == 5193", "timestamp_epoch": "1541624860.247618000" } ], "filename": "DDCthemeMain.css", "filenames": [ "DDCthemeMain.css" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/DDCthemes/DDCthemeMain.css", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 5158, "response_frame": 5193 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 103489, "artifact_id": "artifact-36d59ea32cfa81c61ea8e94d", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 103489, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 103489, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "895323ed2f7258af4fae2c738c8aea49", "sha1": "276c87ff3e1e3155679c318938e74e5c1b76d809", "type": "http-exported-object", "sha256": "ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8", "evidence": [ { "tcp_stream": 107, "frame_number": 4951, "display_filter": "frame.number == 4951", "timestamp_epoch": "1541624859.774463000" } ], "filename": "jquery-1.11.3.min.js", "filenames": [ "jquery-1.11.3.min.js" ], "transfers": [ { "url": "http://www.ucdenver.edu/Javascript%20Library/jquery-1.11.3.min.js", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 107, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4668, "response_frame": 4951 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 95957, "artifact_id": "artifact-00a31f87a9743a8cb43bee4f", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 95957, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 95957, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "17101650557ebf72d18d9673bc66bd1b", "sha1": "7f59cc9ecbbabd8138f83316b10233a5303f6d89", "type": "http-exported-object", "sha256": "05d5af0ab07517396f53c3e161f0ebc23c09242eae0c2372d7da26dd5786953e", "evidence": [ { "tcp_stream": 104, "frame_number": 4793, "display_filter": "frame.number == 4793", "timestamp_epoch": "1541624859.629177000" }, { "tcp_stream": 105, "frame_number": 8214, "display_filter": "frame.number == 8214", "timestamp_epoch": "1541624893.190877000" } ], "filename": "BetaUCDenverTheme.css", "filenames": [ "BetaUCDenverTheme.css", "UCDenverTheme.css" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/UCDenverTheme.css", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4615, "response_frame": 4793 }, { "url": "http://www.ucdenver.edu/Style%20Library/DDCthemes/BetaUCDenverTheme.css", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 8152, "response_frame": 8214 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 87318, "artifact_id": "artifact-3560c3054bb785a27517676a", "occurrences": 2, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 87318, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 87318, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "167ad817553a45fc00b25ebbbabc74a0", "sha1": "c6cf7eb6d1e431a07d54ed57af5abc67b99fa9d8", "type": "http-exported-object", "sha256": "36d8e52a141bc54658ed41dde1654343bbd008af29f889f6e0a2f41441457ba6", "evidence": [ { "tcp_stream": 108, "frame_number": 5882, "display_filter": "frame.number == 5882", "timestamp_epoch": "1541624860.748749000" } ], "filename": "StCajetans-ig.jpg", "filenames": [ "StCajetans-ig.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/StCajetans-ig.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5495, "response_frame": 5882 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 76601, "artifact_id": "artifact-f1aaed09231939c8312afa34", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 76601, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 76601, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2a81d3eb8b0f17453068a572284ba4d7", "sha1": "76aaa3f1af267083d287fa877868b59ef0411c22", "type": "http-exported-object", "sha256": "d7db23ac49a03eb060bc6a928b5a9044218bed6c7add87406b8867f95938aef5", "evidence": [ { "tcp_stream": 103, "frame_number": 6326, "display_filter": "frame.number == 6326", "timestamp_epoch": "1541624861.085307000" } ], "filename": "cta_visit.jpg", "filenames": [ "cta_visit.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5998, "response_frame": 6326 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 75852, "artifact_id": "artifact-8a89f138cc1848f271af5a01", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 75852, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 75852, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "3aa6eeb31d2c07b2128d8cc2b6a9a075", "sha1": "5bfa0670eb1daeec221d6634b26de09c807d62f5", "type": "http-exported-object", "sha256": "b729bb6d682bc3df8fb04c7a940b3da0140284811d168a92929cfec7232237be", "evidence": [ { "tcp_stream": 106, "frame_number": 5836, "display_filter": "frame.number == 5836", "timestamp_epoch": "1541624860.731343000" } ], "filename": "whitepines.jpg", "filenames": [ "whitepines.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/whitepines.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5471, "response_frame": 5836 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 67070, "artifact_id": "artifact-fb54240855e69fd0c3d52e27", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 67070, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 67070, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "97493d3f11c0a3bd5cbd959f5d19b699", "sha1": "1075231650f579955905bb2f6527148a8e2b4b16", "type": "http-exported-object", "sha256": "aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c", "evidence": [ { "tcp_stream": 103, "frame_number": 5545, "display_filter": "frame.number == 5545", "timestamp_epoch": "1541624860.596966000" } ], "filename": "fontawesome-webfont.woff2%3fv=4.3.0", "filenames": [ "fontawesome-webfont.woff2%3fv=4.3.0" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/fonts/fontawesome-fontfacekit/fontawesome-webfont.woff2?v=4.3.0", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5262, "response_frame": 5545 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 56780, "artifact_id": "artifact-c8b4e618925efb2b0e519c92", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 56780, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 56780, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "54e559cef8146fe9aa8b5ba30ca4f6aa", "sha1": "8c53968f786b3d343d375c4b77aeab85ee464a02", "type": "http-exported-object", "sha256": "9c086d962c942cff645dbd48b700191e96e3371b3d006e4eb3c7ac3c842057c9", "evidence": [ { "tcp_stream": 58, "frame_number": 2325, "display_filter": "frame.number == 2325", "timestamp_epoch": "1541623798.652766000" } ], "filename": "authrootstl.cab", "filenames": [ "authrootstl.cab" ], "transfers": [ { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "client_ip": "10.22.15.119", "server_ip": "72.246.64.147", "tcp_stream": 58, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 2270, "response_frame": 2325 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 55583, "artifact_id": "artifact-798004bee94df829a6a71c44", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 55583, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 55583, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "fac48a4f4e9cd3a292e2f885897a423f", "sha1": "42c07a3a0d13f7d3e56fb39de1c2daac833d7f53", "type": "http-exported-object", "sha256": "2976d80beac91eed779d1f204cb2e1be813c53bb2e1dfe03334f2c30b4f995be", "evidence": [ { "tcp_stream": 104, "frame_number": 5824, "display_filter": "frame.number == 5824", "timestamp_epoch": "1541624860.729673000" } ], "filename": "ThreeGuys.jpg", "filenames": [ "ThreeGuys.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/ThreeGuys.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5385, "response_frame": 5824 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 55028, "artifact_id": "artifact-20d3656013f806e5d35cd2fd", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 55028, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 55028, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "38f5de1aab7cfae54d81aecdc074979a", "sha1": "a5f0dcf5d2cb6cf053f5f6462aa8021955f405e2", "type": "http-exported-object", "sha256": "8b6eb285d3afcd5e4d485846c70b442f4b6df4a636533493a6b45ff4808c8364", "evidence": [ { "tcp_stream": 105, "frame_number": 8286, "display_filter": "frame.number == 8286", "timestamp_epoch": "1541624893.372436000" } ], "filename": "ScriptResource.axd%3fd=9di2kcBnRer6u7CuZUM7AfDDbzWMOK7upyNjbmE5Pdu3o5BHVtGXRC91MpdMm5XnQKxQdUdYrD0lcXagGlKdOSu2-gvQh1sQkr9VBx5eiph2ui3XCKHywHXzD91UpgfJQscXyag6PMfkkSUAwV5oTxM-pRGaKbplVIquRmAvCsECm7UwxgbHqr5oRifTbuwyorCrDIb3SKMarpQyLWAcwc1HYq01&t=3cb8783c", "filenames": [ "ScriptResource.axd%3fd=9di2kcBnRer6u7CuZUM7AfDDbzWMOK7upyNjbmE5Pdu3o5BHVtGXRC91MpdMm5XnQKxQdUdYrD0lcXagGlKdOSu2-gvQh1sQkr9VBx5eiph2ui3XCKHywHXzD91UpgfJQscXyag6PMfkkSUAwV5oTxM-pRGaKbplVIquRmAvCsECm7UwxgbHqr5oRifTbuwyorCrDIb3SKMarpQyLWAcwc1HYq01&t=3cb8783c" ], "transfers": [ { "url": "http://www.ucdenver.edu/ScriptResource.axd?d=9di2kcBnRer6u7CuZUM7AfDDbzWMOK7upyNjbmE5Pdu3o5BHVtGXRC91MpdMm5XnQKxQdUdYrD0lcXagGlKdOSu2-gvQh1sQkr9VBx5eiph2ui3XCKHywHXzD91UpgfJQscXyag6PMfkkSUAwV5oTxM-pRGaKbplVIquRmAvCsECm7UwxgbHqr5oRifTbuwyorCrDIb3SKMarpQyLWAcwc1HYq01&t=3cb8783c", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 8216, "response_frame": 8286 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 52214, "artifact_id": "artifact-989dcdbb1ad713c651297c16", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 52214, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 52214, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e9372f0ebbcf71f851e3d321ef2a8e5a", "sha1": "2c7d19d1af7d97085c977d1b69dcb8b84483d87c", "type": "http-exported-object", "sha256": "1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f", "evidence": [ { "tcp_stream": 109, "frame_number": 5363, "display_filter": "frame.number == 5363", "timestamp_epoch": "1541624860.473093000" } ], "filename": "ga.js", "filenames": [ "ga.js" ], "transfers": [ { "url": "http://www.google-analytics.com/ga.js", "client_ip": "10.22.15.119", "server_ip": "216.58.192.46", "tcp_stream": 109, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 5284, "response_frame": 5363 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 46274, "artifact_id": "artifact-769b87fe121bf9294c671af4", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 46274, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 46274, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5c43a2dd877fdf08938c39ebb562c062", "sha1": "0d97bcaf7e07f06220bfeeb4e290f0701490287e", "type": "http-exported-object", "sha256": "7796b5c1eb8d9c8a896b17db41ae969690f2924a8690439ac4d5511935b236c3", "evidence": [ { "tcp_stream": 106, "frame_number": 6115, "display_filter": "frame.number == 6115", "timestamp_epoch": "1541624860.973636000" } ], "filename": "cta_requestInfo.jpg", "filenames": [ "cta_requestInfo.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_requestInfo.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6000, "response_frame": 6115 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 45067, "artifact_id": "artifact-9e5fb5f49fbda7e6e0f458ef", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 45067, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 45067, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e181fc183f2ea004fcfb3854a1a25677", "sha1": "f51fcbbd82b907bc1a75ca76f34b650c0f5e6510", "type": "http-exported-object", "sha256": "71ea89144415bcb2ea2585d7a5ca95b27ab2a10d7f826647bee8c9e78922c5a5", "evidence": [ { "tcp_stream": 107, "frame_number": 6286, "display_filter": "frame.number == 6286", "timestamp_epoch": "1541624861.016108000" } ], "filename": "cta_apply.jpg", "filenames": [ "cta_apply.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 107, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5996, "response_frame": 6286 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 42810, "artifact_id": "artifact-6db183f5a147eb73750fa5a3", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 42810, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 42810, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "bed523eb224f90a742576122ea869933", "sha1": "11080f312075fdfe71d0171c8f4fcff5c28f3002", "type": "http-exported-object", "sha256": "9145ac411c9596c70f7a57d91ddf00f4888aae4d852209ed6efdf99afad1f904", "evidence": [ { "tcp_stream": 107, "frame_number": 4666, "display_filter": "frame.number == 4666", "timestamp_epoch": "1541624859.438210000" } ], "filename": "responsiveBase.css", "filenames": [ "responsiveBase.css" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/responsive/responsiveBase.css", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 107, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4593, "response_frame": 4666 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 42618, "artifact_id": "artifact-fe82b9787c8a3ca52791ff48", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 42618, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 42618, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a4d69ca888d5bf713ae1cc32438d3846", "sha1": "4a34a11c619191b9429c463b10599259856a9380", "type": "http-exported-object", "sha256": "80bad0ee862dd92912bbecb161c17ce3d072b22aef1d48c3ab4c90f55939acae", "evidence": [ { "tcp_stream": 108, "frame_number": 8848, "display_filter": "frame.number == 8848", "timestamp_epoch": "1541624894.307603000" } ], "filename": "cta_catalog.jpg", "filenames": [ "cta_catalog.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8673, "response_frame": 8848 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 36669, "artifact_id": "artifact-96f5f3a39d6616c986fd31ad", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 36669, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 36669, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8c237312864d2e4c4f03544cd4f9b195", "sha1": "253711c6d825de55a8360552573be950da180614", "type": "http-exported-object", "sha256": "d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8", "evidence": [ { "tcp_stream": 103, "frame_number": 4786, "display_filter": "frame.number == 4786", "timestamp_epoch": "1541624859.615717000" } ], "filename": "bootstrap.min.js", "filenames": [ "bootstrap.min.js" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/bootstrap334/js/bootstrap.min.js", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4710, "response_frame": 4786 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 35951, "artifact_id": "artifact-937edfef42264802459c571c", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 35951, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 35951, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "4e9726a35fd2bba474c9ec07a300e5e6", "sha1": "bf01508864677f84ac2d0b2a3798e64c3200c7b6", "type": "http-exported-object", "sha256": "517319eb8ff3d0b11dc60d148babdc714087e386977101e1d76428cdbff6b9c7", "evidence": [ { "tcp_stream": 108, "frame_number": 6740, "display_filter": "frame.number == 6740", "timestamp_epoch": "1541624862.281126000" } ], "filename": "sp.ui.dialog.js%3frev=Tpcmo1%2FSu6R0yewHowDl5g%3D%3D", "filenames": [ "sp.ui.dialog.js%3frev=Tpcmo1%2FSu6R0yewHowDl5g%3D%3D" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/sp.ui.dialog.js?rev=Tpcmo1%2FSu6R0yewHowDl5g%3D%3D", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6601, "response_frame": 6740 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 34270, "artifact_id": "artifact-d0a53c13084a5bd803c22d1e", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 34270, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 34270, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "26812a28850395f8f865be4893fb20c7", "sha1": "69731223ffe4f669444e96f24c54811015e6a776", "type": "http-exported-object", "sha256": "550ceb9559bb4237527909ff21e719804f6b9df337f741f756821c0c9963392b", "evidence": [ { "tcp_stream": 105, "frame_number": 4674, "display_filter": "frame.number == 4674", "timestamp_epoch": "1541624859.446677000" } ], "filename": "jquery-ui.min.css", "filenames": [ "jquery-ui.min.css" ], "transfers": [ { "url": "http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.css", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4589, "response_frame": 4674 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 30163, "artifact_id": "artifact-73ba7d628c2595e7c25d540a", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 30163, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 30163, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "90bad03bf38180eae7bcb12ad3f1c38f", "sha1": "a4b053d1a463168dc9977c8868a274f9b67d2887", "type": "http-exported-object", "sha256": "02717a94a92b22f6715c10f1483a4b252f61bd705675ae250af5411ff01de437", "evidence": [ { "tcp_stream": 105, "frame_number": 5626, "display_filter": "frame.number == 5626", "timestamp_epoch": "1541624860.625043000" } ], "filename": "balancedbudget.jpg", "filenames": [ "balancedbudget.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/balancedbudget.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5412, "response_frame": 5626 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 30137, "artifact_id": "artifact-257744468d2da571ea85240c", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 30137, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 30137, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0ca32fe2b6de1f7955f35e19b5acd9d4", "sha1": "8ca82252af57d189dd7671707bb0d9c7260acebc", "type": "http-exported-object", "sha256": "10570ac15a02224c4743309c48c8b8eefeaa931d9f1db7238edd7b3fa6cd2ff7", "evidence": [ { "tcp_stream": 104, "frame_number": 4897, "display_filter": "frame.number == 4897", "timestamp_epoch": "1541624859.745550000" } ], "filename": "jsBaseResponsive.js", "filenames": [ "jsBaseResponsive.js" ], "transfers": [ { "url": "http://www.ucdenver.edu/Javascript%20Library/responsive/jsBaseResponsive.js", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4794, "response_frame": 4897 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 24410, "artifact_id": "artifact-025b619a9e6b00203a84e174", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 24410, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 24410, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "28100116629515464ac5caa36fadb59a", "sha1": "8e70fdb2aa589220c406c24dc61607fc67bbe68e", "type": "http-exported-object", "sha256": "b24190e46072d124308b908776b21a50d4cefa396934bf5fb788bf26c2e67c33", "evidence": [ { "tcp_stream": 107, "frame_number": 5326, "display_filter": "frame.number == 5326", "timestamp_epoch": "1541624860.457981000" } ], "filename": "sourcesanspro-regular-webfont.woff2", "filenames": [ "sourcesanspro-regular-webfont.woff2" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-regular-webfont.woff2", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 107, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5210, "response_frame": 5326 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 23752, "artifact_id": "artifact-0bbd6efc721aaf2acb9e55fc", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23752, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 23752, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "574022706b4fdbe3be99831b512965ef", "sha1": "16a5d07663800b7908fcc91f31078b8670c77d24", "type": "http-exported-object", "sha256": "ac508fa266db568a28c4e52d7dd1fcc85dbfdc38f97e39892e60f94d904e11d5", "evidence": [ { "tcp_stream": 105, "frame_number": 5397, "display_filter": "frame.number == 5397", "timestamp_epoch": "1541624860.489496000" } ], "filename": "sourcesanspro-light-webfont.woff2", "filenames": [ "sourcesanspro-light-webfont.woff2" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-light-webfont.woff2", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5272, "response_frame": 5397 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 23668, "artifact_id": "artifact-5914d37b9e2afda6c36edc6a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23668, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 23668, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "7d3b66076a35890b4066b4ca0350afaa", "sha1": "5b2836784a6506bf667bf96475d0b4cd1c933d90", "type": "http-exported-object", "sha256": "3cd1a2527c206665892f1e9837f4e7cff960d7e5fa9df017c7b49e84845c0097", "evidence": [ { "tcp_stream": 108, "frame_number": 5353, "display_filter": "frame.number == 5353", "timestamp_epoch": "1541624860.466467000" } ], "filename": "sourcesanspro-bold-webfont.woff2", "filenames": [ "sourcesanspro-bold-webfont.woff2" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-bold-webfont.woff2", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5247, "response_frame": 5353 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 23508, "artifact_id": "artifact-352d44cf2f1a5621ed72ce58", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23508, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 23508, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "788cf11a27c39502bbcfbb7baaa04189", "sha1": "595690ffdc79ccba093782cec93a3192659231fd", "type": "http-exported-object", "sha256": "190a90d96675f28bb6ab1bab072f3b61ec321af3a8c3843a70248d9bb71bcdfe", "evidence": [ { "tcp_stream": 108, "frame_number": 4869, "display_filter": "frame.number == 4869", "timestamp_epoch": "1541624859.683638000" } ], "filename": "angular-animate.min.js", "filenames": [ "angular-animate.min.js" ], "transfers": [ { "url": "http://www.ucdenver.edu/Javascript%20Library/angular-animate.min.js", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4768, "response_frame": 4869 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 23337, "artifact_id": "artifact-9a5cd20330db57d2b5096183", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23337, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 23337, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "eac91542a05209478107c4a3725ce29c", "sha1": "2987e7c40ce780293b3cdd39c4ad491f471bccee", "type": "http-exported-object", "sha256": "0ba2f6756001669bdf934f9d79e8fd1ccf2028130c33a0510279581ec9dfd73a", "evidence": [ { "tcp_stream": 103, "frame_number": 4992, "display_filter": "frame.number == 4992", "timestamp_epoch": "1541624859.849039000" } ], "filename": "WebResource.axd%3fd=Rr8OZckqtIG1LFJTmW4ygCZ8tMHeGI9-qww7ZH6tsHUf-5ACqmhwY6jnlnidSHBrgMkq7on6x9smildQ9krSVOW4yk41&t=636271455501517547", "filenames": [ "WebResource.axd%3fd=Rr8OZckqtIG1LFJTmW4ygCZ8tMHeGI9-qww7ZH6tsHUf-5ACqmhwY6jnlnidSHBrgMkq7on6x9smildQ9krSVOW4yk41&t=636271455501517547" ], "transfers": [ { "url": "http://www.ucdenver.edu/WebResource.axd?d=Rr8OZckqtIG1LFJTmW4ygCZ8tMHeGI9-qww7ZH6tsHUf-5ACqmhwY6jnlnidSHBrgMkq7on6x9smildQ9krSVOW4yk41&t=636271455501517547", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4888, "response_frame": 4992 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 20794, "artifact_id": "artifact-3cc44c07beda5501cf285e69", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 20794, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 20794, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a621eac32d4fa685b60de7c01c648dc8", "sha1": "599d252cbb0ff0d16eafc0ce09526bf322f260e7", "type": "http-exported-object", "sha256": "4004293f081201ead3df6f86daa9d3974bde048ae8187cda602dffb256324124", "evidence": [ { "tcp_stream": 104, "frame_number": 5120, "display_filter": "frame.number == 5120", "timestamp_epoch": "1541624859.963866000" } ], "filename": "fgimg.png", "filenames": [ "fgimg.png" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/images/fgimg.png", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 4994, "response_frame": 5120 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 20115, "artifact_id": "artifact-fda710dfbf03ef71b65c5982", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 20115, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 20115, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "89b29714ad4aaaa3953ef3b51cf9c43a", "sha1": "fc6b4268fbd57ad95d2b41a1d4d6866f222fbdb2", "type": "http-exported-object", "sha256": "2453e31f9c5e0dbee528d11f97a85edf897ed93406954ce8e475f0244abf249a", "evidence": [ { "tcp_stream": 104, "frame_number": 4614, "display_filter": "frame.number == 4614", "timestamp_epoch": "1541624859.312516000" } ], "filename": "bootstrap-theme.min.css", "filenames": [ "bootstrap-theme.min.css" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap-theme.min.css", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4585, "response_frame": 4614 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 19963, "artifact_id": "artifact-843a1ddd57c9775d5df65156", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19963, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 19963, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "73c4b7583e32cb9722a428f418318f01", "sha1": "4f89047e6fbf66831401156b3c3e6657e43d06ce", "type": "http-exported-object", "sha256": "198f44920d0d51bc49281f580acc760fd88a96e2422c8784114df6dab93ecc09", "evidence": [ { "tcp_stream": 105, "frame_number": 8643, "display_filter": "frame.number == 8643", "timestamp_epoch": "1541624894.144652000" } ], "filename": "48_testimonial_klimper.jpg", "filenames": [ "48_testimonial_klimper.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/Testimonial/48_testimonial_klimper.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8579, "response_frame": 8643 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 19117, "artifact_id": "artifact-43f74d9d5a2aa489b6a64f92", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19117, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 19117, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "75bf8407996a0507b808690d4165f83a", "sha1": "c7234015bf72349e7af55cf5c20a868aadc2dbf5", "type": "http-exported-object", "sha256": "4935fdc24e4a4873c078817732e45651c05091b946eff4fb774476a31d52e769", "evidence": [ { "tcp_stream": 103, "frame_number": 4886, "display_filter": "frame.number == 4886", "timestamp_epoch": "1541624859.738226000" } ], "filename": "jquery.jcarousel.min.js", "filenames": [ "jquery.jcarousel.min.js" ], "transfers": [ { "url": "http://www.ucdenver.edu/Javascript%20Library/jquery.jcarousel.min.js", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4788, "response_frame": 4886 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 18123, "artifact_id": "artifact-c6f4298ab196ca50936cb38e", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 18123, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 18123, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "448c34a56d699c29117adc64c43affeb", "sha1": "ca35b697d99cae4d1b60f2d60fcd37771987eb07", "type": "http-exported-object", "sha256": "fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c", "evidence": [ { "tcp_stream": 108, "frame_number": 8079, "display_filter": "frame.number == 8079", "timestamp_epoch": "1541624866.268090000" } ], "filename": "glyphicons-halflings-regular.woff2", "filenames": [ "glyphicons-halflings-regular.woff2" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/bootstrap334/fonts/glyphicons-halflings-regular.woff2", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8059, "response_frame": 8079 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 18028, "artifact_id": "artifact-8e4fd5691f0125b08151c00e", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 18028, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 18028, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9ab36723052e138649a588f59370eadd", "sha1": "d2d6ef4a3570420e47ff85916f108b6c8e9e2b92", "type": "http-exported-object", "sha256": "398cea3dc83051c117a65a9897bd17c84dace5d700ecd01943d1e47af57b5490", "evidence": [ { "tcp_stream": 106, "frame_number": 8607, "display_filter": "frame.number == 8607", "timestamp_epoch": "1541624894.125401000" } ], "filename": "48_testimonial_kliese.jpg", "filenames": [ "48_testimonial_kliese.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/Testimonial/48_testimonial_kliese.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8581, "response_frame": 8607 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 16805, "artifact_id": "artifact-797bfa5c5760f49d21185418", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 16805, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 16805, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "43abdf0fd04d2fef4fbf082b54471cfc", "sha1": "48dd0059a18f737669bc17f482dabab954ff172f", "type": "http-exported-object", "sha256": "7e0baff43a753a2dce0e85dbbd562a503c9f558f846784f3626c0b5d31c9d6d3", "evidence": [ { "tcp_stream": 104, "frame_number": 6912, "display_filter": "frame.number == 6912", "timestamp_epoch": "1541624862.871996000" } ], "filename": "mediaplayer.js%3frev=Q6vfD9BNL%2B9PvwgrVEcc%2FA%3D%3D", "filenames": [ "mediaplayer.js%3frev=Q6vfD9BNL%2B9PvwgrVEcc%2FA%3D%3D" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/mediaplayer.js?rev=Q6vfD9BNL%2B9PvwgrVEcc%2FA%3D%3D", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6903, "response_frame": 6912 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 16377, "artifact_id": "artifact-b98e8363f96d7e627bb1e8f1", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 16377, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 16377, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d47862735c2dbdb3a7f6b585cdc7994a", "sha1": "9d0492478aeb1e645e3ea1113633c22479743207", "type": "http-exported-object", "sha256": "ec8202663864f3744450858c1e5a51826427b7b7b082b5d182d7be0dc47f2c4e", "evidence": [ { "tcp_stream": 108, "frame_number": 6599, "display_filter": "frame.number == 6599", "timestamp_epoch": "1541624862.179847000" } ], "filename": "ScriptResx.ashx%3fculture=en%2Dus&name=SP%2ERes&rev=b6%2FcRx1a6orhAQ%2FcF%2B0ytQ%3D%3D", "filenames": [ "ScriptResx.ashx%3fculture=en%2Dus&name=SP%2ERes&rev=b6%2FcRx1a6orhAQ%2FcF%2B0ytQ%3D%3D" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/ScriptResx.ashx?culture=en%2Dus&name=SP%2ERes&rev=b6%2FcRx1a6orhAQ%2FcF%2B0ytQ%3D%3D", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6581, "response_frame": 6599 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 14312, "artifact_id": "artifact-e89a50c6f1243a6118d0e702", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14312, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14312, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2df4d4b1c6b2ce3b4ecc7f7dd10bf028", "sha1": "1c659042b232a20ed23663fda6433407822dcb96", "type": "http-exported-object", "sha256": "19fda88c2df63d85b7762799904408d0703f7efe7d6956d70c776458075747f3", "evidence": [ { "tcp_stream": 108, "frame_number": 5242, "display_filter": "frame.number == 5242", "timestamp_epoch": "1541624860.348400000" } ], "filename": "CUAnschutz.jpg", "filenames": [ "CUAnschutz.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUAnschutz.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5201, "response_frame": 5242 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 13648, "artifact_id": "artifact-916313dcb00b94426be20837", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 13648, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 13648, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "ec1c8d947faf72044983e44272d742d3", "sha1": "4dead7fbde90aced120172db43a09bf00e2c0271", "type": "http-exported-object", "sha256": "ea99682af1f2ca9bb54887a9cc1ced7c09b2f6d7feb277f2c3d6f3b57af25fc1", "evidence": [ { "tcp_stream": 103, "frame_number": 6593, "display_filter": "frame.number == 6593", "timestamp_epoch": "1541624862.175771000" } ], "filename": "sp.core.js%3frev=7ByNlH%2BvcgRJg%2BRCctdC0w%3D%3D", "filenames": [ "sp.core.js%3frev=7ByNlH%2BvcgRJg%2BRCctdC0w%3D%3D" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/sp.core.js?rev=7ByNlH%2BvcgRJg%2BRCctdC0w%3D%3D", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 6579, "response_frame": 6593 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 12352, "artifact_id": "artifact-c20490455276bd4fae2f6915", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12352, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 12352, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e50db431a93bfe87da97ebc24b407223", "sha1": "2fc2bf21c8785337eb2b74961272d7659aefda33", "type": "http-exported-object", "sha256": "b2aba18ac53e4abc1a631c98959e5411fc64efe761dbe216e1f559b1e2d7aef2", "evidence": [ { "tcp_stream": 106, "frame_number": 5469, "display_filter": "frame.number == 5469", "timestamp_epoch": "1541624860.522124000" } ], "filename": "CUDenver.jpg", "filenames": [ "CUDenver.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUDenver.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5289, "response_frame": 5469 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 11926, "artifact_id": "artifact-e392701ee4e52619358dc31b", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 11926, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 11926, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "966031991ea4ecb07029361f94cf006e", "sha1": "ebd1be648dd452947389932a9f1301c6ff655f6c", "type": "http-exported-object", "sha256": "7df7e6f7c22f1938c2313beb743eb60040f607f2a703a5134c8842ce7e7946ab", "evidence": [ { "tcp_stream": 108, "frame_number": 5493, "display_filter": "frame.number == 5493", "timestamp_epoch": "1541624860.564825000" } ], "filename": "CUSouth.jpg", "filenames": [ "CUSouth.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUSouth.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5355, "response_frame": 5493 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 10826, "artifact_id": "artifact-5f2e119642160f06a6a0f7a9", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 10826, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 10826, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1caa71cc4d4eaa709b80136bfeced358", "sha1": "1e87c08af2dccc90b9268ffcf99995058679e02d", "type": "http-exported-object", "sha256": "b5fcfa087b1cc0b1f61c17437c0a533c027dd68bb1e42898682bad189bacdf67", "evidence": [ { "tcp_stream": 107, "frame_number": 8187, "display_filter": "frame.number == 8187", "timestamp_epoch": "1541624893.166127000" } ], "filename": "WebResource.axd%3fd=nK66gdmZPDA-w-JjHyggjO_q5ZVRp7ooiUATeOMUtTMCTlfkvxq8mxRHybfWnA0Swfdbv1YBCieMhY76WgB3McU0Erit7tpi9kGXDOtvazCF8h1BLSyM9r_pT9xkzGtAoB6i_bw2w0dM46xzuwSmUZ9Il-pR8sIBMDjV6n64EKHYbfoJqQA9doUWhsRbzsGCzJ1g7D2-gJrdDaKQJ1H6GipIFEoKwv_UCr3VeSqOsCE", "filenames": [ "WebResource.axd%3fd=nK66gdmZPDA-w-JjHyggjO_q5ZVRp7ooiUATeOMUtTMCTlfkvxq8mxRHybfWnA0Swfdbv1YBCieMhY76WgB3McU0Erit7tpi9kGXDOtvazCF8h1BLSyM9r_pT9xkzGtAoB6i_bw2w0dM46xzuwSmUZ9Il-pR8sIBMDjV6n64EKHYbfoJqQA9doUWhsRbzsGCzJ1g7D2-gJrdDaKQJ1H6GipIFEoKwv_UCr3VeSqOsCE" ], "transfers": [ { "url": "http://www.ucdenver.edu/WebResource.axd?d=nK66gdmZPDA-w-JjHyggjO_q5ZVRp7ooiUATeOMUtTMCTlfkvxq8mxRHybfWnA0Swfdbv1YBCieMhY76WgB3McU0Erit7tpi9kGXDOtvazCF8h1BLSyM9r_pT9xkzGtAoB6i_bw2w0dM46xzuwSmUZ9Il-pR8sIBMDjV6n64EKHYbfoJqQA9doUWhsRbzsGCzJ1g7D2-gJrdDaKQJ1H6GipIFEoKwv_UCr3VeSqOsCEXfpiHtt2ZR-Y3UW4oyGmrVOioeA2&t=635701215589701395", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 107, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 8154, "response_frame": 8187 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 9556, "artifact_id": "artifact-39790ca1c107130eafdf8d7e", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 9556, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 9556, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2e86bf8f683e533368db29183a979cd8", "sha1": "6d542fcc45327ca1d798ed9c4885f28a107fec93", "type": "http-exported-object", "sha256": "022d0a09ef989821ccf3e8bd48be89355052024fc688fe3c4c84c3da00a6e082", "evidence": [ { "tcp_stream": 105, "frame_number": 5269, "display_filter": "frame.number == 5269", "timestamp_epoch": "1541624860.363711000" } ], "filename": "cta_visit_small.jpg", "filenames": [ "cta_visit_small.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit_small.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5197, "response_frame": 5269 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 8672, "artifact_id": "artifact-e6a6c3d09ebbd481db05e0ee", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 8672, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 8672, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e01eb5a1803bdc4c771d29d9291c37ee", "sha1": "480244e421d0c5f577b9195b4ecfcd3805246d01", "type": "http-exported-object", "sha256": "1519c5e27fa45f1ceb90ae78923c474e3f5597d45e6a8c61ad73367a432333b8", "evidence": [ { "tcp_stream": 103, "frame_number": 4708, "display_filter": "frame.number == 4708", "timestamp_epoch": "1541624859.494550000" } ], "filename": "degree-app.css", "filenames": [ "degree-app.css" ], "transfers": [ { "url": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-app.css", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4636, "response_frame": 4708 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 8091, "artifact_id": "artifact-d2fdd40968961322d17faf32", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 8091, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 8091, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "dbcc46d7ddc44a6dc6dface8d624e21c", "sha1": "e94a6d5d480953369029c35803c53cff4843e986", "type": "http-exported-object", "sha256": "ff7d32dd7321a2b3c5597c69caae82409019ac22e11ecc4530188d4e3b144302", "evidence": [ { "tcp_stream": 103, "frame_number": 5256, "display_filter": "frame.number == 5256", "timestamp_epoch": "1541624860.361632000" } ], "filename": "cta_apply_small.jpg", "filenames": [ "cta_apply_small.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply_small.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5195, "response_frame": 5256 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 7687, "artifact_id": "artifact-69889baa88cad0c8b07b1dfd", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 7687, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 7687, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1a88b02b67ae5fbcca5976b247ab16e0", "sha1": "36009611b33c862fb9b49643ad1a071cf2ad5a11", "type": "http-exported-object", "sha256": "c8e9a8b2cf530cc873941944744e8d053a34d2759194dae198e579c9e17399a2", "evidence": [ { "tcp_stream": 106, "frame_number": 5219, "display_filter": "frame.number == 5219", "timestamp_epoch": "1541624860.345543000" } ], "filename": "cta_appStatus_small.jpg", "filenames": [ "cta_appStatus_small.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_appStatus_small.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5199, "response_frame": 5219 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 7600, "artifact_id": "artifact-dc765154f83d162b2c08389c", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 7600, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 7600, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c02955bd063c0ad3c8d0701f09bbb06f", "sha1": "7bcb64761fd2364326e2559dad3aa1f794a641bd", "type": "http-exported-object", "sha256": "f4fbf7d12ec5db69f6a21a8323602fe7e8aa8c4f59baea6115fe1323c3e1358f", "evidence": [ { "tcp_stream": 103, "frame_number": 8238, "display_filter": "frame.number == 8238", "timestamp_epoch": "1541624893.272991000" } ], "filename": "kwizcom_jsutility.js%3fv=13.4.81&source=kwizcomsharepointutilities", "filenames": [ "kwizcom_jsutility.js%3fv=13.4.81&source=kwizcomsharepointutilities" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/kwizcom.sharepoint.foundation/kwizcom_jsutility.js?v=13.4.81&source=kwizcomsharepointutilities", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 8182, "response_frame": 8238 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 6037, "artifact_id": "artifact-da0475db57959b91baf3d66a", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6037, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 6037, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0dfd56931f9d8cb938febff2f7fead29", "sha1": "b4fa94e1d5e2ceca211082f8354c393b3a7a4884", "type": "http-exported-object", "sha256": "a417a78e9d645ffa38f11bbcd1e4bdd0295bb71e5a7dfd692b3495dac2ef4107", "evidence": [ { "tcp_stream": 107, "frame_number": 5208, "display_filter": "frame.number == 5208", "timestamp_epoch": "1541624860.338508000" } ], "filename": "cta_catalog_small.jpg", "filenames": [ "cta_catalog_small.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog_small.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 107, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5168, "response_frame": 5208 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 5780, "artifact_id": "artifact-6293de5118a7bac03c21abfd", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5780, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5780, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "42d54e77f296e36650e127c3e92f0ef7", "sha1": "ecd9ceff27c64131e3b064fcf4245481d576932d", "type": "http-exported-object", "sha256": "fb229f5700cae4392b42fe23e328ba5e697a7c84f4678670791a22ead70a9d09", "evidence": [ { "tcp_stream": 104, "frame_number": 5226, "display_filter": "frame.number == 5226", "timestamp_epoch": "1541624860.346397000" } ], "filename": "cta_calendar_small.jpg", "filenames": [ "cta_calendar_small.jpg" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_calendar_small.jpg", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5170, "response_frame": 5226 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 5604, "artifact_id": "artifact-a526e124ab22b022640a574a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5604, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5604, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f74755b4757448d71fdcb4650a701816", "sha1": "0bcbe73d6a198f6e5ebafa035b734a12809cefa6", "type": "http-exported-object", "sha256": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "evidence": [ { "tcp_stream": 53, "frame_number": 1947, "display_filter": "frame.number == 1947", "timestamp_epoch": "1541623727.325082000" } ], "filename": "favicon.ico", "filenames": [ "favicon.ico" ], "transfers": [ { "url": "http://dhsiwyqdlskwsqo.com/favicon.ico", "client_ip": "10.22.15.119", "server_ip": "192.162.244.171", "tcp_stream": 53, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1939, "response_frame": 1947 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/vnd.microsoft.icon", "size_bytes": 5430, "artifact_id": "artifact-9adb686404a81c733fde837d", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5430, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5430, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2faee9a51807ab5e3e4a30ddba0d6984", "sha1": "e13dcdba00e7fd11da56ea8c0abab6c233be98d1", "type": "http-exported-object", "sha256": "72c3d8a0ee2408bcb595f51ec68806252c9b60a6be25b091f1d0a88655517f12", "evidence": [ { "tcp_stream": 103, "frame_number": 5127, "display_filter": "frame.number == 5127", "timestamp_epoch": "1541624859.968498000" } ], "filename": "CUDenver_cuitc-300.png", "filenames": [ "CUDenver_cuitc-300.png" ], "transfers": [ { "url": "http://www.ucdenver.edu/SiteCollectionImages/Logos/CUDenver_cuitc-300.png", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 4996, "response_frame": 5127 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 4805, "artifact_id": "artifact-de2cc2983d86233fdd198669", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4805, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 4805, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "390cfc9c03423cfe31fa37675c365214", "sha1": "d63987c33df38115c366d2bb44e92d372c14ec43", "type": "http-exported-object", "sha256": "11065daca98f9840f58be03dd0fa78c710b9509ad517857acacf715c491de6d6", "evidence": [ { "tcp_stream": 103, "frame_number": 8617, "display_filter": "frame.number == 8617", "timestamp_epoch": "1541624894.134686000" } ], "filename": "loading.gif", "filenames": [ "loading.gif" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/KWizCom_Aggregator/loading.gif", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8585, "response_frame": 8617 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/gif", "size_bytes": 4565, "artifact_id": "artifact-1ff85e6753b967c95833ca69", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4565, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 4565, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9608b17db2b5993e3e66810749cdaa38", "sha1": "d9c1951cbf95955b6b725908f457cf3a5b1397a9", "type": "http-exported-object", "sha256": "86a4c543d749c972e930c08df70d17f81c7eae19ea9854476eda897fd33fbfc5", "evidence": [ { "tcp_stream": 105, "frame_number": 6291, "display_filter": "frame.number == 6291", "timestamp_epoch": "1541624861.016855000" } ], "filename": "leftChevron.gif", "filenames": [ "leftChevron.gif" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/leftChevron.gif", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6034, "response_frame": 6291 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/gif", "size_bytes": 4229, "artifact_id": "artifact-fd5eb8e694d1a998776f18a6", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4229, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 4229, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "18dbc17cfcd8881155508fd614882089", "sha1": "301a50508617b230719593821d679c30ceadee2d", "type": "http-exported-object", "sha256": "eac280b1fd4d84b2b386d93b51f9193c42f10fe9c3cb0dd1e67ebff66fd31952", "evidence": [ { "tcp_stream": 108, "frame_number": 6064, "display_filter": "frame.number == 6064", "timestamp_epoch": "1541624860.948095000" } ], "filename": "rightChevron.gif", "filenames": [ "rightChevron.gif" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/rightChevron.gif", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6011, "response_frame": 6064 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/gif", "size_bytes": 4217, "artifact_id": "artifact-32f45df87db2f1d30f2bcd6c", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4217, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 4217, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d5e1c5d5bb229adeb7d21b58865b7c1e", "sha1": "cdfead4e3acdc0b4fe3d3d4c461ed9af97cfb1ec", "type": "http-exported-object", "sha256": "2e2e544728c5e5f5cfdc9ad2faf6063af99088e1c3edc32e5074e7ad541c18a0", "evidence": [ { "tcp_stream": 53, "frame_number": 2229, "display_filter": "frame.number == 2229", "timestamp_epoch": "1541623731.191064000" } ], "filename": "8lw2Htym.avi", "filenames": [ "8lw2Htym.avi" ], "transfers": [ { "url": "http://dhsiwyqdlskwsqo.com/images/UIL_2BVxj_2FFv/cAgM9ZivBfYRBhzmpmqE8/gTexqC1Lh_2F0iW2/AATDXP0c4G4qcxV/_2FXAAoF8eHHNZ8c43/RrSntOi0N/4VTdgqIWbPwlUsd3uIxL/BZP_2Bzh085fEx639Yq/B1kvRr_2FOEM0k57tlZ1QS/8lw2Htym.avi", "client_ip": "10.22.15.119", "server_ip": "192.162.244.171", "tcp_stream": 53, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 2226, "response_frame": 2229 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "video/x-msvideo", "size_bytes": 2320, "artifact_id": "artifact-aa22089d901a3b0c451871c8", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2320, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2320, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8672e6faebb2f45571625793edbcb072", "sha1": "0f46256a51f76798f9df2d1edc109438bd7cd969", "type": "http-exported-object", "sha256": "8ba51e69c99c8a2fee83d5cd85f86d044a51c9979f845ca6abf75901ad83f84c", "evidence": [ { "tcp_stream": 104, "frame_number": 5166, "display_filter": "frame.number == 5166", "timestamp_epoch": "1541624860.232646000" } ], "filename": "data.js", "filenames": [ "data.js" ], "transfers": [ { "url": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/data.js", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 5160, "response_frame": 5166 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 2281, "artifact_id": "artifact-a210390d0377c4f56b278f48", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2281, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2281, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cfbfca7cc289fd1eb2b7997de37d459a", "sha1": "8ca00bf24f5b13a51b5fd6550acc3d73a934d0f0", "type": "http-exported-object", "sha256": "9d7c79b24ac12a185212ccab8741f4acdbd7ab160099e719bedd682806886ac9", "evidence": [ { "tcp_stream": 104, "frame_number": 6003, "display_filter": "frame.number == 6003", "timestamp_epoch": "1541624860.838021000" } ], "filename": "youtube.png", "filenames": [ "youtube.png" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/youtube.png", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5841, "response_frame": 6003 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 2133, "artifact_id": "artifact-5aa85066270b6a3300d69dac", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2133, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2133, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "13175b2ebad03c4cba1888f632797bbc", "sha1": "01bdae362c6a517d12583d0de461c90c9e924be6", "type": "http-exported-object", "sha256": "46868c166bdd75230bd20064033f281d2d6ca30a512eee717871dac9da416955", "evidence": [ { "tcp_stream": 103, "frame_number": 5978, "display_filter": "frame.number == 5978", "timestamp_epoch": "1541624860.824571000" } ], "filename": "googleplus.png", "filenames": [ "googleplus.png" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/googleplus.png", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5807, "response_frame": 5978 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 2012, "artifact_id": "artifact-75cde9a2b7c46d310cc730da", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2012, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2012, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cc03981c4f9e17ba74264e12b42fd98a", "sha1": "25fbb599029bea25f8faee7bd43c92d1b08b3ff6", "type": "http-exported-object", "sha256": "4e3d1cd476ae289fb9a9f4ce26b781659410914c81d11b4befc7735f4c71b2b1", "evidence": [ { "tcp_stream": 106, "frame_number": 5989, "display_filter": "frame.number == 5989", "timestamp_epoch": "1541624860.826336000" } ], "filename": "instagram.png", "filenames": [ "instagram.png" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/instagram.png", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5845, "response_frame": 5989 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 1844, "artifact_id": "artifact-6dc414faf8e4d2e37564269d", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1844, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1844, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2d3f6d40ab8cb18744b7083e9e0a716f", "sha1": "69254b664068b14e4b5089bb3ba6b47709f724a4", "type": "http-exported-object", "sha256": "25d7dc2c15716821face8630fbf2c166969dc0852e19c822e07982ea512da981", "evidence": [ { "tcp_stream": 105, "frame_number": 5885, "display_filter": "frame.number == 5885", "timestamp_epoch": "1541624860.750367000" } ], "filename": "linkedin.png", "filenames": [ "linkedin.png" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/linkedin.png", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5642, "response_frame": 5885 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 1830, "artifact_id": "artifact-d12a53b668c5e4243780e849", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1830, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1830, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a4706be6763760dc3f78f185dc7dac91", "sha1": "47a25c0e49db1e786592703a9cb9f154ad96a53b", "type": "http-exported-object", "sha256": "561ffc13ce19398e938a84992b3791d95e9d6f7b904e3f79c9728dc0c23a8297", "evidence": [ { "tcp_stream": 103, "frame_number": 5803, "display_filter": "frame.number == 5803", "timestamp_epoch": "1541624860.710360000" } ], "filename": "bgximg.png", "filenames": [ "bgximg.png" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/images/bgximg.png", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 103, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5567, "response_frame": 5803 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 1770, "artifact_id": "artifact-46ad088e4430d484b669a99a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1770, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1770, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b89e4c2cfe1e5a508ef89abcf4658e7a", "sha1": "361b50b8af21607eaae32357bd209ede5c0c40e0", "type": "http-exported-object", "sha256": "6cba436e9e5adbe296a382ece4309eb469ec3a0d37d3b14058800f9fd57338ab", "evidence": [ { "tcp_stream": 108, "frame_number": 6008, "display_filter": "frame.number == 6008", "timestamp_epoch": "1541624860.845286000" } ], "filename": "twitter.png", "filenames": [ "twitter.png" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/twitter.png", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5887, "response_frame": 6008 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 1761, "artifact_id": "artifact-768db6039006209ad07e5aa2", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1761, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1761, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "91e1e8b7c6b0fc7bb26804274280f6a4", "sha1": "62a4b3acdd85f090f85acd42d0e69d278117fa9c", "type": "http-exported-object", "sha256": "b943dd2830226be743c9bfcb5ffa4eec591e55d09a736ffecdfd3d8b6581da31", "evidence": [ { "tcp_stream": 105, "frame_number": 6028, "display_filter": "frame.number == 6028", "timestamp_epoch": "1541624860.860307000" } ], "filename": "facebook.png", "filenames": [ "facebook.png" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/facebook.png", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5889, "response_frame": 6028 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 1524, "artifact_id": "artifact-0fb8bb120fa12fed98aea933", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1524, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1524, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1f145fa2d88e00b5fb2a54734e234ea3", "sha1": "b884a71ab541b80ef049af50f5a86e87e08907db", "type": "http-exported-object", "sha256": "61f39b4c6a88443103c0260f69dfc9484012f6bddad680b567c3ababcf416b4e", "evidence": [ { "tcp_stream": 108, "frame_number": 4957, "display_filter": "frame.number == 4957", "timestamp_epoch": "1541624859.775508000" } ], "filename": "UCDJS.js", "filenames": [ "UCDJS.js" ], "transfers": [ { "url": "http://www.ucdenver.edu/Javascript%20Library/UCDJS.js", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 4871, "response_frame": 4957 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 1451, "artifact_id": "artifact-6645db932dc5fcc772ea8b25", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1451, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1451, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "54a0ee586a1fdc423a057de2cdc2da21", "sha1": "cc8b8331446106ba928d9bbac6ef31f2a1c00136", "type": "http-exported-object", "sha256": "da725c97aae07686110485c776b5ebb1733fb26674466d07417aa2ee3c0e09a9", "evidence": [], "filename": "ProcessQuery", "filenames": [ "ProcessQuery" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1426, "artifact_id": "artifact-2e24e15404e5cbf6ecae4af1", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1426, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "795734766d8d8eabd97f05288cf63ede", "sha1": "55ecc50f7c3f553576ad84354fe8d9ec5347b15f", "type": "http-exported-object", "sha256": "bfedb831c9a4afb407a127b04080c8f649d2134e713d4a1f810d9f670295cf7d", "evidence": [ { "tcp_stream": 106, "frame_number": 5287, "display_filter": "frame.number == 5287", "timestamp_epoch": "1541624860.429149000" } ], "filename": "QLtab.png", "filenames": [ "QLtab.png" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/QLtab.png", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5235, "response_frame": 5287 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 1319, "artifact_id": "artifact-d9a7c6b3c7cbdc9d7f4284bb", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1319, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1319, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "28daea4f06e3bd95faf33d131bb681e7", "sha1": "41a5249de5ac77f52dbb47a7ff833d914bc46005", "type": "http-exported-object", "sha256": "9be5b65b630c074027b64f5544e24575e36aba498ee43b12167e82b40872e01f", "evidence": [ { "tcp_stream": 104, "frame_number": 5360, "display_filter": "frame.number == 5360", "timestamp_epoch": "1541624860.473040000" } ], "filename": "searchButton(1).png", "filenames": [ "searchButton(1).png" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/searchButton.png", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5245, "response_frame": 5360 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 1198, "artifact_id": "artifact-36da669f85dac12ff6c68eb9", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1198, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1198, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d54b1846733136b9761c4dacb3273518", "sha1": "1e088c6adab0a7af292e74cce589028c4b2b0cc9", "type": "http-exported-object", "sha256": "d2e3bd61e7e0d4f908192813267d98927cc31043d84387b1a941e3b5b15f9134", "evidence": [ { "tcp_stream": 107, "frame_number": 6603, "display_filter": "frame.number == 6603", "timestamp_epoch": "1541624862.196154000" } ], "filename": "favicon(1).ico", "filenames": [ "favicon(1).ico" ], "transfers": [ { "url": "http://www.ucdenver.edu/favicon.ico", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 107, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6585, "response_frame": 6603 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/vnd.microsoft.icon", "size_bytes": 1150, "artifact_id": "artifact-ca218360a0221d915554e795", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1150, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1150, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a7339ca2b67e9009b86233f2fcf9dbb2", "sha1": "1729b5ccecc775be5baf61c84cb7e78f9abc54a1", "type": "http-exported-object", "sha256": "9a4e9990d71244aaa68b4bff6d5910665e7df9051cd4ee030e61b8e7f16180c1", "evidence": [ { "tcp_stream": 106, "frame_number": 8234, "display_filter": "frame.number == 8234", "timestamp_epoch": "1541624893.267488000" } ], "filename": "local.js", "filenames": [ "local.js" ], "transfers": [ { "url": "http://www.ucdenver.edu/programs/undergraduate/Documents/Styles_Scripts/local.js", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 8178, "response_frame": 8234 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 1085, "artifact_id": "artifact-14eb97ef2db8417f42e1fe3a", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1085, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1085, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8c017c4df0d778913e88b1f0f8412cd4", "sha1": "d260447d2e6a87cc40c04ad5eeaa9a109748cebe", "type": "http-exported-object", "sha256": "9557385d62733e77c3bb5b473d9bb2fa29bd51f8b010d221cbefe8297a454291", "evidence": [ { "tcp_stream": 104, "frame_number": 5139, "display_filter": "frame.number == 5139", "timestamp_epoch": "1541624860.081286000" } ], "filename": "carousel.js", "filenames": [ "carousel.js" ], "transfers": [ { "url": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/carousel.js", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5123, "response_frame": 5139 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 882, "artifact_id": "artifact-38545406f67c6928fcc1ff0a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 882, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 882, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "83d0a8e5c463c3ef3dd80b88e4600850", "sha1": "90ef3a402359573d9bcf53598831148c0d7f17d0", "type": "http-exported-object", "sha256": "f099877e9778681f5ca0c77b7f18b5aa675caa6d5cd50abc28dfe6136ac3b8ac", "evidence": [ { "tcp_stream": 71, "frame_number": 2566, "display_filter": "frame.number == 2566", "timestamp_epoch": "1541624404.525560000" } ], "filename": "client(1).rar", "filenames": [ "client(1).rar" ], "transfers": [ { "url": "http://www.ferranorga.net/img/client.rar", "client_ip": "10.22.15.119", "server_ip": "62.149.140.59", "tcp_stream": 71, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 2564, "response_frame": 2566 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 773, "artifact_id": "artifact-56f591415f6d0d9394b119b4", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 773, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 773, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2dafeec6b68c399a3cb3dc84d312246b", "sha1": "9b2fbe704b925e06ae43e436ef6c0672dc5aaeac", "type": "http-exported-object", "sha256": "d60aea1fe282db3ac579713c98d24d46850375db28ccfec0793d10f275b860a5", "evidence": [ { "tcp_stream": 108, "frame_number": 6304, "display_filter": "frame.number == 6304", "timestamp_epoch": "1541624861.051671000" } ], "filename": "print.css", "filenames": [ "print.css" ], "transfers": [ { "url": "http://www.ucdenver.edu/Style%20Library/responsive/print.css", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6074, "response_frame": 6304 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 705, "artifact_id": "artifact-3c709e74b73ef6c3eba4b352", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 705, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 705, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "30b2b2cc6b55ef41ce8274f7bce93f05", "sha1": "2acabec737d636e3b5815f7f6e24a0b183a97462", "type": "http-exported-object", "sha256": "56bbf5dbefa7919f0b8666d9cfc272b0ddbc9e920a373c1ab701d960dc09ce3a", "evidence": [ { "tcp_stream": 107, "frame_number": 5164, "display_filter": "frame.number == 5164", "timestamp_epoch": "1541624860.228247000" } ], "filename": "searchButton.png", "filenames": [ "searchButton.png" ], "transfers": [ { "url": "http://www.ucdenver.edu/PublishingImages/UCDLayoutImages/searchButton.png", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 107, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5162, "response_frame": 5164 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 629, "artifact_id": "artifact-89447e58613497f037312254", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 629, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 629, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b3406fbcf2081486c94ef8aa3b69fa53", "sha1": "6a5387f6d96e958d4ca6a7333891003c42e1df2c", "type": "http-exported-object", "sha256": "58c778f59b121390544d07cc4ff6948eb35045eafe376247ef285d4f72cfe167", "evidence": [ { "tcp_stream": 108, "frame_number": 6898, "display_filter": "frame.number == 6898", "timestamp_epoch": "1541624862.749001000" } ], "filename": "sites(1).asmx", "filenames": [ "sites(1).asmx" ], "transfers": [ { "url": "http://www.ucdenver.edu/_vti_bin/sites.asmx", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6889, "response_frame": 6898 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 575, "artifact_id": "artifact-59ffcaddb9f21a51656faae1", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 575, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 575, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "49133c6f83755c8943d0618911f280bb", "sha1": "d713977d40cede02db69090be78ede17b7c5910e", "type": "http-exported-object", "sha256": "ca0405f6832d0b1aaf7e5c00aa3241cccf19859dc47ca15ab3a90a9ffcbdf150", "evidence": [ { "tcp_stream": 109, "frame_number": 5690, "display_filter": "frame.number == 5690", "timestamp_epoch": "1541624860.656109000" } ], "filename": "__utm.gif%3futmwv=5.7.2&utms=1&utmn=362717400&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=408037419&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAQE~", "filenames": [ "__utm.gif%3futmwv=5.7.2&utms=1&utmn=362717400&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=408037419&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAQE~" ], "transfers": [ { "url": "http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=362717400&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624860490&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=408037419&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAQE~", "client_ip": "10.22.15.119", "server_ip": "216.58.192.46", "tcp_stream": 109, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "302", "completeness": "matches-declared-content-length", "request_frame": 5617, "response_frame": 5690 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 368, "artifact_id": "artifact-6955ba049cfb48f824abadd4", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 368, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 368, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "62ab2c7cb237cb67acf74eed8107003c", "sha1": "8f780b9be1cc58c5d5ee6119a3a2b34b46ba34a6", "type": "http-exported-object", "sha256": "24e819821e2f9afcfed4ad0e8490935378abfb0df723850078e731cfd9ef6edd", "evidence": [], "filename": "sites.asmx", "filenames": [ "sites.asmx" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 332, "artifact_id": "artifact-bd7e8603abc5153feefe0f38", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 332, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "df2a71ce3ecdd17b8f925fe3a228f305", "sha1": "7f959b259b45e036635a6dde19e07fb0880f17fe", "type": "http-exported-object", "sha256": "f9985bf8754e921e90a0c63e3458daf79c492f25bbaf3cf13bb14d18ca27fd5a", "evidence": [ { "tcp_stream": 70, "frame_number": 2557, "display_filter": "frame.number == 2557", "timestamp_epoch": "1541624404.004624000" } ], "filename": "client.rar", "filenames": [ "client.rar" ], "transfers": [ { "url": "http://ferranorga.net/img/client.rar", "client_ip": "10.22.15.119", "server_ip": "62.149.140.59", "tcp_stream": 70, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "301", "completeness": "matches-declared-content-length", "request_frame": 2555, "response_frame": 2557 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 248, "artifact_id": "artifact-cc6df16ef6019b2344c23c3d", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 248, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 248, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "be342213d34238761b352a2d2fa848b0", "sha1": "aabb55c4e6f56a796e9fc87c023d451c8f60a975", "type": "http-exported-object", "sha256": "a630dac9b5b0fbea3974ad09401522aeda12f11bbe5344508829d575c03cd644", "evidence": [ { "tcp_stream": 108, "frame_number": 8110, "display_filter": "frame.number == 8110", "timestamp_epoch": "1541624887.806709000" } ], "filename": "undergraduate", "filenames": [ "undergraduate" ], "transfers": [ { "url": "http://www.ucdenver.edu/programs/undergraduate", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "302", "completeness": "matches-declared-content-length", "request_frame": 8107, "response_frame": 8110 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 188, "artifact_id": "artifact-944b0ef7ec60dc58049cabbc", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 188, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 188, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "134f5f02b1433c1b41ebda6b7a50373d", "sha1": "525729a730cf552370348b1fa4bbfc2aadad74fc", "type": "http-exported-object", "sha256": "37e9250c18e218e58fb1818a608e9ad463a4b4743ebf3c08ca738001cc8970e0", "evidence": [ { "tcp_stream": 108, "frame_number": 8587, "display_filter": "frame.number == 8587", "timestamp_epoch": "1541624894.112629000" } ], "filename": "minus.gif", "filenames": [ "minus.gif" ], "transfers": [ { "url": "http://www.ucdenver.edu/programs/undergraduate/Pages/_layouts/images/minus.gif", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8583, "response_frame": 8587 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/gif", "size_bytes": 185, "artifact_id": "artifact-8b256bb687f35ab3550db197", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 185, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 185, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "82cb0393de9499aa1eb0936f3c6bae07", "sha1": "0c412305ed8f60facbb15f10ad87ba2265b27485", "type": "http-exported-object", "sha256": "5c9486d0aa62b50180e77e62b15f9977b3b0fd3f7d9b1f797de4c41b7da02b7d", "evidence": [ { "tcp_stream": 105, "frame_number": 9026, "display_filter": "frame.number == 9026", "timestamp_epoch": "1541624907.086642000" } ], "filename": "CreativeWriting.aspx", "filenames": [ "CreativeWriting.aspx" ], "transfers": [ { "url": "http://www.ucdenver.edu/academics/colleges/CLAS/Departments/english/Programs/BachelorOfArts/BAEnglish/Pages/CreativeWriting.aspx", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "302", "completeness": "matches-declared-content-length", "request_frame": 9022, "response_frame": 9026 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 157, "artifact_id": "artifact-76d910eb59dc083ce3592144", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 157, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 157, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "406398009968ba25a01519611d594c28", "sha1": "6e0d7ac653992be095efec8373ee8e3279b4356e", "type": "http-exported-object", "sha256": "7bacd1e07f7de2e51fcd1eafbcd9ec0aaad5c16ac4c4d846a86a5654a00506b4", "evidence": [ { "tcp_stream": 104, "frame_number": 4987, "display_filter": "frame.number == 4987", "timestamp_epoch": "1541624859.846811000" } ], "filename": "blank.js%3frev=QGOYAJlouiWgFRlhHVlMKA%3D%3D", "filenames": [ "blank.js%3frev=QGOYAJlouiWgFRlhHVlMKA%3D%3D" ], "transfers": [ { "url": "http://www.ucdenver.edu/_layouts/blank.js?rev=QGOYAJlouiWgFRlhHVlMKA%3D%3D", "client_ip": "10.22.15.119", "server_ip": "132.194.7.45", "tcp_stream": 104, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 4899, "response_frame": 4987 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 120, "artifact_id": "artifact-93d0e99ae0cda8dbcedf6323", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 120, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 120, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "28d6814f309ea289f847c69cf91194c6", "sha1": "0f4e929dd5bb2564f7ab9c76338e04e292a42ace", "type": "http-exported-object", "sha256": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015", "evidence": [ { "tcp_stream": 109, "frame_number": 8061, "display_filter": "frame.number == 8061", "timestamp_epoch": "1541624866.185609000" }, { "tcp_stream": 109, "frame_number": 8109, "display_filter": "frame.number == 8109", "timestamp_epoch": "1541624887.735089000" }, { "tcp_stream": 109, "frame_number": 8678, "display_filter": "frame.number == 8678", "timestamp_epoch": "1541624894.215314000" } ], "filename": "__utm.gif%3futmwv=5.7.2&utms=2&utmn=1279953315&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage%2aNav%20-%20Primary%2aDe.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~", "filenames": [ "__utm.gif%3futmwv=5.7.2&utms=2&utmn=1279953315&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage%2aNav%20-%20Primary%2aDe.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~", "__utm.gif%3futmwv=5.7.2&utms=3&utmn=1832691277&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage%2aNav%20-%20Primary%2aBa.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~", "__utm.gif%3futmwv=5.7.2&utms=4&utmn=1892096743&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x446&utmsc=24-bit&ut.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~" ], "transfers": [ { "url": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=2&utmn=1279953315&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Degrees%20%26%20Programs)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624866037&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~", "client_ip": "10.22.15.119", "server_ip": "216.58.192.46", "tcp_stream": 109, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8057, "response_frame": 8061 }, { "url": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=3&utmn=1832691277&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Bachelor%270s%20Degrees)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624887589&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~", "client_ip": "10.22.15.119", "server_ip": "216.58.192.46", "tcp_stream": 109, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8105, "response_frame": 8109 }, { "url": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=4&utmn=1892096743&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x446&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Bachelor%27s%20degrees%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=326256236&utmr=0&utmp=%2Fprograms%2Fundergraduate%2FPages%2Fdefault.aspx&utmht=1541624894067&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~", "client_ip": "10.22.15.119", "server_ip": "216.58.192.46", "tcp_stream": 109, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8669, "response_frame": 8678 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 35, "artifact_id": "artifact-04f271b0b8bdff36baa02c98", "occurrences": 3, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 35, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 35, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cd5a4d3fdd5bffc16bf959ef75cf37bc", "sha1": "33bf88d5b82df3723d5863c7d23445e345828904", "type": "http-exported-object", "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [ { "tcp_stream": 27, "frame_number": 430, "display_filter": "frame.number == 430", "timestamp_epoch": "1541623252.682499000" } ], "filename": "ncsi.txt", "filenames": [ "ncsi.txt" ], "transfers": [ { "url": "http://www.msftncsi.com/ncsi.txt", "client_ip": "10.22.15.119", "server_ip": "72.246.64.187", "tcp_stream": 27, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 428, "response_frame": 430 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/plain", "size_bytes": 14, "artifact_id": "artifact-7a8ad9f3d9440f5212e8baab", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "10.22.15.119", "bytes_sent": 579352, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-d9d1da91c024b02ebf8adfa2", "packets_sent": 3917, "mac_addresses": [ "00:11:2f:d1:6e:52" ], "bytes_received": 6994290, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1541625723.650355", "first_seen_epoch": "1541623247.036005", "packets_received": 6314 }, { "ip": "10.22.15.2", "bytes_sent": 95403, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-6259702ce57e72932278dd90", "packets_sent": 409, "mac_addresses": [ "00:18:8b:f7:20:6a" ], "bytes_received": 111971, "evidence_frames": [ 3, 4, 5, 6, 7 ], "last_seen_epoch": "1541625300.13241", "first_seen_epoch": "1541623247.090073", "packets_received": 455 }, { "ip": "10.22.15.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-dbaafceff0b7ef4821659d33", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 4632, "evidence_frames": [ 1, 2, 221, 253, 254 ], "last_seen_epoch": "1541624802.791824", "first_seen_epoch": "1541623247.036005", "packets_received": 48 }, { "ip": "107.178.246.49", "bytes_sent": 6411, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d13f1e1eea8ffe32d005ac5d", "packets_sent": 15, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 2545, "evidence_frames": [ 6461, 6466, 6467, 6468, 6469 ], "last_seen_epoch": "1541624952.035091", "first_seen_epoch": "1541624861.3729", "packets_received": 13 }, { "ip": "132.194.39.10", "bytes_sent": 513477, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1f145669d74a86806a2a2593", "packets_sent": 418, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 34428, "evidence_frames": [ 9029, 9032, 9033, 9034, 9035 ], "last_seen_epoch": "1541624952.103674", "first_seen_epoch": "1541624907.125637", "packets_received": 216 }, { "ip": "132.194.7.45", "bytes_sent": 3744763, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-42944348599aa1674044bc99", "packets_sent": 2711, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 153936, "evidence_frames": [ 4545, 4550, 4551, 4552, 4553 ], "last_seen_epoch": "1541624952.118633", "first_seen_epoch": "1541624858.654697", "packets_received": 1313 }, { "ip": "172.217.15.194", "bytes_sent": 4813, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d1aa8a0c40e3c2887eb34680", "packets_sent": 11, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 2110, "evidence_frames": [ 6047, 6050, 6051, 6052, 6053 ], "last_seen_epoch": "1541624952.02888", "first_seen_epoch": "1541624860.906757", "packets_received": 11 }, { "ip": "172.217.193.155", "bytes_sent": 4694, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2fb2ad6f494ef7583cb6315a", "packets_sent": 11, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 1975, "evidence_frames": [ 5787, 5893, 5894, 5895, 5896 ], "last_seen_epoch": "1541624952.054722", "first_seen_epoch": "1541624860.706034", "packets_received": 11 }, { "ip": "172.217.2.68", "bytes_sent": 912206, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0e91c404201bb3f794ce1761", "packets_sent": 817, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 87739, "evidence_frames": [ 2744, 2745, 2746, 2747, 2748 ], "last_seen_epoch": "1541624952.034329", "first_seen_epoch": "1541624767.480152", "packets_received": 426 }, { "ip": "172.217.3.66", "bytes_sent": 10047, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-38f0ea384339e81d316ee483", "packets_sent": 24, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 5421, "evidence_frames": [ 3417, 3418, 3419, 3422, 3423 ], "last_seen_epoch": "1541624952.028636", "first_seen_epoch": "1541624795.667078", "packets_received": 19 }, { "ip": "172.217.3.67", "bytes_sent": 13672, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-178053430111a6fbbbecd07c", "packets_sent": 19, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 2051, "evidence_frames": [ 3031, 3034, 3035, 3036, 3037 ], "last_seen_epoch": "1541624952.032078", "first_seen_epoch": "1541624794.936615", "packets_received": 15 }, { "ip": "192.162.244.171", "bytes_sent": 391882, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b1c4f9cab3571c5240bfa694", "packets_sent": 272, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 14121, "evidence_frames": [ 1730, 1731, 1732, 1733, 1734 ], "last_seen_epoch": "1541623732.043735", "first_seen_epoch": "1541623725.751777", "packets_received": 232 }, { "ip": "208.67.222.222", "bytes_sent": 666, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c654d96dfb8d6ed2a6ba948d", "packets_sent": 5, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 423, "evidence_frames": [ 2238, 2239, 2240, 2241, 2242 ], "last_seen_epoch": "1541623797.443366", "first_seen_epoch": "1541623797.233056", "packets_received": 5 }, { "ip": "209.15.36.22", "bytes_sent": 19580, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-50641751a8769b3545127d33", "packets_sent": 50, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 7972, "evidence_frames": [ 5837, 5838, 5921, 5922, 5923 ], "last_seen_epoch": "1541624894.166943", "first_seen_epoch": "1541624860.731788", "packets_received": 40 }, { "ip": "216.58.192.35", "bytes_sent": 112402, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-455b1fcc6e17d33b03937884", "packets_sent": 130, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 11879, "evidence_frames": [ 2702, 2703, 2704, 2705, 2706 ], "last_seen_epoch": "1541624952.034233", "first_seen_epoch": "1541624762.867954", "packets_received": 91 }, { "ip": "216.58.192.38", "bytes_sent": 6707, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2149cb8ec3e1ea862e4d7bb5", "packets_sent": 15, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 3019, "evidence_frames": [ 5277, 5278, 5279, 5280, 5281 ], "last_seen_epoch": "1541624952.028702", "first_seen_epoch": "1541624860.397894", "packets_received": 13 }, { "ip": "216.58.192.42", "bytes_sent": 4893, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c67aa28ec404ad51d2475507", "packets_sent": 10, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 1478, "evidence_frames": [ 2791, 2792, 2793, 2794, 2795 ], "last_seen_epoch": "1541624789.867112", "first_seen_epoch": "1541624778.226528", "packets_received": 9 }, { "ip": "216.58.192.45", "bytes_sent": 11424, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8a2ed4c5fc29ccb8fde3f1be", "packets_sent": 27, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 4245, "evidence_frames": [ 2720, 2721, 2722, 2723, 2724 ], "last_seen_epoch": "1541624952.025845", "first_seen_epoch": "1541624763.156101", "packets_received": 22 }, { "ip": "216.58.192.46", "bytes_sent": 165968, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-447813ed7295973eb8bbab57", "packets_sent": 224, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 28651, "evidence_frames": [ 3303, 3304, 3305, 3306, 3307 ], "last_seen_epoch": "1541624952.03419", "first_seen_epoch": "1541624795.442661", "packets_received": 167 }, { "ip": "216.58.192.67", "bytes_sent": 5355, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c4af84e1b19198cbeec8043a", "packets_sent": 13, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 2292, "evidence_frames": [ 3707, 3709, 3710, 3711, 3712 ], "last_seen_epoch": "1541624952.034139", "first_seen_epoch": "1541624810.901493", "packets_received": 12 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4e50c2f4ed37df9a194ca7a9", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 594, "evidence_frames": [ 401, 402, 412, 2700, 2712 ], "last_seen_epoch": "1541624952.45675", "first_seen_epoch": "1541623249.954085", "packets_received": 11 }, { "ip": "224.0.0.251", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6c4d6ee40c219cfad721d6ff", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fb" ], "bytes_received": 492, "evidence_frames": [ 2701, 2738, 2741, 2866, 3374 ], "last_seen_epoch": "1541624797.584679", "first_seen_epoch": "1541624762.860037", "packets_received": 6 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-212a838a67a9e6bdb40e49e3", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 1118, "evidence_frames": [ 403, 408, 409, 410, 2773 ], "last_seen_epoch": "1541624801.073712", "first_seen_epoch": "1541623249.9571", "packets_received": 16 }, { "ip": "23.56.194.57", "bytes_sent": 8953, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8cfd4def3251c2dca805205a", "packets_sent": 16, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 2711, "evidence_frames": [ 6446, 6451, 6452, 6453, 6454 ], "last_seen_epoch": "1541624952.030003", "first_seen_epoch": "1541624861.328146", "packets_received": 13 }, { "ip": "239.255.255.250", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-881ae8859613bcb34f423d41", "packets_sent": 0, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "bytes_received": 2580, "evidence_frames": [ 2696, 2726, 2739, 2740, 2824 ], "last_seen_epoch": "1541624916.896692", "first_seen_epoch": "1541624762.197551", "packets_received": 12 }, { "ip": "255.255.255.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-a03954164c3dbd50f0bee227", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 1026, "evidence_frames": [ 404, 1702, 2250 ], "last_seen_epoch": "1541623797.537766", "first_seen_epoch": "1541623249.964576", "packets_received": 3 }, { "ip": "34.192.39.141", "bytes_sent": 5070, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fabe57b332ba300811dc22e3", "packets_sent": 11, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 2086, "evidence_frames": [ 6329, 6398, 6399, 6400, 6401 ], "last_seen_epoch": "1541624952.005946", "first_seen_epoch": "1541624861.092998", "packets_received": 11 }, { "ip": "34.227.43.215", "bytes_sent": 8570, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8a5f10633d1df5910be46f23", "packets_sent": 17, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 2299, "evidence_frames": [ 6450, 6462, 6463, 6464, 6465 ], "last_seen_epoch": "1541624894.165906", "first_seen_epoch": "1541624861.335895", "packets_received": 13 }, { "ip": "46.229.214.92", "bytes_sent": 16360, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-832c4e5ffa3065b33245a23a", "packets_sent": 54, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 11135, "evidence_frames": [ 2629, 2630, 2631, 2632, 2633 ], "last_seen_epoch": "1541625723.650355", "first_seen_epoch": "1541624602.507094", "packets_received": 60 }, { "ip": "46.29.160.132", "bytes_sent": 461244, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8402384e425da4ade898fe61", "packets_sent": 310, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 7661, "evidence_frames": [ 1244, 1245, 1246, 1247, 1248 ], "last_seen_epoch": "1541623636.559131", "first_seen_epoch": "1541623631.433683", "packets_received": 140 }, { "ip": "50.116.194.23", "bytes_sent": 4576, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-dd8583cbc5fe644d865bdefd", "packets_sent": 12, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 2040, "evidence_frames": [ 5926, 5992, 5993, 5994, 5995 ], "last_seen_epoch": "1541624894.166276", "first_seen_epoch": "1541624860.792661", "packets_received": 10 }, { "ip": "52.207.122.163", "bytes_sent": 6534, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-01346b954c825a0c16433e6f", "packets_sent": 15, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 1748, "evidence_frames": [ 6459, 6476, 6477, 6478, 6479 ], "last_seen_epoch": "1541624952.006351", "first_seen_epoch": "1541624861.37003", "packets_received": 12 }, { "ip": "52.214.151.124", "bytes_sent": 5542, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-96d2bee7d2de53414dd93ef1", "packets_sent": 14, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 1812, "evidence_frames": [ 6448, 6497, 6498, 6499, 6500 ], "last_seen_epoch": "1541624952.004821", "first_seen_epoch": "1541624861.330289", "packets_received": 12 }, { "ip": "54.86.197.0", "bytes_sent": 4768, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-601759044e6a4204769393a3", "packets_sent": 11, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 1790, "evidence_frames": [ 5751, 5839, 5840, 5843, 5844 ], "last_seen_epoch": "1541624952.005773", "first_seen_epoch": "1541624860.691044", "packets_received": 10 }, { "ip": "62.149.140.59", "bytes_sent": 2128, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7b47c9dfffcb9852c52364e5", "packets_sent": 10, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 1034, "evidence_frames": [ 2552, 2553, 2554, 2555, 2556 ], "last_seen_epoch": "1541624421.055014", "first_seen_epoch": "1541624403.693084", "packets_received": 12 }, { "ip": "63.251.240.12", "bytes_sent": 9471, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c334c89fc9886a7cd0147a5e", "packets_sent": 16, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 2503, "evidence_frames": [ 6457, 6480, 6481, 6484, 6485 ], "last_seen_epoch": "1541624894.166475", "first_seen_epoch": "1541624861.363591", "packets_received": 13 }, { "ip": "72.246.64.147", "bytes_sent": 58150, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c2fe52e32681bc4a96f5db40", "packets_sent": 41, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 1309, "evidence_frames": [ 2267, 2268, 2269, 2270, 2271 ], "last_seen_epoch": "1541623858.66047", "first_seen_epoch": "1541623798.578187", "packets_received": 20 }, { "ip": "72.246.64.187", "bytes_sent": 453, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-dc47570b41e5990684de9e88", "packets_sent": 5, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 379, "evidence_frames": [ 425, 426, 427, 428, 429 ], "last_seen_epoch": "1541623252.684806", "first_seen_epoch": "1541623252.646621", "packets_received": 5 }, { "ip": "74.6.141.28", "bytes_sent": 197011, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-edcc3180ebb58805935f0292", "packets_sent": 269, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 12611, "evidence_frames": [ 686, 687, 688, 689, 690 ], "last_seen_epoch": "1541623587.811237", "first_seen_epoch": "1541623305.097494", "packets_received": 149 }, { "ip": "74.6.141.50", "bytes_sent": 12062, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-da369dad30b5772f42330e82", "packets_sent": 58, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 6100, "evidence_frames": [ 1030, 1031, 1032, 1033, 1034 ], "last_seen_epoch": "1541623556.243873", "first_seen_epoch": "1541623379.015798", "packets_received": 38 }, { "ip": "93.184.216.182", "bytes_sent": 145607, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-712334edeffe48ff2e476756", "packets_sent": 152, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 14482, "evidence_frames": [ 9071, 9072, 9073, 9074, 9075 ], "last_seen_epoch": "1541624952.028913", "first_seen_epoch": "1541624907.820975", "packets_received": 92 }, { "ip": "95.181.198.115", "bytes_sent": 23374, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-150b72b74c314fa5453626c1", "packets_sent": 121, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 20760, "evidence_frames": [ 2253, 2254, 2255, 2256, 2257 ], "last_seen_epoch": "1541624540.277221", "first_seen_epoch": "1541623797.924464", "packets_received": 138 }, { "ip": "95.181.198.116", "bytes_sent": 54, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8fdaf87afd8b4e83f5da128d", "packets_sent": 1, "mac_addresses": [ "00:02:7d:88:ee:5d" ], "bytes_received": 194, "evidence_frames": [ 1694, 1695, 1696, 1726 ], "last_seen_epoch": "1541623711.733681", "first_seen_epoch": "1541623636.613776", "packets_received": 3 } ], "identities": [ { "type": "account", "value": "carlos.danger", "bindings": [ { "account": "", "owner_ip": "10.22.15.119", "frame_number": 530, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.2", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 538, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.2", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 540, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 552, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 571, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 606, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 642, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 654, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" } ], "evidence": [ { "tcp_stream": 33, "frame_number": 530, "display_filter": "frame.number == 530", "timestamp_epoch": "1541623290.117632000" }, { "tcp_stream": 34, "frame_number": 538, "display_filter": "frame.number == 538", "timestamp_epoch": "1541623290.128719000" }, { "tcp_stream": 34, "frame_number": 540, "display_filter": "frame.number == 540", "timestamp_epoch": "1541623290.129633000" }, { "tcp_stream": 35, "frame_number": 552, "display_filter": "frame.number == 552", "timestamp_epoch": "1541623290.133215000" }, { "tcp_stream": 37, "frame_number": 571, "display_filter": "frame.number == 571", "timestamp_epoch": "1541623290.692290000" }, { "tcp_stream": 39, "frame_number": 606, "display_filter": "frame.number == 606", "timestamp_epoch": "1541623291.234198000" }, { "tcp_stream": 42, "frame_number": 642, "display_filter": "frame.number == 642", "timestamp_epoch": "1541623291.249855000" }, { "tcp_stream": 43, "frame_number": 654, "display_filter": "frame.number == 654", "timestamp_epoch": "1541623291.251044000" } ], "raw_values": [ "carlos.danger" ], "identity_id": "identity-6bfcb47c24c4c3b27fd8410d", "ip_addresses": [ "10.22.15.119" ], "mac_addresses": [ "00:11:2f:d1:6e:52" ] }, { "type": "account", "value": "danger-win-pc$", "bindings": [ { "account": "", "owner_ip": "10.22.15.119", "frame_number": 28, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.2", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 36, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.2", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 38, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 50, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 79, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.2", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 89, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.2", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 91, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 103, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 119, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 158, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 205, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 299, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 318, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 355, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 367, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 470, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.2", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 478, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.2", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 480, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 492, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.22.15.119", "conversation_src": "10.22.15.2" } ], "evidence": [ { "tcp_stream": 2, "frame_number": 28, "display_filter": "frame.number == 28", "timestamp_epoch": "1541623247.273582000" }, { "tcp_stream": 3, "frame_number": 36, "display_filter": "frame.number == 36", "timestamp_epoch": "1541623247.291653000" }, { "tcp_stream": 3, "frame_number": 38, "display_filter": "frame.number == 38", "timestamp_epoch": "1541623247.292478000" }, { "tcp_stream": 4, "frame_number": 50, "display_filter": "frame.number == 50", "timestamp_epoch": "1541623247.298099000" }, { "tcp_stream": 6, "frame_number": 79, "display_filter": "frame.number == 79", "timestamp_epoch": "1541623247.348514000" }, { "tcp_stream": 7, "frame_number": 89, "display_filter": "frame.number == 89", "timestamp_epoch": "1541623247.382136000" }, { "tcp_stream": 7, "frame_number": 91, "display_filter": "frame.number == 91", "timestamp_epoch": "1541623247.383684000" }, { "tcp_stream": 8, "frame_number": 103, "display_filter": "frame.number == 103", "timestamp_epoch": "1541623247.394641000" }, { "tcp_stream": 9, "frame_number": 119, "display_filter": "frame.number == 119", "timestamp_epoch": "1541623247.397850000" }, { "tcp_stream": 12, "frame_number": 158, "display_filter": "frame.number == 158", "timestamp_epoch": "1541623247.422317000" }, { "tcp_stream": 15, "frame_number": 205, "display_filter": "frame.number == 205", "timestamp_epoch": "1541623247.575275000" }, { "tcp_stream": 20, "frame_number": 299, "display_filter": "frame.number == 299", "timestamp_epoch": "1541623248.533861000" }, { "tcp_stream": 21, "frame_number": 318, "display_filter": "frame.number == 318", "timestamp_epoch": "1541623248.542374000" }, { "tcp_stream": 25, "frame_number": 355, "display_filter": "frame.number == 355", "timestamp_epoch": "1541623248.552472000" }, { "tcp_stream": 26, "frame_number": 367, "display_filter": "frame.number == 367", "timestamp_epoch": "1541623248.553572000" }, { "tcp_stream": 30, "frame_number": 470, "display_filter": "frame.number == 470", "timestamp_epoch": "1541623257.840898000" }, { "tcp_stream": 31, "frame_number": 478, "display_filter": "frame.number == 478", "timestamp_epoch": "1541623257.857286000" }, { "tcp_stream": 31, "frame_number": 480, "display_filter": "frame.number == 480", "timestamp_epoch": "1541623257.857857000" }, { "tcp_stream": 32, "frame_number": 492, "display_filter": "frame.number == 492", "timestamp_epoch": "1541623257.862280000" } ], "raw_values": [ "DANGER-WIN-PC$", "danger-win-pc$" ], "identity_id": "identity-ed8b93e6d98d2581197b1e0a", "ip_addresses": [ "10.22.15.119" ], "mac_addresses": [ "00:11:2f:d1:6e:52" ] }, { "type": "hostname", "value": "Danger-Win-PC", "bindings": [ { "account": "", "owner_ip": "0.0.0.0", "frame_number": 404, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 1702, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 2250, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 1, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.22.15.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 221, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.22.15.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 253, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.22.15.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 276, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.22.15.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 306, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.22.15.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 397, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.22.15.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 399, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.22.15.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": "10.22.15.119", "frame_number": 400, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.22.15.255", "conversation_src": "10.22.15.119" } ], "evidence": [ { "udp_stream": 16, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1541623249.964576000" }, { "udp_stream": 16, "frame_number": 1702, "display_filter": "frame.number == 1702", "timestamp_epoch": "1541623699.459685000" }, { "udp_stream": 16, "frame_number": 2250, "display_filter": "frame.number == 2250", "timestamp_epoch": "1541623797.537766000" }, { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1541623247.036005000" }, { "udp_stream": 0, "frame_number": 221, "display_filter": "frame.number == 221", "timestamp_epoch": "1541623247.614882000" }, { "udp_stream": 0, "frame_number": 253, "display_filter": "frame.number == 253", "timestamp_epoch": "1541623247.785146000" }, { "udp_stream": 0, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1541623248.360882000" }, { "udp_stream": 0, "frame_number": 306, "display_filter": "frame.number == 306", "timestamp_epoch": "1541623248.540123000" }, { "udp_stream": 0, "frame_number": 397, "display_filter": "frame.number == 397", "timestamp_epoch": "1541623249.111298000" }, { "udp_stream": 0, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1541623249.291061000" }, { "udp_stream": 0, "frame_number": 400, "display_filter": "frame.number == 400", "timestamp_epoch": "1541623249.861180000" } ], "raw_values": [ "DANGER-WIN-PC<00>,DANGER-WIN-PC<00> (Workstation/Redirector)", "DANGER-WIN-PC<20>,DANGER-WIN-PC<20> (Server service)", "Danger-Win-PC" ], "identity_id": "identity-0b694a580b14d322375893d3", "ip_addresses": [ "10.22.15.119" ], "mac_addresses": [ "00:11:2f:d1:6e:52", "00:11:2f:d1:6e:52,00:11:2f:d1:6e:52" ] }, { "type": "netbios-group", "value": "GEEOGRAPHIC", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 2, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.22.15.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": null, "frame_number": 254, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.22.15.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": null, "frame_number": 307, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.22.15.255", "conversation_src": "10.22.15.119" }, { "account": "", "owner_ip": null, "frame_number": 398, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.22.15.255", "conversation_src": "10.22.15.119" } ], "evidence": [ { "udp_stream": 0, "frame_number": 2, "display_filter": "frame.number == 2", "timestamp_epoch": "1541623247.036172000" }, { "udp_stream": 0, "frame_number": 254, "display_filter": "frame.number == 254", "timestamp_epoch": "1541623247.786032000" }, { "udp_stream": 0, "frame_number": 307, "display_filter": "frame.number == 307", "timestamp_epoch": "1541623248.540227000" }, { "udp_stream": 0, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1541623249.290880000" } ], "raw_values": [ "GEEOGRAPHIC<00>,GEEOGRAPHIC<00> (Workstation/Redirector)" ], "identity_id": "identity-ce6e7eb36697b96f7b83e9e6", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query" ], "value": "222.222.67.208.in-addr.arpa", "evidence": [ { "udp_stream": 45, "frame_number": 2238, "display_filter": "frame.number == 2238", "timestamp_epoch": "1541623797.233056000" }, { "udp_stream": 45, "frame_number": 2239, "display_filter": "frame.number == 2239", "timestamp_epoch": "1541623797.246082000" } ], "is_private": null, "observable_id": "observable-f7b104f58b376a6988e3d22b", "last_seen_epoch": "1541623797.246082000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623797.233056000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "8895986.fls.doubleclick.net", "evidence": [ { "udp_stream": 89, "frame_number": 5266, "display_filter": "frame.number == 5266", "timestamp_epoch": "1541624860.363489000" }, { "udp_stream": 89, "frame_number": 5274, "display_filter": "frame.number == 5274", "timestamp_epoch": "1541624860.397101000" }, { "tcp_stream": 110, "frame_number": 5280, "display_filter": "frame.number == 5280", "timestamp_epoch": "1541624860.423381000" } ], "is_private": null, "observable_id": "observable-8c7714c9663fb13e969b823e", "last_seen_epoch": "1541624860.423381000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.363489000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "accounts.google.com", "evidence": [ { "udp_stream": 57, "frame_number": 2698, "display_filter": "frame.number == 2698", "timestamp_epoch": "1541624762.854415000" }, { "udp_stream": 57, "frame_number": 2719, "display_filter": "frame.number == 2719", "timestamp_epoch": "1541624763.152884000" }, { "tcp_stream": 78, "frame_number": 2723, "display_filter": "frame.number == 2723", "timestamp_epoch": "1541624763.173519000" }, { "tcp_stream": 82, "frame_number": 2840, "display_filter": "frame.number == 2840", "timestamp_epoch": "1541624794.508880000" } ], "is_private": null, "observable_id": "observable-67465105eb2809011101c666", "last_seen_epoch": "1541624794.508880000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624762.854415000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "adservice.google.com", "evidence": [ { "udp_stream": 75, "frame_number": 3415, "display_filter": "frame.number == 3415", "timestamp_epoch": "1541624795.634633000" }, { "udp_stream": 75, "frame_number": 3416, "display_filter": "frame.number == 3416", "timestamp_epoch": "1541624795.663259000" }, { "tcp_stream": 90, "frame_number": 3422, "display_filter": "frame.number == 3422", "timestamp_epoch": "1541624795.684426000" } ], "is_private": null, "observable_id": "observable-b578dfec4888ddf453845f49", "last_seen_epoch": "1541624795.684426000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624795.634633000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "api.bing.com", "evidence": [ { "udp_stream": 37, "frame_number": 1713, "display_filter": "frame.number == 1713", "timestamp_epoch": "1541623703.045964000" }, { "udp_stream": 40, "frame_number": 1716, "display_filter": "frame.number == 1716", "timestamp_epoch": "1541623703.058312000" }, { "udp_stream": 40, "frame_number": 1719, "display_filter": "frame.number == 1719", "timestamp_epoch": "1541623703.066561000" }, { "udp_stream": 37, "frame_number": 1720, "display_filter": "frame.number == 1720", "timestamp_epoch": "1541623703.066674000" } ], "is_private": null, "observable_id": "observable-2931dff8994ddbdaaaa99c8a", "last_seen_epoch": "1541623703.066674000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623703.045964000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "apis.google.com", "evidence": [ { "udp_stream": 74, "frame_number": 3301, "display_filter": "frame.number == 3301", "timestamp_epoch": "1541624795.412335000" }, { "udp_stream": 74, "frame_number": 3302, "display_filter": "frame.number == 3302", "timestamp_epoch": "1541624795.441778000" }, { "tcp_stream": 89, "frame_number": 3306, "display_filter": "frame.number == 3306", "timestamp_epoch": "1541624795.471389000" } ], "is_private": null, "observable_id": "observable-62b026f73495a5b2eefe016b", "last_seen_epoch": "1541624795.471389000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624795.412335000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "bcp.crwdcntrl.net", "evidence": [ { "udp_stream": 104, "frame_number": 6444, "display_filter": "frame.number == 6444", "timestamp_epoch": "1541624861.321007000" }, { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" }, { "tcp_stream": 123, "frame_number": 6464, "display_filter": "frame.number == 6464", "timestamp_epoch": "1541624861.384572000" } ], "is_private": null, "observable_id": "observable-122cb53407c2e674a4f471ea", "last_seen_epoch": "1541624861.384572000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.321007000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "clas.ucdenver.edu", "evidence": [ { "udp_stream": 105, "frame_number": 9027, "display_filter": "frame.number == 9027", "timestamp_epoch": "1541624907.089653000" }, { "udp_stream": 105, "frame_number": 9028, "display_filter": "frame.number == 9028", "timestamp_epoch": "1541624907.124684000" }, { "tcp_stream": 127, "frame_number": 9034, "display_filter": "frame.number == 9034", "timestamp_epoch": "1541624907.199832000" }, { "tcp_stream": 130, "frame_number": 9081, "display_filter": "frame.number == 9081", "timestamp_epoch": "1541624907.845875000" }, { "tcp_stream": 128, "frame_number": 9084, "display_filter": "frame.number == 9084", "timestamp_epoch": "1541624907.846160000" }, { "tcp_stream": 131, "frame_number": 9086, "display_filter": "frame.number == 9086", "timestamp_epoch": "1541624907.846496000" }, { "tcp_stream": 132, "frame_number": 9097, "display_filter": "frame.number == 9097", "timestamp_epoch": "1541624907.861241000" }, { "tcp_stream": 129, "frame_number": 9106, "display_filter": "frame.number == 9106", "timestamp_epoch": "1541624907.867635000" } ], "is_private": null, "observable_id": "observable-1e673700f33c2c3abd27fd3c", "last_seen_epoch": "1541624907.867635000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624907.089653000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "clients.l.google.com", "evidence": [ { "udp_stream": 87, "frame_number": 4501, "display_filter": "frame.number == 4501", "timestamp_epoch": "1541624853.951935000" }, { "udp_stream": 91, "frame_number": 5477, "display_filter": "frame.number == 5477", "timestamp_epoch": "1541624860.547098000" } ], "is_private": null, "observable_id": "observable-eabc02445e3fc5de7cbfd411", "last_seen_epoch": "1541624860.547098000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624853.951935000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "clients1.google.com", "evidence": [ { "udp_stream": 91, "frame_number": 5457, "display_filter": "frame.number == 5457", "timestamp_epoch": "1541624860.516907000" }, { "udp_stream": 91, "frame_number": 5477, "display_filter": "frame.number == 5477", "timestamp_epoch": "1541624860.547098000" }, { "tcp_stream": 111, "frame_number": 5485, "display_filter": "frame.number == 5485", "timestamp_epoch": "1541624860.563916000" } ], "is_private": null, "observable_id": "observable-35630b515d9ad5769a73256f", "last_seen_epoch": "1541624860.563916000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.516907000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "clients4.google.com", "evidence": [ { "udp_stream": 87, "frame_number": 4491, "display_filter": "frame.number == 4491", "timestamp_epoch": "1541624853.912838000" }, { "udp_stream": 87, "frame_number": 4501, "display_filter": "frame.number == 4501", "timestamp_epoch": "1541624853.951935000" }, { "tcp_stream": 102, "frame_number": 4505, "display_filter": "frame.number == 4505", "timestamp_epoch": "1541624853.969898000" } ], "is_private": null, "observable_id": "observable-12cd3660baa52069462972d2", "last_seen_epoch": "1541624853.969898000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624853.912838000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "clientservices.googleapis.com", "evidence": [ { "udp_stream": 56, "frame_number": 2697, "display_filter": "frame.number == 2697", "timestamp_epoch": "1541624762.530738000" }, { "udp_stream": 56, "frame_number": 2699, "display_filter": "frame.number == 2699", "timestamp_epoch": "1541624762.856918000" }, { "tcp_stream": 77, "frame_number": 2705, "display_filter": "frame.number == 2705", "timestamp_epoch": "1541624762.900485000" }, { "tcp_stream": 81, "frame_number": 2828, "display_filter": "frame.number == 2828", "timestamp_epoch": "1541624794.379580000" } ], "is_private": null, "observable_id": "observable-a3d213d50ded7c2e91e96df3", "last_seen_epoch": "1541624794.379580000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624762.530738000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cm.g.doubleclick.net", "evidence": [ { "udp_stream": 96, "frame_number": 6038, "display_filter": "frame.number == 6038", "timestamp_epoch": "1541624860.873606000" }, { "udp_stream": 96, "frame_number": 6044, "display_filter": "frame.number == 6044", "timestamp_epoch": "1541624860.904837000" }, { "tcp_stream": 117, "frame_number": 6052, "display_filter": "frame.number == 6052", "timestamp_epoch": "1541624860.926710000" } ], "is_private": null, "observable_id": "observable-f9f11af8f854548312ef7397", "last_seen_epoch": "1541624860.926710000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.873606000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "cyanteread.com", "evidence": [ { "udp_stream": 36, "frame_number": 1704, "display_filter": "frame.number == 1704", "timestamp_epoch": "1541623699.520395000" }, { "udp_stream": 36, "frame_number": 1705, "display_filter": "frame.number == 1705", "timestamp_epoch": "1541623699.591391000" } ], "is_private": null, "observable_id": "observable-43af33f3ae1dc4478a39a34b", "last_seen_epoch": "1541623699.591391000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623699.520395000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "d.turn.com", "evidence": [ { "udp_stream": 93, "frame_number": 5691, "display_filter": "frame.number == 5691", "timestamp_epoch": "1541624860.659079000" }, { "udp_stream": 93, "frame_number": 5925, "display_filter": "frame.number == 5925", "timestamp_epoch": "1541624860.792162000" }, { "tcp_stream": 116, "frame_number": 5994, "display_filter": "frame.number == 5994", "timestamp_epoch": "1541624860.828547000" } ], "is_private": null, "observable_id": "observable-301587461d33f4e8c1f39244", "last_seen_epoch": "1541624860.828547000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.659079000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "d.turn.com.akadns.net", "evidence": [ { "udp_stream": 93, "frame_number": 5925, "display_filter": "frame.number == 5925", "timestamp_epoch": "1541624860.792162000" } ], "is_private": null, "observable_id": "observable-3d1c142cdbc289ed2866b033", "last_seen_epoch": "1541624860.792162000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.792162000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "danger-win-pc.geeographic.com", "evidence": [ { "udp_stream": 25, "frame_number": 435, "display_filter": "frame.number == 435", "timestamp_epoch": "1541623254.972102000" }, { "udp_stream": 25, "frame_number": 436, "display_filter": "frame.number == 436", "timestamp_epoch": "1541623254.972506000" } ], "is_private": null, "observable_id": "observable-9e26be5f96957be15122dcdc", "last_seen_epoch": "1541623254.972506000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623254.972102000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "dart.l.doubleclick.net", "evidence": [ { "udp_stream": 89, "frame_number": 5274, "display_filter": "frame.number == 5274", "timestamp_epoch": "1541624860.397101000" } ], "is_private": null, "observable_id": "observable-d475b4f47d8aebd69cf6f83d", "last_seen_epoch": "1541624860.397101000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.397101000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "dhsiwyqdlskwsqo.com", "evidence": [ { "udp_stream": 43, "frame_number": 1728, "display_filter": "frame.number == 1728", "timestamp_epoch": "1541623725.437476000" }, { "udp_stream": 43, "frame_number": 1729, "display_filter": "frame.number == 1729", "timestamp_epoch": "1541623725.722135000" }, { "tcp_stream": 53, "frame_number": 1734, "display_filter": "frame.number == 1734", "timestamp_epoch": "1541623725.916965000" }, { "tcp_stream": 53, "frame_number": 1939, "display_filter": "frame.number == 1939", "timestamp_epoch": "1541623727.157447000" }, { "tcp_stream": 56, "frame_number": 1955, "display_filter": "frame.number == 1955", "timestamp_epoch": "1541623728.369908000" }, { "tcp_stream": 53, "frame_number": 2226, "display_filter": "frame.number == 2226", "timestamp_epoch": "1541623730.990957000" } ], "is_private": null, "observable_id": "observable-7ae438e8626189b74c9c6565", "last_seen_epoch": "1541623730.990957000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623725.437476000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dns.msftncsi.com", "evidence": [ { "udp_stream": 29, "frame_number": 680, "display_filter": "frame.number == 680", "timestamp_epoch": "1541623291.773708000" }, { "udp_stream": 29, "frame_number": 681, "display_filter": "frame.number == 681", "timestamp_epoch": "1541623291.790021000" }, { "udp_stream": 30, "frame_number": 682, "display_filter": "frame.number == 682", "timestamp_epoch": "1541623291.790344000" }, { "udp_stream": 30, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1541623291.810157000" }, { "udp_stream": 34, "frame_number": 1697, "display_filter": "frame.number == 1697", "timestamp_epoch": "1541623657.506880000" }, { "udp_stream": 34, "frame_number": 1698, "display_filter": "frame.number == 1698", "timestamp_epoch": "1541623657.522464000" }, { "udp_stream": 35, "frame_number": 1699, "display_filter": "frame.number == 1699", "timestamp_epoch": "1541623657.523123000" }, { "udp_stream": 35, "frame_number": 1700, "display_filter": "frame.number == 1700", "timestamp_epoch": "1541623657.523396000" } ], "is_private": null, "observable_id": "observable-58602ce8927e2a213a4ef412", "last_seen_epoch": "1541623657.523396000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623291.773708000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dpm.demdex.net", "evidence": [ { "udp_stream": 100, "frame_number": 6440, "display_filter": "frame.number == 6440", "timestamp_epoch": "1541624861.311811000" }, { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" }, { "tcp_stream": 122, "frame_number": 6499, "display_filter": "frame.number == 6499", "timestamp_epoch": "1541624861.460273000" } ], "is_private": null, "observable_id": "observable-c3ff049d6f0f870213a3176c", "last_seen_epoch": "1541624861.460273000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.311811000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dsum-sec.casalemedia.com", "evidence": [ { "udp_stream": 99, "frame_number": 6437, "display_filter": "frame.number == 6437", "timestamp_epoch": "1541624861.269826000" }, { "udp_stream": 99, "frame_number": 6445, "display_filter": "frame.number == 6445", "timestamp_epoch": "1541624861.327626000" }, { "tcp_stream": 121, "frame_number": 6453, "display_filter": "frame.number == 6453", "timestamp_epoch": "1541624861.343026000" } ], "is_private": null, "observable_id": "observable-401b761c8d6def0363683e3e", "last_seen_epoch": "1541624861.343026000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.269826000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "edbmwhcwe.geeographic.com", "evidence": [ { "udp_stream": 77, "frame_number": 3454, "display_filter": "frame.number == 3454", "timestamp_epoch": "1541624800.934850000" }, { "udp_stream": 77, "frame_number": 3456, "display_filter": "frame.number == 3456", "timestamp_epoch": "1541624800.935321000" } ], "is_private": null, "observable_id": "observable-8283bcde47981a990a8a330f", "last_seen_epoch": "1541624800.935321000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624800.934850000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "edbmwhcwe.localdomain", "evidence": [ { "udp_stream": 79, "frame_number": 3458, "display_filter": "frame.number == 3458", "timestamp_epoch": "1541624800.935933000" }, { "udp_stream": 79, "frame_number": 3462, "display_filter": "frame.number == 3462", "timestamp_epoch": "1541624800.976625000" } ], "is_private": null, "observable_id": "observable-b2ef3c2997bed73b7cd94029", "last_seen_epoch": "1541624800.976625000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624800.935933000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "encrypted-tbn0.gstatic.com", "evidence": [ { "udp_stream": 86, "frame_number": 3810, "display_filter": "frame.number == 3810", "timestamp_epoch": "1541624811.266452000" }, { "udp_stream": 86, "frame_number": 3827, "display_filter": "frame.number == 3827", "timestamp_epoch": "1541624811.300199000" }, { "tcp_stream": 96, "frame_number": 3841, "display_filter": "frame.number == 3841", "timestamp_epoch": "1541624811.316700000" }, { "tcp_stream": 95, "frame_number": 3848, "display_filter": "frame.number == 3848", "timestamp_epoch": "1541624811.318524000" }, { "tcp_stream": 94, "frame_number": 3850, "display_filter": "frame.number == 3850", "timestamp_epoch": "1541624811.318892000" }, { "tcp_stream": 97, "frame_number": 3852, "display_filter": "frame.number == 3852", "timestamp_epoch": "1541624811.319555000" }, { "tcp_stream": 98, "frame_number": 3854, "display_filter": "frame.number == 3854", "timestamp_epoch": "1541624811.319863000" }, { "tcp_stream": 99, "frame_number": 3858, "display_filter": "frame.number == 3858", "timestamp_epoch": "1541624811.322264000" } ], "is_private": null, "observable_id": "observable-d7f19f8f3ad18e111995475f", "last_seen_epoch": "1541624811.322264000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624811.266452000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fast.fonts.net", "evidence": [ { "udp_stream": 106, "frame_number": 9068, "display_filter": "frame.number == 9068", "timestamp_epoch": "1541624907.773895000" }, { "udp_stream": 106, "frame_number": 9070, "display_filter": "frame.number == 9070", "timestamp_epoch": "1541624907.820322000" }, { "tcp_stream": 133, "frame_number": 9074, "display_filter": "frame.number == 9074", "timestamp_epoch": "1541624907.838644000" }, { "tcp_stream": 136, "frame_number": 9359, "display_filter": "frame.number == 9359", "timestamp_epoch": "1541624908.372161000" }, { "tcp_stream": 139, "frame_number": 9364, "display_filter": "frame.number == 9364", "timestamp_epoch": "1541624908.372476000" }, { "tcp_stream": 135, "frame_number": 9366, "display_filter": "frame.number == 9366", "timestamp_epoch": "1541624908.372709000" }, { "tcp_stream": 137, "frame_number": 9368, "display_filter": "frame.number == 9368", "timestamp_epoch": "1541624908.372911000" }, { "tcp_stream": 138, "frame_number": 9370, "display_filter": "frame.number == 9370", "timestamp_epoch": "1541624908.373123000" } ], "is_private": null, "observable_id": "observable-20db76c9fa45a8a6c1564856", "last_seen_epoch": "1541624908.373123000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624907.773895000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "ferranorga.net", "evidence": [ { "udp_stream": 52, "frame_number": 2550, "display_filter": "frame.number == 2550", "timestamp_epoch": "1541624403.524417000" }, { "udp_stream": 52, "frame_number": 2551, "display_filter": "frame.number == 2551", "timestamp_epoch": "1541624403.692275000" }, { "tcp_stream": 70, "frame_number": 2555, "display_filter": "frame.number == 2555", "timestamp_epoch": "1541624403.848059000" } ], "is_private": null, "observable_id": "observable-caa6f83142fc298c4f8d6504", "last_seen_epoch": "1541624403.848059000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624403.524417000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fonts.gstatic.com", "evidence": [ { "udp_stream": 71, "frame_number": 2954, "display_filter": "frame.number == 2954", "timestamp_epoch": "1541624794.787349000" }, { "udp_stream": 71, "frame_number": 2962, "display_filter": "frame.number == 2962", "timestamp_epoch": "1541624794.815584000" }, { "tcp_stream": 84, "frame_number": 2966, "display_filter": "frame.number == 2966", "timestamp_epoch": "1541624794.830765000" }, { "tcp_stream": 85, "frame_number": 2980, "display_filter": "frame.number == 2980", "timestamp_epoch": "1541624794.886781000" } ], "is_private": null, "observable_id": "observable-f0c2c98739377c14851c6e78", "last_seen_epoch": "1541624794.886781000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624794.787349000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "geeographic-dc.geeographic.com", "evidence": [ { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1541623247.095753000" }, { "udp_stream": 3, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1541623247.096007000" }, { "udp_stream": 20, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1541623250.618469000" }, { "udp_stream": 20, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1541623250.618757000" } ], "is_private": null, "observable_id": "observable-c81f277ed56b871944bf40fd", "last_seen_epoch": "1541623250.618757000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623247.095753000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "geeographic.com", "evidence": [ { "udp_stream": 26, "frame_number": 437, "display_filter": "frame.number == 437", "timestamp_epoch": "1541623254.974894000" }, { "udp_stream": 26, "frame_number": 438, "display_filter": "frame.number == 438", "timestamp_epoch": "1541623254.977431000" } ], "is_private": null, "observable_id": "observable-fb2fb7f3e57387b2a384320b", "last_seen_epoch": "1541623254.977431000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623254.974894000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "gstaticadssl.l.google.com", "evidence": [ { "udp_stream": 71, "frame_number": 2962, "display_filter": "frame.number == 2962", "timestamp_epoch": "1541624794.815584000" } ], "is_private": null, "observable_id": "observable-927075e4570c73901fc890ea", "last_seen_epoch": "1541624794.815584000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624794.815584000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "id.google.com", "evidence": [ { "udp_stream": 85, "frame_number": 3703, "display_filter": "frame.number == 3703", "timestamp_epoch": "1541624810.869330000" }, { "udp_stream": 85, "frame_number": 3706, "display_filter": "frame.number == 3706", "timestamp_epoch": "1541624810.900411000" }, { "tcp_stream": 93, "frame_number": 3711, "display_filter": "frame.number == 3711", "timestamp_epoch": "1541624810.915240000" } ], "is_private": null, "observable_id": "observable-134ab603116d577cb84b3abf", "last_seen_epoch": "1541624810.915240000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624810.869330000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "id.l.google.com", "evidence": [ { "udp_stream": 85, "frame_number": 3706, "display_filter": "frame.number == 3706", "timestamp_epoch": "1541624810.900411000" } ], "is_private": null, "observable_id": "observable-2ec5ce5638b273e2fc69bd9e", "last_seen_epoch": "1541624810.900411000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624810.900411000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "imap.aol.com", "evidence": [ { "udp_stream": 31, "frame_number": 684, "display_filter": "frame.number == 684", "timestamp_epoch": "1541623305.055861000" }, { "udp_stream": 31, "frame_number": 685, "display_filter": "frame.number == 685", "timestamp_epoch": "1541623305.080372000" }, { "tcp_stream": 44, "frame_number": 689, "display_filter": "frame.number == 689", "timestamp_epoch": "1541623305.152933000" }, { "tcp_stream": 45, "frame_number": 717, "display_filter": "frame.number == 717", "timestamp_epoch": "1541623306.028695000" }, { "tcp_stream": 49, "frame_number": 1131, "display_filter": "frame.number == 1131", "timestamp_epoch": "1541623531.994660000" } ], "is_private": null, "observable_id": "observable-b69e3469f6f679e84580c258", "last_seen_epoch": "1541623531.994660000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623305.055861000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "insight-760077375.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "is_private": null, "observable_id": "observable-9e2d9d2504ccc2c01b6451be", "last_seen_epoch": "1541624860.680901000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.680901000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "insight.adsrvr.org", "evidence": [ { "udp_stream": 92, "frame_number": 5689, "display_filter": "frame.number == 5689", "timestamp_epoch": "1541624860.650537000" }, { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" }, { "tcp_stream": 112, "frame_number": 5843, "display_filter": "frame.number == 5843", "timestamp_epoch": "1541624860.734280000" } ], "is_private": null, "observable_id": "observable-2571d9fa8179fcc9138c955e", "last_seen_epoch": "1541624860.734280000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.650537000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "internal-aol.imap.mail.g03.yahoodns.net", "evidence": [ { "udp_stream": 31, "frame_number": 685, "display_filter": "frame.number == 685", "timestamp_epoch": "1541623305.080372000" } ], "is_private": null, "observable_id": "observable-8ea53542fc7a141e790b4f82", "last_seen_epoch": "1541623305.080372000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623305.080372000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.geeographic.com", "evidence": [ { "udp_stream": 21, "frame_number": 415, "display_filter": "frame.number == 415", "timestamp_epoch": "1541623250.627375000" }, { "udp_stream": 21, "frame_number": 416, "display_filter": "frame.number == 416", "timestamp_epoch": "1541623250.627639000" } ], "is_private": null, "observable_id": "observable-a3b4702643dc5acea095fede", "last_seen_epoch": "1541623250.627639000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623250.627375000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.localdomain", "evidence": [ { "udp_stream": 22, "frame_number": 417, "display_filter": "frame.number == 417", "timestamp_epoch": "1541623250.774107000" }, { "udp_stream": 22, "frame_number": 418, "display_filter": "frame.number == 418", "timestamp_epoch": "1541623250.791929000" } ], "is_private": null, "observable_id": "observable-755d2fe7448e4ca825360e2f", "last_seen_epoch": "1541623250.791929000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623250.774107000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "ivtqfoqdro.geeographic.com", "evidence": [ { "udp_stream": 60, "frame_number": 2762, "display_filter": "frame.number == 2762", "timestamp_epoch": "1541624769.235989000" }, { "udp_stream": 60, "frame_number": 2763, "display_filter": "frame.number == 2763", "timestamp_epoch": "1541624769.236532000" } ], "is_private": null, "observable_id": "observable-47020b9605b5e1edd8450f8f", "last_seen_epoch": "1541624769.236532000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624769.235989000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "ivtqfoqdro.localdomain", "evidence": [ { "udp_stream": 62, "frame_number": 2765, "display_filter": "frame.number == 2765", "timestamp_epoch": "1541624769.238088000" }, { "udp_stream": 62, "frame_number": 2771, "display_filter": "frame.number == 2771", "timestamp_epoch": "1541624769.445040000" } ], "is_private": null, "observable_id": "observable-27c3e2c7e8b4e3e2e2316642", "last_seen_epoch": "1541624769.445040000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624769.238088000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "link.sandwseafood.net", "evidence": [ { "udp_stream": 54, "frame_number": 2627, "display_filter": "frame.number == 2627", "timestamp_epoch": "1541624602.394148000" }, { "udp_stream": 54, "frame_number": 2628, "display_filter": "frame.number == 2628", "timestamp_epoch": "1541624602.506125000" }, { "tcp_stream": 74, "frame_number": 2632, "display_filter": "frame.number == 2632", "timestamp_epoch": "1541624602.665026000" }, { "tcp_stream": 75, "frame_number": 2654, "display_filter": "frame.number == 2654", "timestamp_epoch": "1541624603.809458000" }, { "tcp_stream": 76, "frame_number": 2673, "display_filter": "frame.number == 2673", "timestamp_epoch": "1541624614.990563000" }, { "tcp_stream": 141, "frame_number": 10188, "display_filter": "frame.number == 10188", "timestamp_epoch": "1541625603.803940000" }, { "tcp_stream": 142, "frame_number": 10203, "display_filter": "frame.number == 10203", "timestamp_epoch": "1541625614.954030000" } ], "is_private": null, "observable_id": "observable-e972fea16b78401a5908f612", "last_seen_epoch": "1541625614.954030000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624602.394148000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "loadm.exelator.com", "evidence": [ { "udp_stream": 102, "frame_number": 6442, "display_filter": "frame.number == 6442", "timestamp_epoch": "1541624861.318587000" }, { "udp_stream": 102, "frame_number": 6456, "display_filter": "frame.number == 6456", "timestamp_epoch": "1541624861.362801000" }, { "tcp_stream": 124, "frame_number": 6484, "display_filter": "frame.number == 6484", "timestamp_epoch": "1541624861.422233000" } ], "is_private": null, "observable_id": "observable-4663fbcd1880377d6c888fe2", "last_seen_epoch": "1541624861.422233000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.318587000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "match-975362022.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "is_private": null, "observable_id": "observable-551ad5b02ec2c58d1fd58f7a", "last_seen_epoch": "1541624861.092413000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.092413000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.adsrvr.org", "evidence": [ { "udp_stream": 98, "frame_number": 6307, "display_filter": "frame.number == 6307", "timestamp_epoch": "1541624861.058439000" }, { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" }, { "tcp_stream": 120, "frame_number": 6400, "display_filter": "frame.number == 6400", "timestamp_epoch": "1541624861.137244000" } ], "is_private": null, "observable_id": "observable-fd17edd3a7909b774bd4d51c", "last_seen_epoch": "1541624861.137244000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.058439000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "myip.opendns.com", "evidence": [ { "udp_stream": 48, "frame_number": 2244, "display_filter": "frame.number == 2244", "timestamp_epoch": "1541623797.408013000" }, { "udp_stream": 48, "frame_number": 2245, "display_filter": "frame.number == 2245", "timestamp_epoch": "1541623797.426200000" }, { "udp_stream": 49, "frame_number": 2246, "display_filter": "frame.number == 2246", "timestamp_epoch": "1541623797.429411000" }, { "udp_stream": 49, "frame_number": 2247, "display_filter": "frame.number == 2247", "timestamp_epoch": "1541623797.443366000" } ], "is_private": null, "observable_id": "observable-7974c5100630fcfb9d3542e3", "last_seen_epoch": "1541623797.443366000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623797.408013000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "myip.opendns.com.geeographic.com", "evidence": [ { "udp_stream": 46, "frame_number": 2240, "display_filter": "frame.number == 2240", "timestamp_epoch": "1541623797.246789000" }, { "udp_stream": 46, "frame_number": 2241, "display_filter": "frame.number == 2241", "timestamp_epoch": "1541623797.371219000" }, { "udp_stream": 47, "frame_number": 2242, "display_filter": "frame.number == 2242", "timestamp_epoch": "1541623797.371808000" }, { "udp_stream": 47, "frame_number": 2243, "display_filter": "frame.number == 2243", "timestamp_epoch": "1541623797.407306000" } ], "is_private": null, "observable_id": "observable-868f3c184b822687e2d47ae1", "last_seen_epoch": "1541623797.407306000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623797.246789000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pagead.l.doubleclick.net", "evidence": [ { "udp_stream": 96, "frame_number": 6044, "display_filter": "frame.number == 6044", "timestamp_epoch": "1541624860.904837000" } ], "is_private": null, "observable_id": "observable-ad82dd55de80ef0b80f5b11b", "last_seen_epoch": "1541624860.904837000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.904837000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pagead46.l.doubleclick.net", "evidence": [ { "udp_stream": 75, "frame_number": 3416, "display_filter": "frame.number == 3416", "timestamp_epoch": "1541624795.663259000" } ], "is_private": null, "observable_id": "observable-ba08407c922e0c0aaf50bda7", "last_seen_epoch": "1541624795.663259000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624795.663259000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel-a.basis.net", "evidence": [ { "udp_stream": 94, "frame_number": 5714, "display_filter": "frame.number == 5714", "timestamp_epoch": "1541624860.665729000" }, { "udp_stream": 94, "frame_number": 5835, "display_filter": "frame.number == 5835", "timestamp_epoch": "1541624860.731333000" }, { "tcp_stream": 114, "frame_number": 5923, "display_filter": "frame.number == 5923", "timestamp_epoch": "1541624860.790028000" }, { "tcp_stream": 115, "frame_number": 5936, "display_filter": "frame.number == 5936", "timestamp_epoch": "1541624860.797458000" } ], "is_private": null, "observable_id": "observable-18efee90dbc224c812f4d720", "last_seen_epoch": "1541624860.797458000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.665729000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel.sitescout.com", "evidence": [ { "udp_stream": 97, "frame_number": 6296, "display_filter": "frame.number == 6296", "timestamp_epoch": "1541624861.024210000" }, { "udp_stream": 97, "frame_number": 6297, "display_filter": "frame.number == 6297", "timestamp_epoch": "1541624861.024460000" }, { "tcp_stream": 118, "frame_number": 6312, "display_filter": "frame.number == 6312", "timestamp_epoch": "1541624861.082125000" }, { "tcp_stream": 119, "frame_number": 6317, "display_filter": "frame.number == 6317", "timestamp_epoch": "1541624861.082743000" } ], "is_private": null, "observable_id": "observable-09ba2869e24c38b49f7f0ad1", "last_seen_epoch": "1541624861.082743000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.024210000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel.tapad.com", "evidence": [ { "udp_stream": 101, "frame_number": 6441, "display_filter": "frame.number == 6441", "timestamp_epoch": "1541624861.312992000" }, { "udp_stream": 101, "frame_number": 6460, "display_filter": "frame.number == 6460", "timestamp_epoch": "1541624861.372243000" }, { "tcp_stream": 126, "frame_number": 6468, "display_filter": "frame.number == 6468", "timestamp_epoch": "1541624861.391564000" } ], "is_private": null, "observable_id": "observable-6b213329f8d22d5bad109f74", "last_seen_epoch": "1541624861.391564000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.312992000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "plus.l.google.com", "evidence": [ { "udp_stream": 74, "frame_number": 3302, "display_filter": "frame.number == 3302", "timestamp_epoch": "1541624795.441778000" } ], "is_private": null, "observable_id": "observable-d06ade1561025e6077eb8525", "last_seen_epoch": "1541624795.441778000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624795.441778000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "qigpzlvhnkqxpl.geeographic.com", "evidence": [ { "udp_stream": 61, "frame_number": 2764, "display_filter": "frame.number == 2764", "timestamp_epoch": "1541624769.238004000" }, { "udp_stream": 61, "frame_number": 2766, "display_filter": "frame.number == 2766", "timestamp_epoch": "1541624769.238347000" } ], "is_private": null, "observable_id": "observable-9d49e155431abab2cf841cd9", "last_seen_epoch": "1541624769.238347000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624769.238004000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "qigpzlvhnkqxpl.localdomain", "evidence": [ { "udp_stream": 64, "frame_number": 2769, "display_filter": "frame.number == 2769", "timestamp_epoch": "1541624769.239971000" }, { "udp_stream": 64, "frame_number": 2772, "display_filter": "frame.number == 2772", "timestamp_epoch": "1541624769.445501000" } ], "is_private": null, "observable_id": "observable-55809c00873a0abf57178408", "last_seen_epoch": "1541624769.445501000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624769.239971000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "qwpvlqamqfnzxfk.geeographic.com", "evidence": [ { "udp_stream": 63, "frame_number": 2767, "display_filter": "frame.number == 2767", "timestamp_epoch": "1541624769.238681000" }, { "udp_stream": 63, "frame_number": 2768, "display_filter": "frame.number == 2768", "timestamp_epoch": "1541624769.238877000" } ], "is_private": null, "observable_id": "observable-26e5b1aeff31f687528bb655", "last_seen_epoch": "1541624769.238877000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624769.238681000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "qwpvlqamqfnzxfk.localdomain", "evidence": [ { "udp_stream": 65, "frame_number": 2770, "display_filter": "frame.number == 2770", "timestamp_epoch": "1541624769.240233000" }, { "udp_stream": 65, "frame_number": 2775, "display_filter": "frame.number == 2775", "timestamp_epoch": "1541624769.529988000" } ], "is_private": null, "observable_id": "observable-4500c065091a9f7c5281d54b", "last_seen_epoch": "1541624769.529988000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624769.240233000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "resolver1.opendns.com", "evidence": [ { "udp_stream": 44, "frame_number": 2236, "display_filter": "frame.number == 2236", "timestamp_epoch": "1541623797.206687000" }, { "udp_stream": 44, "frame_number": 2237, "display_filter": "frame.number == 2237", "timestamp_epoch": "1541623797.226998000" } ], "is_private": null, "observable_id": "observable-ea2200a8ad9b4f16d8e6ad6e", "last_seen_epoch": "1541623797.226998000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623797.206687000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "rtelyse.geeographic.com", "evidence": [ { "udp_stream": 76, "frame_number": 3453, "display_filter": "frame.number == 3453", "timestamp_epoch": "1541624800.934735000" }, { "udp_stream": 76, "frame_number": 3455, "display_filter": "frame.number == 3455", "timestamp_epoch": "1541624800.935184000" } ], "is_private": null, "observable_id": "observable-62d4ef8b4d73fa960059bd78", "last_seen_epoch": "1541624800.935184000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624800.934735000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "rtelyse.localdomain", "evidence": [ { "udp_stream": 78, "frame_number": 3457, "display_filter": "frame.number == 3457", "timestamp_epoch": "1541624800.935729000" }, { "udp_stream": 78, "frame_number": 3465, "display_filter": "frame.number == 3465", "timestamp_epoch": "1541624800.977934000" } ], "is_private": null, "observable_id": "observable-b7048f537968a47172b9d54c", "last_seen_epoch": "1541624800.977934000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624800.935729000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "shumbildac.com", "evidence": [ { "udp_stream": 33, "frame_number": 1242, "display_filter": "frame.number == 1242", "timestamp_epoch": "1541623630.882323000" }, { "udp_stream": 33, "frame_number": 1243, "display_filter": "frame.number == 1243", "timestamp_epoch": "1541623631.425241000" }, { "tcp_stream": 51, "frame_number": 1247, "display_filter": "frame.number == 1247", "timestamp_epoch": "1541623631.752689000" } ], "is_private": null, "observable_id": "observable-6968f4fb2f3c066fbd38903e", "last_seen_epoch": "1541623631.752689000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623630.882323000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "smtp.aol.com", "evidence": [ { "udp_stream": 32, "frame_number": 1028, "display_filter": "frame.number == 1028", "timestamp_epoch": "1541623378.925900000" }, { "udp_stream": 32, "frame_number": 1029, "display_filter": "frame.number == 1029", "timestamp_epoch": "1541623379.015119000" }, { "tcp_stream": 48, "frame_number": 1033, "display_filter": "frame.number == 1033", "timestamp_epoch": "1541623379.090748000" }, { "tcp_stream": 50, "frame_number": 1190, "display_filter": "frame.number == 1190", "timestamp_epoch": "1541623552.063814000" } ], "is_private": null, "observable_id": "observable-7c0dbfd21c4682b2054a9f52", "last_seen_epoch": "1541623552.063814000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623378.925900000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ssl.gstatic.com", "evidence": [ { "udp_stream": 73, "frame_number": 3005, "display_filter": "frame.number == 3005", "timestamp_epoch": "1541624794.905693000" }, { "udp_stream": 73, "frame_number": 3028, "display_filter": "frame.number == 3028", "timestamp_epoch": "1541624794.934417000" }, { "tcp_stream": 87, "frame_number": 3036, "display_filter": "frame.number == 3036", "timestamp_epoch": "1541624794.952834000" } ], "is_private": null, "observable_id": "observable-5e9c2ec899b3ebb34dbaccf0", "last_seen_epoch": "1541624794.952834000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624794.905693000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "stats.g.doubleclick.net", "evidence": [ { "udp_stream": 95, "frame_number": 5715, "display_filter": "frame.number == 5715", "timestamp_epoch": "1541624860.667178000" }, { "udp_stream": 95, "frame_number": 5783, "display_filter": "frame.number == 5783", "timestamp_epoch": "1541624860.705335000" }, { "tcp_stream": 113, "frame_number": 5895, "display_filter": "frame.number == 5895", "timestamp_epoch": "1541624860.759852000" } ], "is_private": null, "observable_id": "observable-6dd04867ae87187c3f27ca5d", "last_seen_epoch": "1541624860.759852000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.667178000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "stats.l.doubleclick.net", "evidence": [ { "udp_stream": 95, "frame_number": 5783, "display_filter": "frame.number == 5783", "timestamp_epoch": "1541624860.705335000" } ], "is_private": null, "observable_id": "observable-7869f6ad61164639fda129c0", "last_seen_epoch": "1541624860.705335000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.705335000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.teads.tv", "evidence": [ { "udp_stream": 103, "frame_number": 6443, "display_filter": "frame.number == 6443", "timestamp_epoch": "1541624861.318677000" }, { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" }, { "tcp_stream": 125, "frame_number": 6478, "display_filter": "frame.number == 6478", "timestamp_epoch": "1541624861.417726000" } ], "is_private": null, "observable_id": "observable-f5b6ee48e7d40263a95b34b5", "last_seen_epoch": "1541624861.417726000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.318677000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tmencedfur.com", "evidence": [ { "udp_stream": 50, "frame_number": 2249, "display_filter": "frame.number == 2249", "timestamp_epoch": "1541623797.536622000" }, { "udp_stream": 50, "frame_number": 2252, "display_filter": "frame.number == 2252", "timestamp_epoch": "1541623797.918025000" }, { "tcp_stream": 57, "frame_number": 2256, "display_filter": "frame.number == 2256", "timestamp_epoch": "1541623798.099564000" }, { "tcp_stream": 59, "frame_number": 2335, "display_filter": "frame.number == 2335", "timestamp_epoch": "1541623799.430172000" }, { "tcp_stream": 60, "frame_number": 2354, "display_filter": "frame.number == 2354", "timestamp_epoch": "1541623810.459537000" }, { "tcp_stream": 61, "frame_number": 2380, "display_filter": "frame.number == 2380", "timestamp_epoch": "1541623999.415441000" }, { "tcp_stream": 62, "frame_number": 2395, "display_filter": "frame.number == 2395", "timestamp_epoch": "1541624000.439640000" }, { "tcp_stream": 64, "frame_number": 2440, "display_filter": "frame.number == 2440", "timestamp_epoch": "1541624200.447606000" }, { "tcp_stream": 65, "frame_number": 2455, "display_filter": "frame.number == 2455", "timestamp_epoch": "1541624201.459241000" }, { "tcp_stream": 66, "frame_number": 2472, "display_filter": "frame.number == 2472", "timestamp_epoch": "1541624212.416891000" }, { "tcp_stream": 67, "frame_number": 2495, "display_filter": "frame.number == 2495", "timestamp_epoch": "1541624223.761992000" }, { "tcp_stream": 68, "frame_number": 2523, "display_filter": "frame.number == 2523", "timestamp_epoch": "1541624401.469751000" }, { "tcp_stream": 69, "frame_number": 2538, "display_filter": "frame.number == 2538", "timestamp_epoch": "1541624402.562901000" }, { "tcp_stream": 72, "frame_number": 2573, "display_filter": "frame.number == 2573", "timestamp_epoch": "1541624414.707664000" }, { "tcp_stream": 73, "frame_number": 2600, "display_filter": "frame.number == 2600", "timestamp_epoch": "1541624425.693132000" } ], "is_private": null, "observable_id": "observable-5ae3daa0e9eb17c965f20dd2", "last_seen_epoch": "1541624425.693132000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623797.536622000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "translate.googleapis.com", "evidence": [ { "udp_stream": 69, "frame_number": 2789, "display_filter": "frame.number == 2789", "timestamp_epoch": "1541624778.193456000" }, { "udp_stream": 69, "frame_number": 2790, "display_filter": "frame.number == 2790", "timestamp_epoch": "1541624778.225835000" }, { "tcp_stream": 80, "frame_number": 2794, "display_filter": "frame.number == 2794", "timestamp_epoch": "1541624778.242052000" } ], "is_private": null, "observable_id": "observable-ec542fdb8af56d18e58b5d45", "last_seen_epoch": "1541624778.242052000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624778.193456000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.geeographic.com", "evidence": [ { "udp_stream": 18, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1541623249.980468000" }, { "udp_stream": 18, "frame_number": 407, "display_filter": "frame.number == 407", "timestamp_epoch": "1541623249.980801000" } ], "is_private": null, "observable_id": "observable-b58b39a6773e532d00f719cc", "last_seen_epoch": "1541623249.980801000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623249.980468000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "www-google-analytics.l.google.com", "evidence": [ { "udp_stream": 90, "frame_number": 5275, "display_filter": "frame.number == 5275", "timestamp_epoch": "1541624860.397205000" } ], "is_private": null, "observable_id": "observable-5e60ce220fc2f405d8148d64", "last_seen_epoch": "1541624860.397205000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.397205000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "www.bing.com", "evidence": [ { "udp_stream": 38, "frame_number": 1714, "display_filter": "frame.number == 1714", "timestamp_epoch": "1541623703.056771000" }, { "udp_stream": 39, "frame_number": 1715, "display_filter": "frame.number == 1715", "timestamp_epoch": "1541623703.057682000" }, { "udp_stream": 41, "frame_number": 1717, "display_filter": "frame.number == 1717", "timestamp_epoch": "1541623703.060728000" }, { "udp_stream": 42, "frame_number": 1718, "display_filter": "frame.number == 1718", "timestamp_epoch": "1541623703.061311000" }, { "udp_stream": 39, "frame_number": 1721, "display_filter": "frame.number == 1721", "timestamp_epoch": "1541623703.101869000" }, { "udp_stream": 41, "frame_number": 1722, "display_filter": "frame.number == 1722", "timestamp_epoch": "1541623703.101986000" }, { "udp_stream": 42, "frame_number": 1723, "display_filter": "frame.number == 1723", "timestamp_epoch": "1541623703.102105000" }, { "udp_stream": 38, "frame_number": 1724, "display_filter": "frame.number == 1724", "timestamp_epoch": "1541623703.102190000" } ], "is_private": null, "observable_id": "observable-615388b4ee66a255a27857f4", "last_seen_epoch": "1541623703.102190000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623703.056771000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.download.windowsupdate.com", "evidence": [ { "udp_stream": 51, "frame_number": 2265, "display_filter": "frame.number == 2265", "timestamp_epoch": "1541623798.514101000" }, { "udp_stream": 51, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1541623798.576317000" }, { "tcp_stream": 58, "frame_number": 2270, "display_filter": "frame.number == 2270", "timestamp_epoch": "1541623798.594440000" } ], "is_private": null, "observable_id": "observable-0a3bb044e7438ac406e39af2", "last_seen_epoch": "1541623798.594440000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623798.514101000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.ferranorga.net", "evidence": [ { "udp_stream": 53, "frame_number": 2559, "display_filter": "frame.number == 2559", "timestamp_epoch": "1541624404.006477000" }, { "udp_stream": 53, "frame_number": 2560, "display_filter": "frame.number == 2560", "timestamp_epoch": "1541624404.222937000" }, { "tcp_stream": 71, "frame_number": 2564, "display_filter": "frame.number == 2564", "timestamp_epoch": "1541624404.370399000" } ], "is_private": null, "observable_id": "observable-94c40bdfee6ade1aab13c77d", "last_seen_epoch": "1541624404.370399000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624404.006477000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "www.google-analytics.com", "evidence": [ { "udp_stream": 90, "frame_number": 5271, "display_filter": "frame.number == 5271", "timestamp_epoch": "1541624860.364107000" }, { "udp_stream": 90, "frame_number": 5275, "display_filter": "frame.number == 5275", "timestamp_epoch": "1541624860.397205000" }, { "tcp_stream": 109, "frame_number": 5284, "display_filter": "frame.number == 5284", "timestamp_epoch": "1541624860.425130000" }, { "tcp_stream": 109, "frame_number": 5617, "display_filter": "frame.number == 5617", "timestamp_epoch": "1541624860.618251000" }, { "tcp_stream": 109, "frame_number": 8057, "display_filter": "frame.number == 8057", "timestamp_epoch": "1541624866.166359000" }, { "tcp_stream": 109, "frame_number": 8105, "display_filter": "frame.number == 8105", "timestamp_epoch": "1541624887.715261000" }, { "tcp_stream": 109, "frame_number": 8669, "display_filter": "frame.number == 8669", "timestamp_epoch": "1541624894.195169000" }, { "tcp_stream": 134, "frame_number": 9350, "display_filter": "frame.number == 9350", "timestamp_epoch": "1541624908.366512000" } ], "is_private": null, "observable_id": "observable-1e31c933b7cc675cb0ce5d21", "last_seen_epoch": "1541624908.366512000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.364107000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.google.com", "evidence": [ { "udp_stream": 59, "frame_number": 2742, "display_filter": "frame.number == 2742", "timestamp_epoch": "1541624767.161679000" }, { "udp_stream": 59, "frame_number": 2743, "display_filter": "frame.number == 2743", "timestamp_epoch": "1541624767.479203000" }, { "tcp_stream": 79, "frame_number": 2747, "display_filter": "frame.number == 2747", "timestamp_epoch": "1541624767.495250000" }, { "tcp_stream": 83, "frame_number": 2844, "display_filter": "frame.number == 2844", "timestamp_epoch": "1541624794.519353000" }, { "tcp_stream": 88, "frame_number": 3048, "display_filter": "frame.number == 3048", "timestamp_epoch": "1541624794.961269000" }, { "tcp_stream": 91, "frame_number": 3576, "display_filter": "frame.number == 3576", "timestamp_epoch": "1541624810.118090000" }, { "tcp_stream": 92, "frame_number": 3590, "display_filter": "frame.number == 3590", "timestamp_epoch": "1541624810.149072000" }, { "tcp_stream": 100, "frame_number": 4467, "display_filter": "frame.number == 4467", "timestamp_epoch": "1541624844.620256000" } ], "is_private": null, "observable_id": "observable-d70db8e6142b8baa844ac221", "last_seen_epoch": "1541624844.620256000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624767.161679000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.gstatic.com", "evidence": [ { "udp_stream": 72, "frame_number": 3002, "display_filter": "frame.number == 3002", "timestamp_epoch": "1541624794.904273000" }, { "udp_stream": 72, "frame_number": 3029, "display_filter": "frame.number == 3029", "timestamp_epoch": "1541624794.934525000" }, { "tcp_stream": 86, "frame_number": 3040, "display_filter": "frame.number == 3040", "timestamp_epoch": "1541624794.954277000" }, { "tcp_stream": 101, "frame_number": 4489, "display_filter": "frame.number == 4489", "timestamp_epoch": "1541624853.888354000" } ], "is_private": null, "observable_id": "observable-0c371a019d4be3c62e4ba2a7", "last_seen_epoch": "1541624853.888354000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624794.904273000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.msftncsi.com", "evidence": [ { "udp_stream": 24, "frame_number": 423, "display_filter": "frame.number == 423", "timestamp_epoch": "1541623252.570392000" }, { "udp_stream": 24, "frame_number": 424, "display_filter": "frame.number == 424", "timestamp_epoch": "1541623252.644208000" }, { "tcp_stream": 27, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1541623252.666384000" } ], "is_private": null, "observable_id": "observable-99aef14f278eca3ac854985c", "last_seen_epoch": "1541623252.666384000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623252.570392000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.ucdenver.edu", "evidence": [ { "udp_stream": 88, "frame_number": 4538, "display_filter": "frame.number == 4538", "timestamp_epoch": "1541624858.580540000" }, { "udp_stream": 88, "frame_number": 4544, "display_filter": "frame.number == 4544", "timestamp_epoch": "1541624858.654111000" }, { "tcp_stream": 103, "frame_number": 4552, "display_filter": "frame.number == 4552", "timestamp_epoch": "1541624858.750822000" }, { "tcp_stream": 106, "frame_number": 4577, "display_filter": "frame.number == 4577", "timestamp_epoch": "1541624859.196686000" }, { "tcp_stream": 108, "frame_number": 4581, "display_filter": "frame.number == 4581", "timestamp_epoch": "1541624859.201803000" }, { "tcp_stream": 104, "frame_number": 4585, "display_filter": "frame.number == 4585", "timestamp_epoch": "1541624859.204941000" }, { "tcp_stream": 105, "frame_number": 4589, "display_filter": "frame.number == 4589", "timestamp_epoch": "1541624859.217138000" }, { "tcp_stream": 107, "frame_number": 4593, "display_filter": "frame.number == 4593", "timestamp_epoch": "1541624859.219621000" }, { "tcp_stream": 104, "frame_number": 4615, "display_filter": "frame.number == 4615", "timestamp_epoch": "1541624859.315195000" }, { "tcp_stream": 103, "frame_number": 4636, "display_filter": "frame.number == 4636", "timestamp_epoch": "1541624859.381889000" }, { "tcp_stream": 107, "frame_number": 4668, "display_filter": "frame.number == 4668", "timestamp_epoch": "1541624859.440397000" }, { "tcp_stream": 105, "frame_number": 4676, "display_filter": "frame.number == 4676", "timestamp_epoch": "1541624859.448624000" }, { "tcp_stream": 103, "frame_number": 4710, "display_filter": "frame.number == 4710", "timestamp_epoch": "1541624859.497098000" }, { "tcp_stream": 106, "frame_number": 4749, "display_filter": "frame.number == 4749", "timestamp_epoch": "1541624859.563108000" }, { "tcp_stream": 108, "frame_number": 4768, "display_filter": "frame.number == 4768", "timestamp_epoch": "1541624859.568418000" }, { "tcp_stream": 103, "frame_number": 4788, "display_filter": "frame.number == 4788", "timestamp_epoch": "1541624859.617568000" }, { "tcp_stream": 104, "frame_number": 4794, "display_filter": "frame.number == 4794", "timestamp_epoch": "1541624859.630828000" }, { "tcp_stream": 108, "frame_number": 4871, "display_filter": "frame.number == 4871", "timestamp_epoch": "1541624859.685949000" }, { "tcp_stream": 103, "frame_number": 4888, "display_filter": "frame.number == 4888", "timestamp_epoch": "1541624859.741750000" }, { "tcp_stream": 104, "frame_number": 4899, "display_filter": "frame.number == 4899", "timestamp_epoch": "1541624859.747203000" } ], "is_private": null, "observable_id": "observable-8d3ef54ed0a77d7397cf3097", "last_seen_epoch": "1541624906.875946000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624858.580540000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "zotwyog.geeographic.com", "evidence": [ { "udp_stream": 80, "frame_number": 3459, "display_filter": "frame.number == 3459", "timestamp_epoch": "1541624800.937038000" }, { "udp_stream": 80, "frame_number": 3460, "display_filter": "frame.number == 3460", "timestamp_epoch": "1541624800.937265000" } ], "is_private": null, "observable_id": "observable-62ddb04a807edcf58f91d080", "last_seen_epoch": "1541624800.937265000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624800.937038000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "zotwyog.localdomain", "evidence": [ { "udp_stream": 81, "frame_number": 3461, "display_filter": "frame.number == 3461", "timestamp_epoch": "1541624800.938209000" }, { "udp_stream": 81, "frame_number": 3464, "display_filter": "frame.number == 3464", "timestamp_epoch": "1541624800.977490000" } ], "is_private": null, "observable_id": "observable-2b63c5f8ca7620e5c6438358", "last_seen_epoch": "1541624800.977490000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624800.938209000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.22.15.119", "evidence": [ { "udp_stream": 26, "frame_number": 437, "display_filter": "frame.number == 437", "timestamp_epoch": "1541623254.974894000" }, { "udp_stream": 26, "frame_number": 438, "display_filter": "frame.number == 438", "timestamp_epoch": "1541623254.977431000" } ], "is_private": true, "observable_id": "observable-240037d2b9d191d2c54f92a6", "last_seen_epoch": "1541623254.977431000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623254.974894000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.22.15.2", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1541623247.090323000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1541623247.091195000" }, { "udp_stream": 3, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1541623247.096007000" }, { "udp_stream": 7, "frame_number": 172, "display_filter": "frame.number == 172", "timestamp_epoch": "1541623247.429977000" }, { "udp_stream": 9, "frame_number": 176, "display_filter": "frame.number == 176", "timestamp_epoch": "1541623247.460829000" }, { "udp_stream": 11, "frame_number": 188, "display_filter": "frame.number == 188", "timestamp_epoch": "1541623247.541306000" }, { "udp_stream": 20, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1541623250.618757000" }, { "udp_stream": 25, "frame_number": 436, "display_filter": "frame.number == 436", "timestamp_epoch": "1541623254.972506000" } ], "is_private": true, "observable_id": "observable-1b11e980c206a4a4638a6f00", "last_seen_epoch": "1541623254.972506000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623247.090323000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.22.15.255", "evidence": [], "is_private": true, "observable_id": "observable-a830bc3e9c272022bae610df", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "107.178.246.49", "evidence": [ { "udp_stream": 101, "frame_number": 6460, "display_filter": "frame.number == 6460", "timestamp_epoch": "1541624861.372243000" } ], "is_private": false, "observable_id": "observable-d5a590291f810175c03f0ede", "last_seen_epoch": "1541624861.372243000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.372243000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.107.21.200", "evidence": [ { "udp_stream": 39, "frame_number": 1721, "display_filter": "frame.number == 1721", "timestamp_epoch": "1541623703.101869000" }, { "udp_stream": 41, "frame_number": 1722, "display_filter": "frame.number == 1722", "timestamp_epoch": "1541623703.101986000" }, { "udp_stream": 42, "frame_number": 1723, "display_filter": "frame.number == 1723", "timestamp_epoch": "1541623703.102105000" }, { "udp_stream": 38, "frame_number": 1724, "display_filter": "frame.number == 1724", "timestamp_epoch": "1541623703.102190000" } ], "is_private": false, "observable_id": "observable-d5ba35a22969dcc52b9136c7", "last_seen_epoch": "1541623703.102190000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623703.101869000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.107.5.80", "evidence": [ { "udp_stream": 40, "frame_number": 1719, "display_filter": "frame.number == 1719", "timestamp_epoch": "1541623703.066561000" }, { "udp_stream": 37, "frame_number": 1720, "display_filter": "frame.number == 1720", "timestamp_epoch": "1541623703.066674000" } ], "is_private": false, "observable_id": "observable-1ea96aa254574842aab8bacd", "last_seen_epoch": "1541623703.066674000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623703.066561000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "131.107.255.255", "evidence": [ { "udp_stream": 29, "frame_number": 681, "display_filter": "frame.number == 681", "timestamp_epoch": "1541623291.790021000" }, { "udp_stream": 34, "frame_number": 1698, "display_filter": "frame.number == 1698", "timestamp_epoch": "1541623657.522464000" } ], "is_private": false, "observable_id": "observable-4da0026cb9e4f177cea03e01", "last_seen_epoch": "1541623657.522464000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623291.790021000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "132.194.39.10", "evidence": [ { "udp_stream": 105, "frame_number": 9028, "display_filter": "frame.number == 9028", "timestamp_epoch": "1541624907.124684000" } ], "is_private": false, "observable_id": "observable-5d0ed2184af875d1459e0664", "last_seen_epoch": "1541624907.124684000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624907.124684000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "132.194.7.45", "evidence": [ { "udp_stream": 88, "frame_number": 4544, "display_filter": "frame.number == 4544", "timestamp_epoch": "1541624858.654111000" } ], "is_private": false, "observable_id": "observable-a5e011eaf34a9f65fb65b8dc", "last_seen_epoch": "1541624858.654111000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624858.654111000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.15.194", "evidence": [ { "udp_stream": 96, "frame_number": 6044, "display_filter": "frame.number == 6044", "timestamp_epoch": "1541624860.904837000" } ], "is_private": false, "observable_id": "observable-0ff728c34b9268feadcac6bf", "last_seen_epoch": "1541624860.904837000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.904837000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "172.217.193.154", "evidence": [ { "udp_stream": 95, "frame_number": 5783, "display_filter": "frame.number == 5783", "timestamp_epoch": "1541624860.705335000" } ], "is_private": false, "observable_id": "observable-2020ab22b49b0fefabb9e0d2", "last_seen_epoch": "1541624860.705335000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.705335000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.193.155", "evidence": [ { "udp_stream": 95, "frame_number": 5783, "display_filter": "frame.number == 5783", "timestamp_epoch": "1541624860.705335000" } ], "is_private": false, "observable_id": "observable-aa6c9123c582d80d90d3beee", "last_seen_epoch": "1541624860.705335000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.705335000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "172.217.193.156", "evidence": [ { "udp_stream": 95, "frame_number": 5783, "display_filter": "frame.number == 5783", "timestamp_epoch": "1541624860.705335000" } ], "is_private": false, "observable_id": "observable-4272154b7cc3ac9d68e91b44", "last_seen_epoch": "1541624860.705335000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.705335000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "172.217.193.157", "evidence": [ { "udp_stream": 95, "frame_number": 5783, "display_filter": "frame.number == 5783", "timestamp_epoch": "1541624860.705335000" } ], "is_private": false, "observable_id": "observable-35a46fa76936e2e39c26a9ed", "last_seen_epoch": "1541624860.705335000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.705335000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.2.68", "evidence": [ { "udp_stream": 59, "frame_number": 2743, "display_filter": "frame.number == 2743", "timestamp_epoch": "1541624767.479203000" } ], "is_private": false, "observable_id": "observable-088fb0e25ac0ffac788570e0", "last_seen_epoch": "1541624767.479203000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624767.479203000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.3.66", "evidence": [ { "udp_stream": 75, "frame_number": 3416, "display_filter": "frame.number == 3416", "timestamp_epoch": "1541624795.663259000" } ], "is_private": false, "observable_id": "observable-86921d45dce416f492ffe77d", "last_seen_epoch": "1541624795.663259000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624795.663259000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.3.67", "evidence": [ { "udp_stream": 73, "frame_number": 3028, "display_filter": "frame.number == 3028", "timestamp_epoch": "1541624794.934417000" } ], "is_private": false, "observable_id": "observable-c0981e2d028bc3f9c59dd1c6", "last_seen_epoch": "1541624794.934417000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624794.934417000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "192.162.244.171", "evidence": [ { "udp_stream": 43, "frame_number": 1729, "display_filter": "frame.number == 1729", "timestamp_epoch": "1541623725.722135000" } ], "is_private": false, "observable_id": "observable-3b6808bbf4b5b6620b4326d0", "last_seen_epoch": "1541623725.722135000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623725.722135000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "204.79.197.200", "evidence": [ { "udp_stream": 39, "frame_number": 1721, "display_filter": "frame.number == 1721", "timestamp_epoch": "1541623703.101869000" }, { "udp_stream": 41, "frame_number": 1722, "display_filter": "frame.number == 1722", "timestamp_epoch": "1541623703.101986000" }, { "udp_stream": 42, "frame_number": 1723, "display_filter": "frame.number == 1723", "timestamp_epoch": "1541623703.102105000" }, { "udp_stream": 38, "frame_number": 1724, "display_filter": "frame.number == 1724", "timestamp_epoch": "1541623703.102190000" } ], "is_private": false, "observable_id": "observable-e5b855bc8158da1812068f75", "last_seen_epoch": "1541623703.102190000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623703.101869000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "208.67.222.222", "evidence": [ { "udp_stream": 44, "frame_number": 2237, "display_filter": "frame.number == 2237", "timestamp_epoch": "1541623797.226998000" } ], "is_private": false, "observable_id": "observable-85e4c4121a9e2dd073f8b77b", "last_seen_epoch": "1541623797.226998000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623797.226998000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "209.15.36.22", "evidence": [ { "udp_stream": 94, "frame_number": 5835, "display_filter": "frame.number == 5835", "timestamp_epoch": "1541624860.731333000" }, { "udp_stream": 97, "frame_number": 6297, "display_filter": "frame.number == 6297", "timestamp_epoch": "1541624861.024460000" } ], "is_private": false, "observable_id": "observable-a35a2f1aa19a676ef93af986", "last_seen_epoch": "1541624861.024460000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.731333000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.35", "evidence": [ { "udp_stream": 56, "frame_number": 2699, "display_filter": "frame.number == 2699", "timestamp_epoch": "1541624762.856918000" }, { "udp_stream": 71, "frame_number": 2962, "display_filter": "frame.number == 2962", "timestamp_epoch": "1541624794.815584000" }, { "udp_stream": 72, "frame_number": 3029, "display_filter": "frame.number == 3029", "timestamp_epoch": "1541624794.934525000" } ], "is_private": false, "observable_id": "observable-d7d11cd1fc9f237913cab2f6", "last_seen_epoch": "1541624794.934525000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624762.856918000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.38", "evidence": [ { "udp_stream": 89, "frame_number": 5274, "display_filter": "frame.number == 5274", "timestamp_epoch": "1541624860.397101000" } ], "is_private": false, "observable_id": "observable-deda4d116456054eff68fac8", "last_seen_epoch": "1541624860.397101000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.397101000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.42", "evidence": [ { "udp_stream": 69, "frame_number": 2790, "display_filter": "frame.number == 2790", "timestamp_epoch": "1541624778.225835000" } ], "is_private": false, "observable_id": "observable-74fbd116c6652cd54f09bc08", "last_seen_epoch": "1541624778.225835000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624778.225835000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.45", "evidence": [ { "udp_stream": 57, "frame_number": 2719, "display_filter": "frame.number == 2719", "timestamp_epoch": "1541624763.152884000" } ], "is_private": false, "observable_id": "observable-668f20c520a82d4f171bc13f", "last_seen_epoch": "1541624763.152884000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624763.152884000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.46", "evidence": [ { "udp_stream": 74, "frame_number": 3302, "display_filter": "frame.number == 3302", "timestamp_epoch": "1541624795.441778000" }, { "udp_stream": 86, "frame_number": 3827, "display_filter": "frame.number == 3827", "timestamp_epoch": "1541624811.300199000" }, { "udp_stream": 87, "frame_number": 4501, "display_filter": "frame.number == 4501", "timestamp_epoch": "1541624853.951935000" }, { "udp_stream": 90, "frame_number": 5275, "display_filter": "frame.number == 5275", "timestamp_epoch": "1541624860.397205000" }, { "udp_stream": 91, "frame_number": 5477, "display_filter": "frame.number == 5477", "timestamp_epoch": "1541624860.547098000" } ], "is_private": false, "observable_id": "observable-00d0b56c8c27cc813e704fd6", "last_seen_epoch": "1541624860.547098000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624795.441778000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.192.67", "evidence": [ { "udp_stream": 85, "frame_number": 3706, "display_filter": "frame.number == 3706", "timestamp_epoch": "1541624810.900411000" } ], "is_private": false, "observable_id": "observable-00e6b1eab9f0fd7d4245946d", "last_seen_epoch": "1541624810.900411000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624810.900411000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-4d4ce0877215bfffa891b12a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.251", "evidence": [], "is_private": false, "observable_id": "observable-e849c5bf960dad3056d49e9e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-3dffeb9c977b31b385fe6539", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.56.194.57", "evidence": [ { "udp_stream": 99, "frame_number": 6445, "display_filter": "frame.number == 6445", "timestamp_epoch": "1541624861.327626000" } ], "is_private": false, "observable_id": "observable-a9daf1b54f3867ddcc7a6e82", "last_seen_epoch": "1541624861.327626000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.327626000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "239.255.255.250", "evidence": [ { "frame_number": 2696, "display_filter": "frame.number == 2696", "timestamp_epoch": "1541624762.197551000" }, { "frame_number": 2726, "display_filter": "frame.number == 2726", "timestamp_epoch": "1541624763.200415000" }, { "frame_number": 2739, "display_filter": "frame.number == 2739", "timestamp_epoch": "1541624764.215092000" }, { "frame_number": 2740, "display_filter": "frame.number == 2740", "timestamp_epoch": "1541624765.218107000" }, { "frame_number": 2824, "display_filter": "frame.number == 2824", "timestamp_epoch": "1541624793.957286000" }, { "frame_number": 3045, "display_filter": "frame.number == 3045", "timestamp_epoch": "1541624794.958348000" }, { "frame_number": 3435, "display_filter": "frame.number == 3435", "timestamp_epoch": "1541624795.958880000" }, { "frame_number": 3436, "display_filter": "frame.number == 3436", "timestamp_epoch": "1541624796.959614000" }, { "frame_number": 9898, "display_filter": "frame.number == 9898", "timestamp_epoch": "1541624913.892827000" }, { "frame_number": 9904, "display_filter": "frame.number == 9904", "timestamp_epoch": "1541624914.893631000" }, { "frame_number": 9905, "display_filter": "frame.number == 9905", "timestamp_epoch": "1541624915.895001000" }, { "frame_number": 9906, "display_filter": "frame.number == 9906", "timestamp_epoch": "1541624916.896692000" } ], "is_private": false, "observable_id": "observable-438b9022d048586258bde056", "last_seen_epoch": "1541624916.896692000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624762.197551000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "255.255.255.255", "evidence": [], "is_private": true, "observable_id": "observable-4c59f19e5cdbfc1b1c151005", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.192.39.141", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "is_private": false, "observable_id": "observable-36aae558a6cbd96b4ac20c18", "last_seen_epoch": "1541624861.092413000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.092413000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.192.90.231", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "is_private": false, "observable_id": "observable-a96d57583105445b7e025ce9", "last_seen_epoch": "1541624861.335497000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.335497000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.198.191.149", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "is_private": false, "observable_id": "observable-5063a8135db33567ad13441c", "last_seen_epoch": "1541624861.368818000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.368818000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.198.228.49", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "is_private": false, "observable_id": "observable-2fe4c9d090f11f4bced89b60", "last_seen_epoch": "1541624861.368818000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.368818000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.199.147.194", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "is_private": false, "observable_id": "observable-8c4625b1431bf9e62048f2e8", "last_seen_epoch": "1541624861.335497000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.335497000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.202.147.29", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "is_private": false, "observable_id": "observable-e3e861f982f1964af8a47a10", "last_seen_epoch": "1541624860.680901000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.680901000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.203.74.207", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "is_private": false, "observable_id": "observable-c42f4f0e5081de895ec60ebe", "last_seen_epoch": "1541624860.680901000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.680901000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.204.248.161", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "is_private": false, "observable_id": "observable-d3af9f2951996373301fdcfc", "last_seen_epoch": "1541624861.092413000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.092413000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.205.99.3", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "is_private": false, "observable_id": "observable-81649eae5a41469b60e29231", "last_seen_epoch": "1541624861.368818000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.368818000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.224.172.188", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "is_private": false, "observable_id": "observable-0461f6271b5f9c68eb5d5320", "last_seen_epoch": "1541624861.092413000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.092413000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.227.43.215", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "is_private": false, "observable_id": "observable-55276904c0cca8e9ef7c902b", "last_seen_epoch": "1541624861.335497000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.335497000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.236.63.37", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "is_private": false, "observable_id": "observable-d2c1c40d9e8c4b2b19307eb8", "last_seen_epoch": "1541624861.335497000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.335497000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.237.159.145", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "is_private": false, "observable_id": "observable-16300952ed8342089811711b", "last_seen_epoch": "1541624861.368818000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.368818000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.239.206.211", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "is_private": false, "observable_id": "observable-bab59c6c22f7edabb0f3d668", "last_seen_epoch": "1541624861.335497000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.335497000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.168.218.13", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "is_private": false, "observable_id": "observable-e5a3048a0a292c7d2712825b", "last_seen_epoch": "1541624861.335497000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.335497000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.168.53.247", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "is_private": false, "observable_id": "observable-64b1fee25d38f3d2c13f19ed", "last_seen_epoch": "1541624861.335497000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.335497000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.168.67.88", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "is_private": false, "observable_id": "observable-237a41d1d0424703199cacdf", "last_seen_epoch": "1541624861.335497000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.335497000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.171.180.138", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "is_private": false, "observable_id": "observable-5359461d8786517f3527f2b1", "last_seen_epoch": "1541624860.680901000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.680901000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "46.229.214.92", "evidence": [ { "udp_stream": 54, "frame_number": 2628, "display_filter": "frame.number == 2628", "timestamp_epoch": "1541624602.506125000" } ], "is_private": false, "observable_id": "observable-c8e93d4cfcd896ee9b62e06d", "last_seen_epoch": "1541624602.506125000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624602.506125000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "46.29.160.132", "evidence": [ { "udp_stream": 33, "frame_number": 1243, "display_filter": "frame.number == 1243", "timestamp_epoch": "1541623631.425241000" } ], "is_private": false, "observable_id": "observable-c3c30bb4425a57c616eceff2", "last_seen_epoch": "1541623631.425241000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623631.425241000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "50.116.194.23", "evidence": [ { "udp_stream": 93, "frame_number": 5925, "display_filter": "frame.number == 5925", "timestamp_epoch": "1541624860.792162000" } ], "is_private": false, "observable_id": "observable-0334862e1b5d13ee6652b009", "last_seen_epoch": "1541624860.792162000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.792162000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.0.244.217", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "is_private": false, "observable_id": "observable-3a5acee315413f1a53032c55", "last_seen_epoch": "1541624861.368818000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.368818000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.20.145.225", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "is_private": false, "observable_id": "observable-8d5d1f389eab9908c8d79e26", "last_seen_epoch": "1541624861.368818000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.368818000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.204.152.189", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "is_private": false, "observable_id": "observable-87f4d98eceb1b246f654b9c8", "last_seen_epoch": "1541624860.680901000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.680901000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.207.122.163", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "is_private": false, "observable_id": "observable-d9125d75bcf4d5ed0298ec84", "last_seen_epoch": "1541624861.368818000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.368818000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.208.135.160", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "is_private": false, "observable_id": "observable-3d0b7894639af765bef93085", "last_seen_epoch": "1541624861.329520000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.329520000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.210.213.208", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "is_private": false, "observable_id": "observable-bf43d7d277dbb3bf3ab9f3c9", "last_seen_epoch": "1541624861.329520000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.329520000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.210.34.59", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "is_private": false, "observable_id": "observable-48308645d80dd8350defac8b", "last_seen_epoch": "1541624861.329520000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.329520000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.213.58.51", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "is_private": false, "observable_id": "observable-fe01852081f89ba181e400bb", "last_seen_epoch": "1541624861.329520000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.329520000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.214.151.124", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "is_private": false, "observable_id": "observable-c145993b649196eb7a3aa8c7", "last_seen_epoch": "1541624861.329520000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.329520000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.30.113.91", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "is_private": false, "observable_id": "observable-abb2a3bfad9f88e2b25ea9ed", "last_seen_epoch": "1541624861.329520000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.329520000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.31.219.56", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "is_private": false, "observable_id": "observable-f344292eba6a0286ce82d581", "last_seen_epoch": "1541624861.329520000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.329520000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.4.55.137", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "is_private": false, "observable_id": "observable-7f643758348f5fe07be1474b", "last_seen_epoch": "1541624861.092413000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.092413000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.7.21.186", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "is_private": false, "observable_id": "observable-bc1ba3b8d697db9e480e94d3", "last_seen_epoch": "1541624861.368818000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.368818000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.72.190.60", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "is_private": false, "observable_id": "observable-637914063aeed587fb60a80a", "last_seen_epoch": "1541624861.092413000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.092413000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.194.108.5", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "is_private": false, "observable_id": "observable-635c6394d648b043115f8b7e", "last_seen_epoch": "1541624861.329520000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.329520000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.236.245.79", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "is_private": false, "observable_id": "observable-8caacdd683ac68ead1ce5f37", "last_seen_epoch": "1541624861.092413000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.092413000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.81.75.176", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "is_private": false, "observable_id": "observable-042756cea7f163316a81a755", "last_seen_epoch": "1541624861.092413000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.092413000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.85.197.245", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "is_private": false, "observable_id": "observable-5b47acd66181154a49b19b23", "last_seen_epoch": "1541624860.680901000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.680901000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.85.233.91", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "is_private": false, "observable_id": "observable-d8450b608418405e3788a125", "last_seen_epoch": "1541624860.680901000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.680901000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.85.96.132", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "is_private": false, "observable_id": "observable-1d7da79bbb8c0c045c69bf3e", "last_seen_epoch": "1541624860.680901000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.680901000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.86.197.0", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "is_private": false, "observable_id": "observable-61b2fd9ec287fb2a38e01447", "last_seen_epoch": "1541624860.680901000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.680901000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "62.149.140.59", "evidence": [ { "udp_stream": 52, "frame_number": 2551, "display_filter": "frame.number == 2551", "timestamp_epoch": "1541624403.692275000" }, { "udp_stream": 53, "frame_number": 2560, "display_filter": "frame.number == 2560", "timestamp_epoch": "1541624404.222937000" } ], "is_private": false, "observable_id": "observable-1f22579e90fc92c7afba86e1", "last_seen_epoch": "1541624404.222937000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624403.692275000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "63.251.240.12", "evidence": [ { "udp_stream": 102, "frame_number": 6456, "display_filter": "frame.number == 6456", "timestamp_epoch": "1541624861.362801000" } ], "is_private": false, "observable_id": "observable-de949209917a7096fd60b219", "last_seen_epoch": "1541624861.362801000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624861.362801000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.218.86.51", "evidence": [ { "udp_stream": 31, "frame_number": 685, "display_filter": "frame.number == 685", "timestamp_epoch": "1541623305.080372000" } ], "is_private": false, "observable_id": "observable-175f80099b2abc96ee4ea3eb", "last_seen_epoch": "1541623305.080372000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623305.080372000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.246.64.147", "evidence": [ { "udp_stream": 51, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1541623798.576317000" } ], "is_private": false, "observable_id": "observable-d5d5ec59c6e8f76eb497e155", "last_seen_epoch": "1541623798.576317000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623798.576317000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.246.64.187", "evidence": [ { "udp_stream": 24, "frame_number": 424, "display_filter": "frame.number == 424", "timestamp_epoch": "1541623252.644208000" } ], "is_private": false, "observable_id": "observable-7a9bfce6cc5e3f74286ce188", "last_seen_epoch": "1541623252.644208000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623252.644208000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "72.246.64.227", "evidence": [ { "udp_stream": 24, "frame_number": 424, "display_filter": "frame.number == 424", "timestamp_epoch": "1541623252.644208000" } ], "is_private": false, "observable_id": "observable-2a80492895b8dc9f70b838ec", "last_seen_epoch": "1541623252.644208000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623252.644208000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "72.246.64.48", "evidence": [ { "udp_stream": 51, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1541623798.576317000" } ], "is_private": false, "observable_id": "observable-a2e944d6a0f34c63dc9a18aa", "last_seen_epoch": "1541623798.576317000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623798.576317000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "72.45.33.49", "evidence": [ { "udp_stream": 48, "frame_number": 2245, "display_filter": "frame.number == 2245", "timestamp_epoch": "1541623797.426200000" } ], "is_private": false, "observable_id": "observable-cddf6b6870d0c6f3920d7e2b", "last_seen_epoch": "1541623797.426200000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623797.426200000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.6.141.28", "evidence": [ { "udp_stream": 31, "frame_number": 685, "display_filter": "frame.number == 685", "timestamp_epoch": "1541623305.080372000" } ], "is_private": false, "observable_id": "observable-5fae8a8fc5e16aadb921ea24", "last_seen_epoch": "1541623305.080372000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623305.080372000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.6.141.50", "evidence": [ { "udp_stream": 32, "frame_number": 1029, "display_filter": "frame.number == 1029", "timestamp_epoch": "1541623379.015119000" } ], "is_private": false, "observable_id": "observable-37aa9523f7ebb6f58a96a4a0", "last_seen_epoch": "1541623379.015119000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623379.015119000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "93.184.216.182", "evidence": [ { "udp_stream": 106, "frame_number": 9070, "display_filter": "frame.number == 9070", "timestamp_epoch": "1541624907.820322000" } ], "is_private": false, "observable_id": "observable-3f7aa774d41205e14974187a", "last_seen_epoch": "1541624907.820322000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624907.820322000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "95.181.198.115", "evidence": [ { "udp_stream": 50, "frame_number": 2252, "display_filter": "frame.number == 2252", "timestamp_epoch": "1541623797.918025000" } ], "is_private": false, "observable_id": "observable-52c9a568bf49a162bc149d24", "last_seen_epoch": "1541623797.918025000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623797.918025000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "95.181.198.116", "evidence": [], "is_private": false, "observable_id": "observable-750a4ec20c4568ef5fb26567", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv6", "roles": [ "dns-answer" ], "value": "fd3e:4f5a:5b81::1", "evidence": [ { "udp_stream": 30, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1541623291.810157000" }, { "udp_stream": 35, "frame_number": 1700, "display_filter": "frame.number == 1700", "timestamp_epoch": "1541623657.523396000" } ], "is_private": true, "observable_id": "observable-a847ced3c6a38e63a5a68f58", "last_seen_epoch": "1541623657.523396000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623291.810157000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "14eff09463c9d6dc6e14e954eba239c2", "evidence": [ { "tcp_stream": 78, "frame_number": 2723, "display_filter": "frame.number == 2723", "timestamp_epoch": "1541624763.173519000" }, { "tcp_stream": 79, "frame_number": 2747, "display_filter": "frame.number == 2747", "timestamp_epoch": "1541624767.495250000" }, { "tcp_stream": 82, "frame_number": 2840, "display_filter": "frame.number == 2840", "timestamp_epoch": "1541624794.508880000" }, { "tcp_stream": 83, "frame_number": 2844, "display_filter": "frame.number == 2844", "timestamp_epoch": "1541624794.519353000" }, { "tcp_stream": 87, "frame_number": 3036, "display_filter": "frame.number == 3036", "timestamp_epoch": "1541624794.952834000" }, { "tcp_stream": 86, "frame_number": 3040, "display_filter": "frame.number == 3040", "timestamp_epoch": "1541624794.954277000" }, { "tcp_stream": 89, "frame_number": 3306, "display_filter": "frame.number == 3306", "timestamp_epoch": "1541624795.471389000" }, { "tcp_stream": 90, "frame_number": 3422, "display_filter": "frame.number == 3422", "timestamp_epoch": "1541624795.684426000" }, { "tcp_stream": 93, "frame_number": 3711, "display_filter": "frame.number == 3711", "timestamp_epoch": "1541624810.915240000" }, { "tcp_stream": 96, "frame_number": 3841, "display_filter": "frame.number == 3841", "timestamp_epoch": "1541624811.316700000" }, { "tcp_stream": 95, "frame_number": 3848, "display_filter": "frame.number == 3848", "timestamp_epoch": "1541624811.318524000" }, { "tcp_stream": 94, "frame_number": 3850, "display_filter": "frame.number == 3850", "timestamp_epoch": "1541624811.318892000" }, { "tcp_stream": 97, "frame_number": 3852, "display_filter": "frame.number == 3852", "timestamp_epoch": "1541624811.319555000" }, { "tcp_stream": 98, "frame_number": 3854, "display_filter": "frame.number == 3854", "timestamp_epoch": "1541624811.319863000" }, { "tcp_stream": 99, "frame_number": 3858, "display_filter": "frame.number == 3858", "timestamp_epoch": "1541624811.322264000" }, { "tcp_stream": 110, "frame_number": 5280, "display_filter": "frame.number == 5280", "timestamp_epoch": "1541624860.423381000" }, { "tcp_stream": 112, "frame_number": 5843, "display_filter": "frame.number == 5843", "timestamp_epoch": "1541624860.734280000" }, { "tcp_stream": 113, "frame_number": 5895, "display_filter": "frame.number == 5895", "timestamp_epoch": "1541624860.759852000" }, { "tcp_stream": 114, "frame_number": 5923, "display_filter": "frame.number == 5923", "timestamp_epoch": "1541624860.790028000" }, { "tcp_stream": 115, "frame_number": 5936, "display_filter": "frame.number == 5936", "timestamp_epoch": "1541624860.797458000" } ], "is_private": null, "observable_id": "observable-6f5c937e62561d767cbb6fa6", "last_seen_epoch": "1541624908.366512000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624763.173519000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "1d095e68489d3c535297cd8dffb06cb9", "evidence": [ { "tcp_stream": 44, "frame_number": 689, "display_filter": "frame.number == 689", "timestamp_epoch": "1541623305.152933000" }, { "tcp_stream": 45, "frame_number": 717, "display_filter": "frame.number == 717", "timestamp_epoch": "1541623306.028695000" }, { "tcp_stream": 48, "frame_number": 1033, "display_filter": "frame.number == 1033", "timestamp_epoch": "1541623379.090748000" }, { "tcp_stream": 49, "frame_number": 1131, "display_filter": "frame.number == 1131", "timestamp_epoch": "1541623531.994660000" }, { "tcp_stream": 50, "frame_number": 1190, "display_filter": "frame.number == 1190", "timestamp_epoch": "1541623552.063814000" } ], "is_private": null, "observable_id": "observable-0aa4eefa73626377b14dbe01", "last_seen_epoch": "1541623552.063814000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623305.152933000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "4d7a28d6f2263ed61de88ca66eb011e3", "evidence": [ { "tcp_stream": 57, "frame_number": 2256, "display_filter": "frame.number == 2256", "timestamp_epoch": "1541623798.099564000" }, { "tcp_stream": 59, "frame_number": 2335, "display_filter": "frame.number == 2335", "timestamp_epoch": "1541623799.430172000" }, { "tcp_stream": 60, "frame_number": 2354, "display_filter": "frame.number == 2354", "timestamp_epoch": "1541623810.459537000" }, { "tcp_stream": 61, "frame_number": 2380, "display_filter": "frame.number == 2380", "timestamp_epoch": "1541623999.415441000" }, { "tcp_stream": 62, "frame_number": 2395, "display_filter": "frame.number == 2395", "timestamp_epoch": "1541624000.439640000" }, { "tcp_stream": 64, "frame_number": 2440, "display_filter": "frame.number == 2440", "timestamp_epoch": "1541624200.447606000" }, { "tcp_stream": 65, "frame_number": 2455, "display_filter": "frame.number == 2455", "timestamp_epoch": "1541624201.459241000" }, { "tcp_stream": 66, "frame_number": 2472, "display_filter": "frame.number == 2472", "timestamp_epoch": "1541624212.416891000" }, { "tcp_stream": 67, "frame_number": 2495, "display_filter": "frame.number == 2495", "timestamp_epoch": "1541624223.761992000" }, { "tcp_stream": 68, "frame_number": 2523, "display_filter": "frame.number == 2523", "timestamp_epoch": "1541624401.469751000" }, { "tcp_stream": 69, "frame_number": 2538, "display_filter": "frame.number == 2538", "timestamp_epoch": "1541624402.562901000" }, { "tcp_stream": 72, "frame_number": 2573, "display_filter": "frame.number == 2573", "timestamp_epoch": "1541624414.707664000" }, { "tcp_stream": 73, "frame_number": 2600, "display_filter": "frame.number == 2600", "timestamp_epoch": "1541624425.693132000" }, { "tcp_stream": 74, "frame_number": 2632, "display_filter": "frame.number == 2632", "timestamp_epoch": "1541624602.665026000" }, { "tcp_stream": 75, "frame_number": 2654, "display_filter": "frame.number == 2654", "timestamp_epoch": "1541624603.809458000" }, { "tcp_stream": 76, "frame_number": 2673, "display_filter": "frame.number == 2673", "timestamp_epoch": "1541624614.990563000" }, { "tcp_stream": 141, "frame_number": 10188, "display_filter": "frame.number == 10188", "timestamp_epoch": "1541625603.803940000" }, { "tcp_stream": 142, "frame_number": 10203, "display_filter": "frame.number == 10203", "timestamp_epoch": "1541625614.954030000" } ], "is_private": null, "observable_id": "observable-b5ccd92ef2a91f82acea1fae", "last_seen_epoch": "1541625614.954030000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623798.099564000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "656854b0e07f676ae44f8d559744be60", "evidence": [ { "tcp_stream": 77, "frame_number": 2705, "display_filter": "frame.number == 2705", "timestamp_epoch": "1541624762.900485000" }, { "tcp_stream": 80, "frame_number": 2794, "display_filter": "frame.number == 2794", "timestamp_epoch": "1541624778.242052000" }, { "tcp_stream": 81, "frame_number": 2828, "display_filter": "frame.number == 2828", "timestamp_epoch": "1541624794.379580000" }, { "tcp_stream": 84, "frame_number": 2966, "display_filter": "frame.number == 2966", "timestamp_epoch": "1541624794.830765000" }, { "tcp_stream": 101, "frame_number": 4489, "display_filter": "frame.number == 4489", "timestamp_epoch": "1541624853.888354000" }, { "tcp_stream": 102, "frame_number": 4505, "display_filter": "frame.number == 4505", "timestamp_epoch": "1541624853.969898000" }, { "tcp_stream": 111, "frame_number": 5485, "display_filter": "frame.number == 5485", "timestamp_epoch": "1541624860.563916000" }, { "tcp_stream": 136, "frame_number": 9359, "display_filter": "frame.number == 9359", "timestamp_epoch": "1541624908.372161000" }, { "tcp_stream": 139, "frame_number": 9364, "display_filter": "frame.number == 9364", "timestamp_epoch": "1541624908.372476000" }, { "tcp_stream": 135, "frame_number": 9366, "display_filter": "frame.number == 9366", "timestamp_epoch": "1541624908.372709000" }, { "tcp_stream": 137, "frame_number": 9368, "display_filter": "frame.number == 9368", "timestamp_epoch": "1541624908.372911000" }, { "tcp_stream": 138, "frame_number": 9370, "display_filter": "frame.number == 9370", "timestamp_epoch": "1541624908.373123000" } ], "is_private": null, "observable_id": "observable-a530847f5c385f852923543b", "last_seen_epoch": "1541624908.373123000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624762.900485000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "bd05542435b3f44f31461cdd7ddc94b8", "evidence": [ { "tcp_stream": 85, "frame_number": 2980, "display_filter": "frame.number == 2980", "timestamp_epoch": "1541624794.886781000" } ], "is_private": null, "observable_id": "observable-b3aeede7d4aadc9eac39ce5d", "last_seen_epoch": "1541624794.886781000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624794.886781000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "e25044a54b6fbc8ba81f95563dd201c3", "evidence": [ { "tcp_stream": 88, "frame_number": 3048, "display_filter": "frame.number == 3048", "timestamp_epoch": "1541624794.961269000" }, { "tcp_stream": 91, "frame_number": 3576, "display_filter": "frame.number == 3576", "timestamp_epoch": "1541624810.118090000" }, { "tcp_stream": 92, "frame_number": 3590, "display_filter": "frame.number == 3590", "timestamp_epoch": "1541624810.149072000" }, { "tcp_stream": 100, "frame_number": 4467, "display_filter": "frame.number == 4467", "timestamp_epoch": "1541624844.620256000" } ], "is_private": null, "observable_id": "observable-67c536222ee9ef5a80ed362c", "last_seen_epoch": "1541624844.620256000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624794.961269000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "009d4cdb69f30688198c7a19b25ef0667c5f7b172d65b2273ed2274bc8eb5425", "evidence": [], "is_private": null, "observable_id": "observable-dba90df3dbc48406ba4d1b3a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "022d0a09ef989821ccf3e8bd48be89355052024fc688fe3c4c84c3da00a6e082", "evidence": [], "is_private": null, "observable_id": "observable-3d39863ed6cb5b6e89176b46", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "02717a94a92b22f6715c10f1483a4b252f61bd705675ae250af5411ff01de437", "evidence": [], "is_private": null, "observable_id": "observable-05803f057140ea5177605c2e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "05d5af0ab07517396f53c3e161f0ebc23c09242eae0c2372d7da26dd5786953e", "evidence": [], "is_private": null, "observable_id": "observable-3d936a86a11b17f6b18bff8f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "0ba2f6756001669bdf934f9d79e8fd1ccf2028130c33a0510279581ec9dfd73a", "evidence": [], "is_private": null, "observable_id": "observable-c962ad1ad6f4f56986be2d55", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "0c6da6b5d4f5db2accb9c1847cd2686c683d0875750b069f14339c5f75c93029", "evidence": [], "is_private": null, "observable_id": "observable-2629b953cbafd24b26cc21c5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "10570ac15a02224c4743309c48c8b8eefeaa931d9f1db7238edd7b3fa6cd2ff7", "evidence": [], "is_private": null, "observable_id": "observable-9190e50a937f7382940b8897", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "11065daca98f9840f58be03dd0fa78c710b9509ad517857acacf715c491de6d6", "evidence": [], "is_private": null, "observable_id": "observable-8fc4c5a21b5077f013c9d40a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f", "evidence": [], "is_private": null, "observable_id": "observable-49e7fc1b6ac7226959d94b17", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1519c5e27fa45f1ceb90ae78923c474e3f5597d45e6a8c61ad73367a432333b8", "evidence": [], "is_private": null, "observable_id": "observable-c74b89c3722a8a04a0b43646", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "158494850d445b90585ee2d25e2969b3218808ccb0897c79ca240f7c3556d92b", "evidence": [], "is_private": null, "observable_id": "observable-360096253ad148edb5f7cf03", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "185f2b901d68c7451a492d90ed38aa2c1de840061735a06836c2587f958ed31c", "evidence": [], "is_private": null, "observable_id": "observable-707f5b38e3e2f4bdc68ebbb3", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "190a90d96675f28bb6ab1bab072f3b61ec321af3a8c3843a70248d9bb71bcdfe", "evidence": [], "is_private": null, "observable_id": "observable-d17f63fea1dfcbdac44d8d36", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "198f44920d0d51bc49281f580acc760fd88a96e2422c8784114df6dab93ecc09", "evidence": [], "is_private": null, "observable_id": "observable-9a110cb010e47d0ecdcdee9f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "19fda88c2df63d85b7762799904408d0703f7efe7d6956d70c776458075747f3", "evidence": [], "is_private": null, "observable_id": "observable-965f002a708861a6ef35c162", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "20f3807f724bf5bb6c8a2cf7f62bc8003717104ef480c7dfd1b8dab767144bbc", "evidence": [], "is_private": null, "observable_id": "observable-e6568fb4359a07c59863e2c4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2453e31f9c5e0dbee528d11f97a85edf897ed93406954ce8e475f0244abf249a", "evidence": [], "is_private": null, "observable_id": "observable-ba88b51b69ded7cd01450392", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "24e819821e2f9afcfed4ad0e8490935378abfb0df723850078e731cfd9ef6edd", "evidence": [], "is_private": null, "observable_id": "observable-0413d87d41ad0e97055b56b0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "25d7dc2c15716821face8630fbf2c166969dc0852e19c822e07982ea512da981", "evidence": [], "is_private": null, "observable_id": "observable-8a280a9d89a1da1829dcd87b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2976d80beac91eed779d1f204cb2e1be813c53bb2e1dfe03334f2c30b4f995be", "evidence": [], "is_private": null, "observable_id": "observable-a787d4b7a6ad68c2fc2ba933", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2e2e544728c5e5f5cfdc9ad2faf6063af99088e1c3edc32e5074e7ad541c18a0", "evidence": [], "is_private": null, "observable_id": "observable-89784d2a9f78e1283cfb4e34", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "36d8e52a141bc54658ed41dde1654343bbd008af29f889f6e0a2f41441457ba6", "evidence": [], "is_private": null, "observable_id": "observable-2dca0b1460e3377b5d33c407", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "37e9250c18e218e58fb1818a608e9ad463a4b4743ebf3c08ca738001cc8970e0", "evidence": [], "is_private": null, "observable_id": "observable-2b1a586e85f861c991c80ee5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "398cea3dc83051c117a65a9897bd17c84dace5d700ecd01943d1e47af57b5490", "evidence": [], "is_private": null, "observable_id": "observable-c642e3e67bb205b2d4a6355f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3c19c9d085f085252c974a1ae0637fa809cf09d3c461c64cbae6a011f7d0b78a", "evidence": [], "is_private": null, "observable_id": "observable-3734e0a84465c84950b1813f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3cd1a2527c206665892f1e9837f4e7cff960d7e5fa9df017c7b49e84845c0097", "evidence": [], "is_private": null, "observable_id": "observable-6e6f45a18c164450f71aee7f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4004293f081201ead3df6f86daa9d3974bde048ae8187cda602dffb256324124", "evidence": [], "is_private": null, "observable_id": "observable-b0fbdffde052a52558078e98", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "46868c166bdd75230bd20064033f281d2d6ca30a512eee717871dac9da416955", "evidence": [], "is_private": null, "observable_id": "observable-ac3297cbabd7340810f09eb1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4935fdc24e4a4873c078817732e45651c05091b946eff4fb774476a31d52e769", "evidence": [], "is_private": null, "observable_id": "observable-5704d3efe250ee2a5c32f85b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4e3d1cd476ae289fb9a9f4ce26b781659410914c81d11b4befc7735f4c71b2b1", "evidence": [], "is_private": null, "observable_id": "observable-5a7753556598a85eb124b487", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "517319eb8ff3d0b11dc60d148babdc714087e386977101e1d76428cdbff6b9c7", "evidence": [], "is_private": null, "observable_id": "observable-757d6f5410c57e42147362e8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "550ceb9559bb4237527909ff21e719804f6b9df337f741f756821c0c9963392b", "evidence": [], "is_private": null, "observable_id": "observable-109fd89e4573912aec62aba2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "561ffc13ce19398e938a84992b3791d95e9d6f7b904e3f79c9728dc0c23a8297", "evidence": [], "is_private": null, "observable_id": "observable-373c0e9d969fb41a3785b167", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "56bbf5dbefa7919f0b8666d9cfc272b0ddbc9e920a373c1ab701d960dc09ce3a", "evidence": [], "is_private": null, "observable_id": "observable-55ff1fca1270e6ab67083395", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "58c778f59b121390544d07cc4ff6948eb35045eafe376247ef285d4f72cfe167", "evidence": [], "is_private": null, "observable_id": "observable-bd555395ad468d006faa0556", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5b107e17113a4c5a547d98a30bcd47aa3ad52317856828c762a67fda9f34baa0", "evidence": [], "is_private": null, "observable_id": "observable-8c0da513bcfd5ccc427db6ca", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5c9486d0aa62b50180e77e62b15f9977b3b0fd3f7d9b1f797de4c41b7da02b7d", "evidence": [], "is_private": null, "observable_id": "observable-23e1f495b2e41baac57a77f6", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5fedc714f715123098edf3d8ceffcc6f6c1d503513e3dee6077c0fb3a6fcdbec", "evidence": [], "is_private": null, "observable_id": "observable-adc148ebe12cc329dbf94409", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [], "is_private": null, "observable_id": "observable-a61a641025e0c366165a5f1a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "61f39b4c6a88443103c0260f69dfc9484012f6bddad680b567c3ababcf416b4e", "evidence": [], "is_private": null, "observable_id": "observable-c30345c9eb0f29185a48adfe", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "65f5df3cd45f3b8bf27731651a76b32bdef821fdb79451fa160ee55ff30467e2", "evidence": [], "is_private": null, "observable_id": "observable-da6ae9cc1d75e4c6b7f8226b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6cba436e9e5adbe296a382ece4309eb469ec3a0d37d3b14058800f9fd57338ab", "evidence": [], "is_private": null, "observable_id": "observable-633b716aa40589397583cfc7", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6f7307aed5e6e60222ef7d66e258362e1df71eabd5f7af0f33afa0fc6b8f65dd", "evidence": [], "is_private": null, "observable_id": "observable-f05b30b3f2289d80cebec292", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "71ea89144415bcb2ea2585d7a5ca95b27ab2a10d7f826647bee8c9e78922c5a5", "evidence": [], "is_private": null, "observable_id": "observable-431427755d624a5b68b2a65e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "72c3d8a0ee2408bcb595f51ec68806252c9b60a6be25b091f1d0a88655517f12", "evidence": [], "is_private": null, "observable_id": "observable-d4b9b0cdece8dc1d3a4ed573", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7796b5c1eb8d9c8a896b17db41ae969690f2924a8690439ac4d5511935b236c3", "evidence": [], "is_private": null, "observable_id": "observable-4ddc4a97e98881564c48f3c6", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "79ff1591234ea9434d7f96516781130625b1880ba4fa8eb965b278337e11f8ae", "evidence": [], "is_private": null, "observable_id": "observable-5196dcb8050c21df8409a99a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7bacd1e07f7de2e51fcd1eafbcd9ec0aaad5c16ac4c4d846a86a5654a00506b4", "evidence": [], "is_private": null, "observable_id": "observable-e3c4cf8100ab028800e504f7", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7df7e6f7c22f1938c2313beb743eb60040f607f2a703a5134c8842ce7e7946ab", "evidence": [], "is_private": null, "observable_id": "observable-1e3bfc95e633eff9cd4af48e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7e0baff43a753a2dce0e85dbbd562a503c9f558f846784f3626c0b5d31c9d6d3", "evidence": [], "is_private": null, "observable_id": "observable-d9146839524cf1a0e5e44021", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "80bad0ee862dd92912bbecb161c17ce3d072b22aef1d48c3ab4c90f55939acae", "evidence": [], "is_private": null, "observable_id": "observable-78ea2da7ebef3d6af7671ff2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015", "evidence": [], "is_private": null, "observable_id": "observable-9c00a7cbc1127858732800ac", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "833aae2efa9e7eb97334c8596c07bd22c09ffa2e771dc64fadcfa66d2ed2330e", "evidence": [], "is_private": null, "observable_id": "observable-3de3dee2f2286414a98d19f4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "86a4c543d749c972e930c08df70d17f81c7eae19ea9854476eda897fd33fbfc5", "evidence": [], "is_private": null, "observable_id": "observable-dc539e2e53dda1c834b32a45", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8768d73b262d33c7dceaedcbf83576d31129c8bef0d03be58e92a57a65bd81c2", "evidence": [], "is_private": null, "observable_id": "observable-bb0f4fd6b599a1df4bb1e63e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8b6eb285d3afcd5e4d485846c70b442f4b6df4a636533493a6b45ff4808c8364", "evidence": [], "is_private": null, "observable_id": "observable-8fb9a286794024771f820c02", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8ba51e69c99c8a2fee83d5cd85f86d044a51c9979f845ca6abf75901ad83f84c", "evidence": [], "is_private": null, "observable_id": "observable-0d733468c3d00c31850db7c7", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9145ac411c9596c70f7a57d91ddf00f4888aae4d852209ed6efdf99afad1f904", "evidence": [], "is_private": null, "observable_id": "observable-dc954f3cad0b3183fe7c5d4e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9557385d62733e77c3bb5b473d9bb2fa29bd51f8b010d221cbefe8297a454291", "evidence": [], "is_private": null, "observable_id": "observable-6f419b0434a061a755e4695a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "97f149f146b0ec63c32abff204ae27638f0310536172b0f718f1a91a5672fe71", "evidence": [], "is_private": null, "observable_id": "observable-d84934048cf597232891d317", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9a4e9990d71244aaa68b4bff6d5910665e7df9051cd4ee030e61b8e7f16180c1", "evidence": [], "is_private": null, "observable_id": "observable-5a0d94747b314d8d3b46e5cc", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9be5b65b630c074027b64f5544e24575e36aba498ee43b12167e82b40872e01f", "evidence": [], "is_private": null, "observable_id": "observable-5dfe4dabaa0aae2877f00d8d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9c086d962c942cff645dbd48b700191e96e3371b3d006e4eb3c7ac3c842057c9", "evidence": [], "is_private": null, "observable_id": "observable-e08f820be93834e7fb47e99b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9c16b72304e8dbf5ddce0e0614934eac07d641ef12c654398eda8df088f3c296", "evidence": [], "is_private": null, "observable_id": "observable-9e69eebce2567c4eaf728987", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9d7c79b24ac12a185212ccab8741f4acdbd7ab160099e719bedd682806886ac9", "evidence": [], "is_private": null, "observable_id": "observable-8c88451fb1913a18dd4580d0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a417a78e9d645ffa38f11bbcd1e4bdd0295bb71e5a7dfd692b3495dac2ef4107", "evidence": [], "is_private": null, "observable_id": "observable-d7896a8e1efc637b561dc13e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a630dac9b5b0fbea3974ad09401522aeda12f11bbe5344508829d575c03cd644", "evidence": [], "is_private": null, "observable_id": "observable-aad877860927a75d909e1473", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c", "evidence": [], "is_private": null, "observable_id": "observable-2fe260de13b10d4960d2451c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ac508fa266db568a28c4e52d7dd1fcc85dbfdc38f97e39892e60f94d904e11d5", "evidence": [], "is_private": null, "observable_id": "observable-ca1588f39b96b83cd0251bae", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b24190e46072d124308b908776b21a50d4cefa396934bf5fb788bf26c2e67c33", "evidence": [], "is_private": null, "observable_id": "observable-920519a2d890fbe34f26c0a2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b2aba18ac53e4abc1a631c98959e5411fc64efe761dbe216e1f559b1e2d7aef2", "evidence": [], "is_private": null, "observable_id": "observable-4bd681bda4dd5af8825cdb03", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b43e75f48fa68b71ee6e66751c0c3822314ca6dc592fce9309495baada78de54", "evidence": [], "is_private": null, "observable_id": "observable-9fa2e5d5eba6174221797cce", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b5fcfa087b1cc0b1f61c17437c0a533c027dd68bb1e42898682bad189bacdf67", "evidence": [], "is_private": null, "observable_id": "observable-8efd3f188ee2fb742f8a9fdf", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b729bb6d682bc3df8fb04c7a940b3da0140284811d168a92929cfec7232237be", "evidence": [], "is_private": null, "observable_id": "observable-084d5dacb132a63c6f0472d9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b74056eea98bad621835b90b80499dad886c07ef70b5213bcde0408e63908c6f", "evidence": [], "is_private": null, "observable_id": "observable-31ed6f1cfb021b5f88bc0e2e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b943dd2830226be743c9bfcb5ffa4eec591e55d09a736ffecdfd3d8b6581da31", "evidence": [], "is_private": null, "observable_id": "observable-b560c069a4053dfc9b0ed976", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "bd9ea8a38face9cb05cb209900b16b09b3bda1c247ddd7d2e2c95a82a3615cd3", "evidence": [], "is_private": null, "observable_id": "observable-6024d4d914088974e2db78e3", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "bfedb831c9a4afb407a127b04080c8f649d2134e713d4a1f810d9f670295cf7d", "evidence": [], "is_private": null, "observable_id": "observable-9fa85d6da593203531ed2526", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c4d8dbe77feb63e5a61bee0bead4e5f66e8fa6a927599bd1b74aced52467273c", "evidence": [], "is_private": null, "observable_id": "observable-576a2e73288d57b70ed6f000", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c4e63117b5fac36c75799cae97f4f0464bd9d6978b442fe6cf28078d0be7ac31", "evidence": [], "is_private": null, "observable_id": "observable-ee1668516c1bdb6002d59832", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c8e9a8b2cf530cc873941944744e8d053a34d2759194dae198e579c9e17399a2", "evidence": [], "is_private": null, "observable_id": "observable-bb2f58c47ed1d3f5854a15d3", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ca0405f6832d0b1aaf7e5c00aa3241cccf19859dc47ca15ab3a90a9ffcbdf150", "evidence": [], "is_private": null, "observable_id": "observable-58a647220ad784a501e80f8b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "cbf768030ad75e8aec0263d9d2286c2b0106cf7ac4daa17396129b172a93d1a9", "evidence": [], "is_private": null, "observable_id": "observable-9e438367c403e3736556685e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d2e3bd61e7e0d4f908192813267d98927cc31043d84387b1a941e3b5b15f9134", "evidence": [], "is_private": null, "observable_id": "observable-d00d6d4971cf8ac3b91d3296", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8", "evidence": [], "is_private": null, "observable_id": "observable-0a2b1ed7b1eacde687b7a739", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d60aea1fe282db3ac579713c98d24d46850375db28ccfec0793d10f275b860a5", "evidence": [], "is_private": null, "observable_id": "observable-34b5de7d93c9a95475509fb5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d78b0583ff00e0b8e6caac5c236fdf795fd447208cfea7f23abd528a26a57674", "evidence": [], "is_private": null, "observable_id": "observable-3fb263b544bb6ffc5344afb7", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d7db23ac49a03eb060bc6a928b5a9044218bed6c7add87406b8867f95938aef5", "evidence": [], "is_private": null, "observable_id": "observable-77e3e32a43eb980bc8407e49", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d9f5dfcc2555a6e6c530c190b3c6f1cac2a0af97b3689547713dc28bece0e7cd", "evidence": [], "is_private": null, "observable_id": "observable-3e6dee4603a4515a01a1b84a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "da725c97aae07686110485c776b5ebb1733fb26674466d07417aa2ee3c0e09a9", "evidence": [], "is_private": null, "observable_id": "observable-c340ae34853cbae3a209a7fe", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e1f409fdaac72c188fa638ac4be1958322f1dfe8b2b7b076c4ff95f026f47a4f", "evidence": [], "is_private": null, "observable_id": "observable-251d92daa1642f0cd20f4b33", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e2f4ebe008e4e29b0695a4cf033f5bc45d5ab70ca43bf0873580a7c4fd500b96", "evidence": [], "is_private": null, "observable_id": "observable-fd1c26e0683d30fed520661d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "evidence": [], "is_private": null, "observable_id": "observable-028c237b3954c205b9934386", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ea34443271cb87b667af587dc8b344c211458dc0616abdf48a49b14c4fde9b1a", "evidence": [], "is_private": null, "observable_id": "observable-04ed2e8882f508cf668ab27c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ea99682af1f2ca9bb54887a9cc1ced7c09b2f6d7feb277f2c3d6f3b57af25fc1", "evidence": [], "is_private": null, "observable_id": "observable-061616a527b9ec92c0732d58", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "eac280b1fd4d84b2b386d93b51f9193c42f10fe9c3cb0dd1e67ebff66fd31952", "evidence": [], "is_private": null, "observable_id": "observable-519602f6803c93faf1a8e088", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ec8202663864f3744450858c1e5a51826427b7b7b082b5d182d7be0dc47f2c4e", "evidence": [], "is_private": null, "observable_id": "observable-7a5602226c3d6f390a50b4a7", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8", "evidence": [], "is_private": null, "observable_id": "observable-18c203cf07fd695d7074e1f9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5", "evidence": [], "is_private": null, "observable_id": "observable-70c828998254a9d052a2a829", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f099877e9778681f5ca0c77b7f18b5aa675caa6d5cd50abc28dfe6136ac3b8ac", "evidence": [], "is_private": null, "observable_id": "observable-74b7918234c860d38de8884c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f4fbf7d12ec5db69f6a21a8323602fe7e8aa8c4f59baea6115fe1323c3e1358f", "evidence": [], "is_private": null, "observable_id": "observable-968a9d6a9f86004e0ac9985d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f9985bf8754e921e90a0c63e3458daf79c492f25bbaf3cf13bb14d18ca27fd5a", "evidence": [], "is_private": null, "observable_id": "observable-8df30cf259f32485b3c2653a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "fb229f5700cae4392b42fe23e328ba5e697a7c84f4678670791a22ead70a9d09", "evidence": [], "is_private": null, "observable_id": "observable-cc2f044d30d3473e13e66706", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c", "evidence": [], "is_private": null, "observable_id": "observable-60db55451937af26d00bbde2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ff7d32dd7321a2b3c5597c69caae82409019ac22e11ecc4530188d4e3b144302", "evidence": [], "is_private": null, "observable_id": "observable-d3f02fb8377d6f8d75adce17", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ff8619dad2bbbf61330224649844a7ff7665785c3f174913729961d77ba5facc", "evidence": [], "is_private": null, "observable_id": "observable-f66568abef937334bbaf548b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://239.255.255.250:1900*", "evidence": [ { "frame_number": 2696, "display_filter": "frame.number == 2696", "timestamp_epoch": "1541624762.197551000" }, { "frame_number": 2726, "display_filter": "frame.number == 2726", "timestamp_epoch": "1541624763.200415000" }, { "frame_number": 2739, "display_filter": "frame.number == 2739", "timestamp_epoch": "1541624764.215092000" }, { "frame_number": 2740, "display_filter": "frame.number == 2740", "timestamp_epoch": "1541624765.218107000" }, { "frame_number": 2824, "display_filter": "frame.number == 2824", "timestamp_epoch": "1541624793.957286000" }, { "frame_number": 3045, "display_filter": "frame.number == 3045", "timestamp_epoch": "1541624794.958348000" }, { "frame_number": 3435, "display_filter": "frame.number == 3435", "timestamp_epoch": "1541624795.958880000" }, { "frame_number": 3436, "display_filter": "frame.number == 3436", "timestamp_epoch": "1541624796.959614000" }, { "frame_number": 9898, "display_filter": "frame.number == 9898", "timestamp_epoch": "1541624913.892827000" }, { "frame_number": 9904, "display_filter": "frame.number == 9904", "timestamp_epoch": "1541624914.893631000" }, { "frame_number": 9905, "display_filter": "frame.number == 9905", "timestamp_epoch": "1541624915.895001000" }, { "frame_number": 9906, "display_filter": "frame.number == 9906", "timestamp_epoch": "1541624916.896692000" } ], "is_private": null, "observable_id": "observable-4b77edc823018a17403b9a52", "last_seen_epoch": "1541624916.896692000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624762.197551000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://dhsiwyqdlskwsqo.com/favicon.ico", "evidence": [ { "tcp_stream": 53, "frame_number": 1939, "display_filter": "frame.number == 1939", "timestamp_epoch": "1541623727.157447000" } ], "is_private": null, "observable_id": "observable-6b83d005e4ae7c3d45331921", "last_seen_epoch": "1541623727.157447000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623727.157447000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://dhsiwyqdlskwsqo.com/images/oHxu3OjFB6DuXsB336/xwuexjnHY/P5VoU9fs1NStyMFZ_2FZ/6s8umkBGsQOSsZgZiqQ/Jnp65UJ_2B9Qq9qo_2BCxl/LpqyFXF9TVVz_/2BLffdp3/TW_2B64CmxBQ7r03un00c1o/B2mvu2ig9G/7GcZJn_2FNTO8/6Kwy7mw.avi", "evidence": [ { "tcp_stream": 56, "frame_number": 1955, "display_filter": "frame.number == 1955", "timestamp_epoch": "1541623728.369908000" } ], "is_private": null, "observable_id": "observable-640682a504a70121fa02aa20", "last_seen_epoch": "1541623728.369908000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623728.369908000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://dhsiwyqdlskwsqo.com/images/Owsg6NXtcG4F/aQTGTFRGYCk/mwdnmTGg8q5u_2/B23I8WXH1qhcd_2BC7kNQ/SplwlVD2F3jUMRCB/dTSK84tk3PapDt7/wErikpmrkQw2_2Bhba/FTtz6Avew/ty3DREXbyq083JlIg3zM/TEYrA_2BNXjAICO93pa/QGJ.avi", "evidence": [ { "tcp_stream": 53, "frame_number": 1734, "display_filter": "frame.number == 1734", "timestamp_epoch": "1541623725.916965000" } ], "is_private": null, "observable_id": "observable-5962e9f578bf72a00f2ae865", "last_seen_epoch": "1541623725.916965000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623725.916965000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://dhsiwyqdlskwsqo.com/images/UIL_2BVxj_2FFv/cAgM9ZivBfYRBhzmpmqE8/gTexqC1Lh_2F0iW2/AATDXP0c4G4qcxV/_2FXAAoF8eHHNZ8c43/RrSntOi0N/4VTdgqIWbPwlUsd3uIxL/BZP_2Bzh085fEx639Yq/B1kvRr_2FOEM0k57tlZ1QS/8lw2Htym.avi", "evidence": [ { "tcp_stream": 53, "frame_number": 2226, "display_filter": "frame.number == 2226", "timestamp_epoch": "1541623730.990957000" } ], "is_private": null, "observable_id": "observable-d9170f5a6b6634d9ada1d14a", "last_seen_epoch": "1541623730.990957000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623730.990957000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ferranorga.net/img/client.rar", "evidence": [ { "tcp_stream": 70, "frame_number": 2555, "display_filter": "frame.number == 2555", "timestamp_epoch": "1541624403.848059000" } ], "is_private": null, "observable_id": "observable-2d1c2509d7ddb2c13a59af36", "last_seen_epoch": "1541624403.848059000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624403.848059000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://shumbildac.com/WES/fatog.php?l=ngul5.xap", "evidence": [ { "tcp_stream": 51, "frame_number": 1247, "display_filter": "frame.number == 1247", "timestamp_epoch": "1541623631.752689000" } ], "is_private": null, "observable_id": "observable-ac91084b5ee0db9fa3f43d89", "last_seen_epoch": "1541623631.752689000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623631.752689000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "evidence": [ { "tcp_stream": 58, "frame_number": 2270, "display_filter": "frame.number == 2270", "timestamp_epoch": "1541623798.594440000" } ], "is_private": null, "observable_id": "observable-470622274c788b27d8dedddb", "last_seen_epoch": "1541623798.594440000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623798.594440000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ferranorga.net/img/client.rar", "evidence": [ { "tcp_stream": 71, "frame_number": 2564, "display_filter": "frame.number == 2564", "timestamp_epoch": "1541624404.370399000" } ], "is_private": null, "observable_id": "observable-4e83b063c8f5454589305a24", "last_seen_epoch": "1541624404.370399000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624404.370399000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=2&utmn=1279953315&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Degrees%20%26%20Programs)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624866037&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~", "evidence": [ { "tcp_stream": 109, "frame_number": 8057, "display_filter": "frame.number == 8057", "timestamp_epoch": "1541624866.166359000" } ], "is_private": null, "observable_id": "observable-14edf492ab578eec7b3f85eb", "last_seen_epoch": "1541624866.166359000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624866.166359000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=3&utmn=1832691277&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Bachelor%270s%20Degrees)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624887589&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~", "evidence": [ { "tcp_stream": 109, "frame_number": 8105, "display_filter": "frame.number == 8105", "timestamp_epoch": "1541624887.715261000" } ], "is_private": null, "observable_id": "observable-a3debbd930a1506b92923c88", "last_seen_epoch": "1541624887.715261000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624887.715261000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=4&utmn=1892096743&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x446&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Bachelor%27s%20degrees%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=326256236&utmr=0&utmp=%2Fprograms%2Fundergraduate%2FPages%2Fdefault.aspx&utmht=1541624894067&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~", "evidence": [ { "tcp_stream": 109, "frame_number": 8669, "display_filter": "frame.number == 8669", "timestamp_epoch": "1541624894.195169000" } ], "is_private": null, "observable_id": "observable-744cb16a3b15f34c0eff5a83", "last_seen_epoch": "1541624894.195169000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624894.195169000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.google-analytics.com/ga.js", "evidence": [ { "tcp_stream": 109, "frame_number": 5284, "display_filter": "frame.number == 5284", "timestamp_epoch": "1541624860.425130000" } ], "is_private": null, "observable_id": "observable-83fb3d1f69fe37c9c2e93815", "last_seen_epoch": "1541624860.425130000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.425130000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=362717400&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624860490&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=408037419&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAQE~", "evidence": [ { "tcp_stream": 109, "frame_number": 5617, "display_filter": "frame.number == 5617", "timestamp_epoch": "1541624860.618251000" } ], "is_private": null, "observable_id": "observable-006ac61090134020539eb7b4", "last_seen_epoch": "1541624860.618251000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.618251000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.msftncsi.com/ncsi.txt", "evidence": [ { "tcp_stream": 27, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1541623252.666384000" } ], "is_private": null, "observable_id": "observable-3828a9b42730caa118f9c659", "last_seen_epoch": "1541623252.666384000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623252.666384000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/1033/core.js?rev=Emb5hNX1RZMNXk9oS82yvA%3D%3D", "evidence": [ { "tcp_stream": 104, "frame_number": 6577, "display_filter": "frame.number == 6577", "timestamp_epoch": "1541624862.071589000" } ], "is_private": null, "observable_id": "observable-c0f469fd39018fac9b4ba72e", "last_seen_epoch": "1541624862.071589000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.071589000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/1033/init.js?rev=wgiyW1GQqDQZTITaawvYoA%3D%3D", "evidence": [ { "tcp_stream": 106, "frame_number": 4947, "display_filter": "frame.number == 4947", "timestamp_epoch": "1541624859.774236000" } ], "is_private": null, "observable_id": "observable-7a9c2d575473b7478a384f6b", "last_seen_epoch": "1541624859.774236000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.774236000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/blank.js?rev=QGOYAJlouiWgFRlhHVlMKA%3D%3D", "evidence": [ { "tcp_stream": 104, "frame_number": 4899, "display_filter": "frame.number == 4899", "timestamp_epoch": "1541624859.747203000" } ], "is_private": null, "observable_id": "observable-2ecbf9e51706535b69945480", "last_seen_epoch": "1541624859.747203000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.747203000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/cui.js?rev=OOyJv78CADNBeet%2FvTvniQ%3D%3D", "evidence": [ { "tcp_stream": 105, "frame_number": 6583, "display_filter": "frame.number == 6583", "timestamp_epoch": "1541624862.075493000" } ], "is_private": null, "observable_id": "observable-6f94117eb937c5c6de998f5f", "last_seen_epoch": "1541624862.075493000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.075493000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/images/bgximg.png", "evidence": [ { "tcp_stream": 103, "frame_number": 5567, "display_filter": "frame.number == 5567", "timestamp_epoch": "1541624860.602366000" } ], "is_private": null, "observable_id": "observable-4669e231a1a9e32356e429f4", "last_seen_epoch": "1541624860.602366000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.602366000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/images/fgimg.png", "evidence": [ { "tcp_stream": 104, "frame_number": 4994, "display_filter": "frame.number == 4994", "timestamp_epoch": "1541624859.850761000" } ], "is_private": null, "observable_id": "observable-3ca7708e4c879151eab11cab", "last_seen_epoch": "1541624859.850761000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.850761000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/inplview.js?rev=WB6Gy8a027aeNCq7koVCUg%3D%3D", "evidence": [ { "tcp_stream": 105, "frame_number": 6905, "display_filter": "frame.number == 6905", "timestamp_epoch": "1541624862.770720000" } ], "is_private": null, "observable_id": "observable-b57d82709a2db2f17e0f4692", "last_seen_epoch": "1541624862.770720000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.770720000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/kwizcom.sharepoint.foundation/jquery.js?v=13.4.81&source=kwizcomsharepointutilities", "evidence": [ { "tcp_stream": 104, "frame_number": 8188, "display_filter": "frame.number == 8188", "timestamp_epoch": "1541624893.168255000" } ], "is_private": null, "observable_id": "observable-6ffb4715c06e40ececbbf3c8", "last_seen_epoch": "1541624893.168255000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624893.168255000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/kwizcom.sharepoint.foundation/kwizcom_jsutility.js?v=13.4.81&source=kwizcomsharepointutilities", "evidence": [ { "tcp_stream": 103, "frame_number": 8182, "display_filter": "frame.number == 8182", "timestamp_epoch": "1541624893.163167000" } ], "is_private": null, "observable_id": "observable-c4c0845927176ed696aa5d84", "last_seen_epoch": "1541624893.163167000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624893.163167000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/kwizcom_aggregator/kwizcom_listaggregator.js?v=12.1.12&source=kwizcomsharepointutilities", "evidence": [ { "tcp_stream": 107, "frame_number": 8190, "display_filter": "frame.number == 8190", "timestamp_epoch": "1541624893.170050000" } ], "is_private": null, "observable_id": "observable-cc1464d1949915185ec7a71c", "last_seen_epoch": "1541624893.170050000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624893.170050000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/KWizCom_Aggregator/loading.gif", "evidence": [ { "tcp_stream": 103, "frame_number": 8585, "display_filter": "frame.number == 8585", "timestamp_epoch": "1541624894.031664000" } ], "is_private": null, "observable_id": "observable-ba58e5cdc77b1b3e4e15a13c", "last_seen_epoch": "1541624894.031664000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624894.031664000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/mediaplayer.js?rev=Q6vfD9BNL%2B9PvwgrVEcc%2FA%3D%3D", "evidence": [ { "tcp_stream": 104, "frame_number": 6903, "display_filter": "frame.number == 6903", "timestamp_epoch": "1541624862.769105000" } ], "is_private": null, "observable_id": "observable-1bff2ce3bafaa6aacede2b0c", "last_seen_epoch": "1541624862.769105000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.769105000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/ScriptResx.ashx?culture=en%2Dus&name=SP%2ERes&rev=b6%2FcRx1a6orhAQ%2FcF%2B0ytQ%3D%3D", "evidence": [ { "tcp_stream": 108, "frame_number": 6581, "display_filter": "frame.number == 6581", "timestamp_epoch": "1541624862.074280000" } ], "is_private": null, "observable_id": "observable-055c49a8138e6f6cd9fe638c", "last_seen_epoch": "1541624862.074280000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.074280000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/sp.core.js?rev=7ByNlH%2BvcgRJg%2BRCctdC0w%3D%3D", "evidence": [ { "tcp_stream": 103, "frame_number": 6579, "display_filter": "frame.number == 6579", "timestamp_epoch": "1541624862.073012000" } ], "is_private": null, "observable_id": "observable-8139fd81784c695ad34736a6", "last_seen_epoch": "1541624862.073012000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.073012000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/sp.js?rev=%2B4ZEyA892P3T0504qi0paw%3D%3D", "evidence": [ { "tcp_stream": 108, "frame_number": 6798, "display_filter": "frame.number == 6798", "timestamp_epoch": "1541624862.397142000" } ], "is_private": null, "observable_id": "observable-d604772f85d12f96e1b6e4d0", "last_seen_epoch": "1541624862.397142000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.397142000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/sp.ribbon.js?rev=F%2BUEJ66rbXzSvpf7nN69wQ%3D%3D", "evidence": [ { "tcp_stream": 105, "frame_number": 6930, "display_filter": "frame.number == 6930", "timestamp_epoch": "1541624862.896966000" } ], "is_private": null, "observable_id": "observable-3f0b8f9bf5e1c56cd57db2e1", "last_seen_epoch": "1541624862.896966000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.896966000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/sp.runtime.js?rev=IGffcZfunndj0247nOxKVg%3D%3D", "evidence": [ { "tcp_stream": 108, "frame_number": 6742, "display_filter": "frame.number == 6742", "timestamp_epoch": "1541624862.290081000" } ], "is_private": null, "observable_id": "observable-6b06b54325fe7da1aff8e771", "last_seen_epoch": "1541624862.290081000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.290081000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_layouts/sp.ui.dialog.js?rev=Tpcmo1%2FSu6R0yewHowDl5g%3D%3D", "evidence": [ { "tcp_stream": 108, "frame_number": 6601, "display_filter": "frame.number == 6601", "timestamp_epoch": "1541624862.185947000" } ], "is_private": null, "observable_id": "observable-71af899844297de0aad3f2c1", "last_seen_epoch": "1541624862.185947000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.185947000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/_vti_bin/sites.asmx", "evidence": [ { "tcp_stream": 108, "frame_number": 6889, "display_filter": "frame.number == 6889", "timestamp_epoch": "1541624862.663283000" } ], "is_private": null, "observable_id": "observable-3a2caa2cdccff1a1db8f3cdf", "last_seen_epoch": "1541624862.663283000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.663283000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/academics/colleges/CLAS/Departments/english/Programs/BachelorOfArts/BAEnglish/Pages/CreativeWriting.aspx", "evidence": [ { "tcp_stream": 105, "frame_number": 9022, "display_filter": "frame.number == 9022", "timestamp_epoch": "1541624906.875946000" } ], "is_private": null, "observable_id": "observable-7cf5b2cba28f789743f300fd", "last_seen_epoch": "1541624906.875946000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624906.875946000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/academics/degrees/_vti_bin/client.svc/ProcessQuery", "evidence": [ { "tcp_stream": 108, "frame_number": 6900, "display_filter": "frame.number == 6900", "timestamp_epoch": "1541624862.758014000" } ], "is_private": null, "observable_id": "observable-ba7fa371379031367421201c", "last_seen_epoch": "1541624862.758014000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.758014000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/06InfoGraphic/image/factBack3.jpg", "evidence": [ { "tcp_stream": 104, "frame_number": 6005, "display_filter": "frame.number == 6005", "timestamp_epoch": "1541624860.841068000" } ], "is_private": null, "observable_id": "observable-8e219a2e464d3ed2933a5ef0", "last_seen_epoch": "1541624860.841068000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.841068000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/carousel.js", "evidence": [ { "tcp_stream": 104, "frame_number": 5123, "display_filter": "frame.number == 5123", "timestamp_epoch": "1541624859.966453000" } ], "is_private": null, "observable_id": "observable-2c3d0e9101d3441cfafc9cd5", "last_seen_epoch": "1541624859.966453000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.966453000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/data.js", "evidence": [ { "tcp_stream": 104, "frame_number": 5160, "display_filter": "frame.number == 5160", "timestamp_epoch": "1541624860.128717000" } ], "is_private": null, "observable_id": "observable-a7550aa45530d7edd4f48470", "last_seen_epoch": "1541624860.128717000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.128717000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-app.css", "evidence": [ { "tcp_stream": 103, "frame_number": 4636, "display_filter": "frame.number == 4636", "timestamp_epoch": "1541624859.381889000" } ], "is_private": null, "observable_id": "observable-e071b4108971cbb7475c7415", "last_seen_epoch": "1541624859.381889000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.381889000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-search-ng.js", "evidence": [ { "tcp_stream": 103, "frame_number": 5129, "display_filter": "frame.number == 5129", "timestamp_epoch": "1541624859.971247000" } ], "is_private": null, "observable_id": "observable-18410bf6bcaf340a8060b2c2", "last_seen_epoch": "1541624859.971247000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.971247000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/16HeroImage/images/ResearchRoundupHero.jpg", "evidence": [ { "tcp_stream": 107, "frame_number": 5333, "display_filter": "frame.number == 5333", "timestamp_epoch": "1541624860.459487000" } ], "is_private": null, "observable_id": "observable-6e1f24f722fb5f9c7d3c47c5", "last_seen_epoch": "1541624860.459487000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.459487000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/favicon.ico", "evidence": [ { "tcp_stream": 107, "frame_number": 6585, "display_filter": "frame.number == 6585", "timestamp_epoch": "1541624862.076528000" } ], "is_private": null, "observable_id": "observable-f7262d0bc213ab7ca1c15551", "last_seen_epoch": "1541624862.076528000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624862.076528000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Javascript%20Library/angular-animate.min.js", "evidence": [ { "tcp_stream": 108, "frame_number": 4768, "display_filter": "frame.number == 4768", "timestamp_epoch": "1541624859.568418000" } ], "is_private": null, "observable_id": "observable-0a0f7c69edf75d29549fbbc9", "last_seen_epoch": "1541624859.568418000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.568418000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Javascript%20Library/angular.min.js", "evidence": [ { "tcp_stream": 106, "frame_number": 4749, "display_filter": "frame.number == 4749", "timestamp_epoch": "1541624859.563108000" } ], "is_private": null, "observable_id": "observable-5c791d09fbeb0a36bbf936b1", "last_seen_epoch": "1541624859.563108000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.563108000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Javascript%20Library/jquery-1.11.3.min.js", "evidence": [ { "tcp_stream": 107, "frame_number": 4668, "display_filter": "frame.number == 4668", "timestamp_epoch": "1541624859.440397000" }, { "tcp_stream": 107, "frame_number": 8125, "display_filter": "frame.number == 8125", "timestamp_epoch": "1541624892.841922000" } ], "is_private": null, "observable_id": "observable-cdacdb30441f2d857ef206a7", "last_seen_epoch": "1541624892.841922000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.440397000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.css", "evidence": [ { "tcp_stream": 105, "frame_number": 4589, "display_filter": "frame.number == 4589", "timestamp_epoch": "1541624859.217138000" }, { "tcp_stream": 104, "frame_number": 8135, "display_filter": "frame.number == 8135", "timestamp_epoch": "1541624892.958159000" } ], "is_private": null, "observable_id": "observable-04e0d0050884d9af40c0b661", "last_seen_epoch": "1541624892.958159000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.217138000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.js", "evidence": [ { "tcp_stream": 105, "frame_number": 4676, "display_filter": "frame.number == 4676", "timestamp_epoch": "1541624859.448624000" }, { "tcp_stream": 103, "frame_number": 8127, "display_filter": "frame.number == 8127", "timestamp_epoch": "1541624892.845416000" } ], "is_private": null, "observable_id": "observable-7d244b7efd6819b21119b9c5", "last_seen_epoch": "1541624892.845416000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.448624000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Javascript%20Library/jquery.jcarousel.min.js", "evidence": [ { "tcp_stream": 103, "frame_number": 4788, "display_filter": "frame.number == 4788", "timestamp_epoch": "1541624859.617568000" } ], "is_private": null, "observable_id": "observable-7c84a4a73800242a85a1f587", "last_seen_epoch": "1541624859.617568000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.617568000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Javascript%20Library/responsive/jsBaseResponsive.js", "evidence": [ { "tcp_stream": 104, "frame_number": 4794, "display_filter": "frame.number == 4794", "timestamp_epoch": "1541624859.630828000" }, { "tcp_stream": 103, "frame_number": 8157, "display_filter": "frame.number == 8157", "timestamp_epoch": "1541624893.057986000" } ], "is_private": null, "observable_id": "observable-bbf4e862670cdf1139907327", "last_seen_epoch": "1541624893.057986000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.630828000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Javascript%20Library/UCDJS.js", "evidence": [ { "tcp_stream": 108, "frame_number": 4871, "display_filter": "frame.number == 4871", "timestamp_epoch": "1541624859.685949000" }, { "tcp_stream": 104, "frame_number": 8160, "display_filter": "frame.number == 8160", "timestamp_epoch": "1541624893.060607000" } ], "is_private": null, "observable_id": "observable-b9516a19c1e47c19658863b6", "last_seen_epoch": "1541624893.060607000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.685949000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/pages/ucdwelcomepage.aspx", "evidence": [ { "tcp_stream": 103, "frame_number": 4552, "display_filter": "frame.number == 4552", "timestamp_epoch": "1541624858.750822000" } ], "is_private": null, "observable_id": "observable-48ffa53ede7003d3ed33d5e6", "last_seen_epoch": "1541624858.750822000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624858.750822000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/programs/undergraduate", "evidence": [ { "tcp_stream": 108, "frame_number": 8107, "display_filter": "frame.number == 8107", "timestamp_epoch": "1541624887.720790000" } ], "is_private": null, "observable_id": "observable-cf388ab3074617beb151f33d", "last_seen_epoch": "1541624887.720790000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624887.720790000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/programs/undergraduate/Documents/Styles_Scripts/local.js", "evidence": [ { "tcp_stream": 106, "frame_number": 8178, "display_filter": "frame.number == 8178", "timestamp_epoch": "1541624893.130675000" } ], "is_private": null, "observable_id": "observable-f40661e8e28189484bbb64e9", "last_seen_epoch": "1541624893.130675000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624893.130675000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/programs/undergraduate/Pages/_layouts/images/minus.gif", "evidence": [ { "tcp_stream": 108, "frame_number": 8583, "display_filter": "frame.number == 8583", "timestamp_epoch": "1541624894.030037000" } ], "is_private": null, "observable_id": "observable-ad6cc709a2c63f066d498b9b", "last_seen_epoch": "1541624894.030037000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624894.030037000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/programs/undergraduate/Pages/default.aspx", "evidence": [ { "tcp_stream": 108, "frame_number": 8111, "display_filter": "frame.number == 8111", "timestamp_epoch": "1541624887.810832000" } ], "is_private": null, "observable_id": "observable-2d8bc64c10b438aa39f94f7a", "last_seen_epoch": "1541624887.810832000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624887.810832000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply.jpg", "evidence": [ { "tcp_stream": 107, "frame_number": 5996, "display_filter": "frame.number == 5996", "timestamp_epoch": "1541624860.831216000" }, { "tcp_stream": 107, "frame_number": 8629, "display_filter": "frame.number == 8629", "timestamp_epoch": "1541624894.139813000" } ], "is_private": null, "observable_id": "observable-2c7b5bc728ce48e3fabc5ac6", "last_seen_epoch": "1541624894.139813000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.831216000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply_small.jpg", "evidence": [ { "tcp_stream": 103, "frame_number": 5195, "display_filter": "frame.number == 5195", "timestamp_epoch": "1541624860.255371000" }, { "tcp_stream": 107, "frame_number": 8529, "display_filter": "frame.number == 8529", "timestamp_epoch": "1541624893.648687000" } ], "is_private": null, "observable_id": "observable-f22bb339c072b3e8b93bb620", "last_seen_epoch": "1541624893.648687000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.255371000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_appStatus_small.jpg", "evidence": [ { "tcp_stream": 106, "frame_number": 5199, "display_filter": "frame.number == 5199", "timestamp_epoch": "1541624860.259689000" }, { "tcp_stream": 107, "frame_number": 8568, "display_filter": "frame.number == 8568", "timestamp_epoch": "1541624893.918735000" } ], "is_private": null, "observable_id": "observable-037861897da39967b4edab37", "last_seen_epoch": "1541624893.918735000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.259689000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_calendar_small.jpg", "evidence": [ { "tcp_stream": 104, "frame_number": 5170, "display_filter": "frame.number == 5170", "timestamp_epoch": "1541624860.237436000" }, { "tcp_stream": 107, "frame_number": 8407, "display_filter": "frame.number == 8407", "timestamp_epoch": "1541624893.493619000" } ], "is_private": null, "observable_id": "observable-55d698bdb1b273e6c9af619b", "last_seen_epoch": "1541624893.493619000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.237436000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog.jpg", "evidence": [ { "tcp_stream": 108, "frame_number": 8673, "display_filter": "frame.number == 8673", "timestamp_epoch": "1541624894.206873000" } ], "is_private": null, "observable_id": "observable-72b24a7cfd304121ea8690e3", "last_seen_epoch": "1541624894.206873000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624894.206873000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog_small.jpg", "evidence": [ { "tcp_stream": 107, "frame_number": 5168, "display_filter": "frame.number == 5168", "timestamp_epoch": "1541624860.233813000" }, { "tcp_stream": 105, "frame_number": 8405, "display_filter": "frame.number == 8405", "timestamp_epoch": "1541624893.492068000" } ], "is_private": null, "observable_id": "observable-38dbfaec330c08161fb10338", "last_seen_epoch": "1541624893.492068000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.233813000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_requestInfo.jpg", "evidence": [ { "tcp_stream": 106, "frame_number": 6000, "display_filter": "frame.number == 6000", "timestamp_epoch": "1541624860.835661000" } ], "is_private": null, "observable_id": "observable-436e386a67acf2426c12c3ea", "last_seen_epoch": "1541624860.835661000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.835661000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit.jpg", "evidence": [ { "tcp_stream": 103, "frame_number": 5998, "display_filter": "frame.number == 5998", "timestamp_epoch": "1541624860.832935000" } ], "is_private": null, "observable_id": "observable-ba2da1bb0ba087c72e8839f5", "last_seen_epoch": "1541624860.832935000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.832935000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit_small.jpg", "evidence": [ { "tcp_stream": 105, "frame_number": 5197, "display_filter": "frame.number == 5197", "timestamp_epoch": "1541624860.258241000" }, { "tcp_stream": 105, "frame_number": 8531, "display_filter": "frame.number == 8531", "timestamp_epoch": "1541624893.650403000" } ], "is_private": null, "observable_id": "observable-e5850a86c678aba9ff71a461", "last_seen_epoch": "1541624893.650403000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.258241000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUAnschutz.jpg", "evidence": [ { "tcp_stream": 108, "frame_number": 5201, "display_filter": "frame.number == 5201", "timestamp_epoch": "1541624860.260824000" }, { "tcp_stream": 104, "frame_number": 8570, "display_filter": "frame.number == 8570", "timestamp_epoch": "1541624893.920995000" } ], "is_private": null, "observable_id": "observable-e801c27d6fcdca2963a84363", "last_seen_epoch": "1541624893.920995000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.260824000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUDenver.jpg", "evidence": [ { "tcp_stream": 106, "frame_number": 5289, "display_filter": "frame.number == 5289", "timestamp_epoch": "1541624860.432498000" }, { "tcp_stream": 107, "frame_number": 8575, "display_filter": "frame.number == 8575", "timestamp_epoch": "1541624894.025495000" } ], "is_private": null, "observable_id": "observable-d4fa7cdcd524c359585cfbc0", "last_seen_epoch": "1541624894.025495000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.432498000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUSouth.jpg", "evidence": [ { "tcp_stream": 108, "frame_number": 5355, "display_filter": "frame.number == 5355", "timestamp_epoch": "1541624860.469628000" }, { "tcp_stream": 104, "frame_number": 8577, "display_filter": "frame.number == 8577", "timestamp_epoch": "1541624894.026539000" } ], "is_private": null, "observable_id": "observable-f3045b8d48d8282ec6eb5332", "last_seen_epoch": "1541624894.026539000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.469628000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/Hero/48_hero.jpg", "evidence": [ { "tcp_stream": 103, "frame_number": 8621, "display_filter": "frame.number == 8621", "timestamp_epoch": "1541624894.136456000" } ], "is_private": null, "observable_id": "observable-4c68cf9c31fcfa4576e9beb2", "last_seen_epoch": "1541624894.136456000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624894.136456000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/Testimonial/48_testimonial_kliese.jpg", "evidence": [ { "tcp_stream": 106, "frame_number": 8581, "display_filter": "frame.number == 8581", "timestamp_epoch": "1541624894.029046000" } ], "is_private": null, "observable_id": "observable-d96bedbf66d725768f68ca6e", "last_seen_epoch": "1541624894.029046000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624894.029046000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/Testimonial/48_testimonial_klimper.jpg", "evidence": [ { "tcp_stream": 105, "frame_number": 8579, "display_filter": "frame.number == 8579", "timestamp_epoch": "1541624894.027821000" } ], "is_private": null, "observable_id": "observable-03035a857889fae367117c2e", "last_seen_epoch": "1541624894.027821000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624894.027821000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/cta-triple-buttons/cta2.jpg", "evidence": [ { "tcp_stream": 105, "frame_number": 8645, "display_filter": "frame.number == 8645", "timestamp_epoch": "1541624894.149518000" } ], "is_private": null, "observable_id": "observable-ef78f8113682169e70ef76d9", "last_seen_epoch": "1541624894.149518000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624894.149518000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/balancedbudget.jpg", "evidence": [ { "tcp_stream": 105, "frame_number": 5412, "display_filter": "frame.number == 5412", "timestamp_epoch": "1541624860.492735000" } ], "is_private": null, "observable_id": "observable-8576b3f8433d9930f40a9072", "last_seen_epoch": "1541624860.492735000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.492735000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/StCajetans-ig.jpg", "evidence": [ { "tcp_stream": 108, "frame_number": 5495, "display_filter": "frame.number == 5495", "timestamp_epoch": "1541624860.570466000" } ], "is_private": null, "observable_id": "observable-678d3d33a7f2878e5f92df13", "last_seen_epoch": "1541624860.570466000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.570466000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/ThreeGuys.jpg", "evidence": [ { "tcp_stream": 104, "frame_number": 5385, "display_filter": "frame.number == 5385", "timestamp_epoch": "1541624860.481944000" } ], "is_private": null, "observable_id": "observable-2c50a8c98feef4b073913c4d", "last_seen_epoch": "1541624860.481944000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.481944000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/whitepines.jpg", "evidence": [ { "tcp_stream": 106, "frame_number": 5471, "display_filter": "frame.number == 5471", "timestamp_epoch": "1541624860.524980000" } ], "is_private": null, "observable_id": "observable-efe772a50544a7f0f0675cd0", "last_seen_epoch": "1541624860.524980000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.524980000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/PublishingImages/UCDLayoutImages/searchButton.png", "evidence": [ { "tcp_stream": 107, "frame_number": 5162, "display_filter": "frame.number == 5162", "timestamp_epoch": "1541624860.130512000" } ], "is_private": null, "observable_id": "observable-8f29e79b6127f92aff5fca99", "last_seen_epoch": "1541624860.130512000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.130512000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/ScriptResource.axd?d=1QDyKS9h_RiM240HMbYjM6ODCJOKhzpWzUoeDZ16t3d487fp531Bj79wvRUTrpe40Sb2WC34BUqekTySkaN5JfKY-KmMcnh1StfQCVLNGKh9bApp04C1q9RX01pYhWwBp5cQe9b_UUDsH1MpnrV6Qpz6c1ILT-tGnGCdfhY6NJVDQZ2p0&t=2e2045e2", "evidence": [ { "tcp_stream": 108, "frame_number": 4975, "display_filter": "frame.number == 4975", "timestamp_epoch": "1541624859.779592000" } ], "is_private": null, "observable_id": "observable-a50c86b3cd1cf420cbc9b69f", "last_seen_epoch": "1541624859.779592000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.779592000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/ScriptResource.axd?d=9di2kcBnRer6u7CuZUM7AfDDbzWMOK7upyNjbmE5Pdu3o5BHVtGXRC91MpdMm5XnQKxQdUdYrD0lcXagGlKdOSu2-gvQh1sQkr9VBx5eiph2ui3XCKHywHXzD91UpgfJQscXyag6PMfkkSUAwV5oTxM-pRGaKbplVIquRmAvCsECm7UwxgbHqr5oRifTbuwyorCrDIb3SKMarpQyLWAcwc1HYq01&t=3cb8783c", "evidence": [ { "tcp_stream": 105, "frame_number": 8216, "display_filter": "frame.number == 8216", "timestamp_epoch": "1541624893.192548000" } ], "is_private": null, "observable_id": "observable-02ab7b1fe9df7df84187096b", "last_seen_epoch": "1541624893.192548000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624893.192548000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/ScriptResource.axd?d=kbtxWN87DQ1VIylVprHAWnyKaGLTA4pXlXTHlCuJIMsMYgKaYAHacVcYWnfHdzexemLANVUTb9RCqYHuFVYEeMMivsq9U8GpgkkDFsA3RU3W-vDHMWw2gDPk5jSrhT-rAV4PHKkL432QiTzOJMscy2b0-_w-jLBdS2fQZi5KQMX9r-i8Y6ucvvNoN81ML1rcIiQZneq5Y7wGC-UMWsKoXE1IejlZ1LpGQdWma9ut0iUIFPwY0&t=3cb8783c", "evidence": [ { "tcp_stream": 106, "frame_number": 8235, "display_filter": "frame.number == 8235", "timestamp_epoch": "1541624893.271519000" } ], "is_private": null, "observable_id": "observable-87117e67135eee620cbdfc29", "last_seen_epoch": "1541624893.271519000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624893.271519000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/ScriptResource.axd?d=nDIPXhUC97iGOuHV1bSa3g9PgqtW-xIy12fJV_T8vVy7js2xrAy8ccqwmnXPgF-xNQgkyT7tmsbDKVfT8ifdxCFRXJAu8n8jnliYraK21_he0x3K2sbtAORIu3mC-DFdoxOp3B5OGN3NzbzrPG28T1haK-w1&t=2e2045e2", "evidence": [ { "tcp_stream": 107, "frame_number": 4958, "display_filter": "frame.number == 4958", "timestamp_epoch": "1541624859.776150000" } ], "is_private": null, "observable_id": "observable-6ff3850b56fd179b6b6bae43", "last_seen_epoch": "1541624859.776150000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.776150000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/SiteCollectionImages/Logos/CUDenver_cuitc-300.png", "evidence": [ { "tcp_stream": 103, "frame_number": 4996, "display_filter": "frame.number == 4996", "timestamp_epoch": "1541624859.853521000" } ], "is_private": null, "observable_id": "observable-fbc25fee6fe516f4a90b18e1", "last_seen_epoch": "1541624859.853521000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.853521000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap-theme.min.css", "evidence": [ { "tcp_stream": 104, "frame_number": 4585, "display_filter": "frame.number == 4585", "timestamp_epoch": "1541624859.204941000" }, { "tcp_stream": 103, "frame_number": 8133, "display_filter": "frame.number == 8133", "timestamp_epoch": "1541624892.956106000" } ], "is_private": null, "observable_id": "observable-016f054613253ffb549a9b11", "last_seen_epoch": "1541624892.956106000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.204941000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap.min.css", "evidence": [ { "tcp_stream": 108, "frame_number": 4581, "display_filter": "frame.number == 4581", "timestamp_epoch": "1541624859.201803000" }, { "tcp_stream": 104, "frame_number": 8123, "display_filter": "frame.number == 8123", "timestamp_epoch": "1541624892.840098000" } ], "is_private": null, "observable_id": "observable-aec83e09a85437f54976ea87", "last_seen_epoch": "1541624892.840098000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.201803000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/bootstrap334/fonts/glyphicons-halflings-regular.woff2", "evidence": [ { "tcp_stream": 108, "frame_number": 8059, "display_filter": "frame.number == 8059", "timestamp_epoch": "1541624866.169891000" } ], "is_private": null, "observable_id": "observable-d6c92932d25096a0a0fca1c3", "last_seen_epoch": "1541624866.169891000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624866.169891000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/bootstrap334/js/bootstrap.min.js", "evidence": [ { "tcp_stream": 103, "frame_number": 4710, "display_filter": "frame.number == 4710", "timestamp_epoch": "1541624859.497098000" }, { "tcp_stream": 106, "frame_number": 8129, "display_filter": "frame.number == 8129", "timestamp_epoch": "1541624892.849579000" } ], "is_private": null, "observable_id": "observable-5fc1e645fc9bf4c7ca901659", "last_seen_epoch": "1541624892.849579000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.497098000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/corev4Anonymous.css", "evidence": [ { "tcp_stream": 106, "frame_number": 4577, "display_filter": "frame.number == 4577", "timestamp_epoch": "1541624859.196686000" }, { "tcp_stream": 105, "frame_number": 8121, "display_filter": "frame.number == 8121", "timestamp_epoch": "1541624892.838345000" } ], "is_private": null, "observable_id": "observable-df73db006fd77350a6e9c4fe", "last_seen_epoch": "1541624892.838345000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.196686000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/BetaUCDenverTheme.css", "evidence": [ { "tcp_stream": 105, "frame_number": 8152, "display_filter": "frame.number == 8152", "timestamp_epoch": "1541624893.010022000" } ], "is_private": null, "observable_id": "observable-5d0362f666b44551246d3e78", "last_seen_epoch": "1541624893.010022000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624893.010022000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/DDCthemeMain.css", "evidence": [ { "tcp_stream": 103, "frame_number": 5158, "display_filter": "frame.number == 5158", "timestamp_epoch": "1541624860.126535000" }, { "tcp_stream": 105, "frame_number": 8566, "display_filter": "frame.number == 8566", "timestamp_epoch": "1541624893.915915000" } ], "is_private": null, "observable_id": "observable-a359c8533438c35e67ded4ab", "last_seen_epoch": "1541624893.915915000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.126535000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/facebook.png", "evidence": [ { "tcp_stream": 105, "frame_number": 5889, "display_filter": "frame.number == 5889", "timestamp_epoch": "1541624860.754925000" } ], "is_private": null, "observable_id": "observable-90ddc5544311f99119a56fd1", "last_seen_epoch": "1541624860.754925000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.754925000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/googleplus.png", "evidence": [ { "tcp_stream": 103, "frame_number": 5807, "display_filter": "frame.number == 5807", "timestamp_epoch": "1541624860.712635000" } ], "is_private": null, "observable_id": "observable-027e99673cdf01971f9fd9d9", "last_seen_epoch": "1541624860.712635000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.712635000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/instagram.png", "evidence": [ { "tcp_stream": 106, "frame_number": 5845, "display_filter": "frame.number == 5845", "timestamp_epoch": "1541624860.735835000" } ], "is_private": null, "observable_id": "observable-e1e20426b6ecb0fe7fe8b3c3", "last_seen_epoch": "1541624860.735835000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.735835000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/linkedin.png", "evidence": [ { "tcp_stream": 105, "frame_number": 5642, "display_filter": "frame.number == 5642", "timestamp_epoch": "1541624860.627830000" } ], "is_private": null, "observable_id": "observable-f89f8af8e53ac6a1ff6f91e7", "last_seen_epoch": "1541624860.627830000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.627830000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/QLtab.png", "evidence": [ { "tcp_stream": 106, "frame_number": 5235, "display_filter": "frame.number == 5235", "timestamp_epoch": "1541624860.347934000" } ], "is_private": null, "observable_id": "observable-78ae0f2e43ed1abd9adcdca9", "last_seen_epoch": "1541624860.347934000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.347934000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/searchButton.png", "evidence": [ { "tcp_stream": 104, "frame_number": 5245, "display_filter": "frame.number == 5245", "timestamp_epoch": "1541624860.353114000" } ], "is_private": null, "observable_id": "observable-1f7cdd0a1fca38aa58f526eb", "last_seen_epoch": "1541624860.353114000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.353114000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/twitter.png", "evidence": [ { "tcp_stream": 108, "frame_number": 5887, "display_filter": "frame.number == 5887", "timestamp_epoch": "1541624860.752218000" } ], "is_private": null, "observable_id": "observable-d74d78dec172361398644fe5", "last_seen_epoch": "1541624860.752218000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.752218000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/youtube.png", "evidence": [ { "tcp_stream": 104, "frame_number": 5841, "display_filter": "frame.number == 5841", "timestamp_epoch": "1541624860.733368000" } ], "is_private": null, "observable_id": "observable-e0c77a1eb14966ead907400d", "last_seen_epoch": "1541624860.733368000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.733368000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/leftChevron.gif", "evidence": [ { "tcp_stream": 105, "frame_number": 6034, "display_filter": "frame.number == 6034", "timestamp_epoch": "1541624860.865620000" } ], "is_private": null, "observable_id": "observable-55220dee675ceffa39e7a35c", "last_seen_epoch": "1541624860.865620000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.865620000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/rightChevron.gif", "evidence": [ { "tcp_stream": 108, "frame_number": 6011, "display_filter": "frame.number == 6011", "timestamp_epoch": "1541624860.847864000" } ], "is_private": null, "observable_id": "observable-6404e07c498bdd87e6745b1f", "last_seen_epoch": "1541624860.847864000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.847864000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/fonts/fontawesome-fontfacekit/fontawesome-webfont.woff2?v=4.3.0", "evidence": [ { "tcp_stream": 103, "frame_number": 5262, "display_filter": "frame.number == 5262", "timestamp_epoch": "1541624860.363198000" } ], "is_private": null, "observable_id": "observable-18beaed1067aec972bfd6a5a", "last_seen_epoch": "1541624860.363198000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.363198000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-bold-webfont.woff2", "evidence": [ { "tcp_stream": 108, "frame_number": 5247, "display_filter": "frame.number == 5247", "timestamp_epoch": "1541624860.359313000" }, { "tcp_stream": 106, "frame_number": 8609, "display_filter": "frame.number == 8609", "timestamp_epoch": "1541624894.127435000" } ], "is_private": null, "observable_id": "observable-22dfdf8c0237c938c33e0ce7", "last_seen_epoch": "1541624894.127435000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.359313000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-light-webfont.woff2", "evidence": [ { "tcp_stream": 105, "frame_number": 5272, "display_filter": "frame.number == 5272", "timestamp_epoch": "1541624860.366019000" }, { "tcp_stream": 104, "frame_number": 8612, "display_filter": "frame.number == 8612", "timestamp_epoch": "1541624894.130411000" } ], "is_private": null, "observable_id": "observable-9215d29184a7197fb8d16e7f", "last_seen_epoch": "1541624894.130411000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.366019000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-regular-webfont.woff2", "evidence": [ { "tcp_stream": 107, "frame_number": 5210, "display_filter": "frame.number == 5210", "timestamp_epoch": "1541624860.340649000" }, { "tcp_stream": 108, "frame_number": 8588, "display_filter": "frame.number == 8588", "timestamp_epoch": "1541624894.114920000" } ], "is_private": null, "observable_id": "observable-4753b0d2ce79f535d1cb7da4", "last_seen_epoch": "1541624894.114920000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.340649000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/responsive/print.css", "evidence": [ { "tcp_stream": 108, "frame_number": 6074, "display_filter": "frame.number == 6074", "timestamp_epoch": "1541624860.952712000" }, { "tcp_stream": 106, "frame_number": 8676, "display_filter": "frame.number == 8676", "timestamp_epoch": "1541624894.214024000" } ], "is_private": null, "observable_id": "observable-c821f92bb1c45e257d2e75e4", "last_seen_epoch": "1541624894.214024000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624860.952712000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/responsive/responsiveBase.css", "evidence": [ { "tcp_stream": 107, "frame_number": 4593, "display_filter": "frame.number == 4593", "timestamp_epoch": "1541624859.219621000" }, { "tcp_stream": 106, "frame_number": 8148, "display_filter": "frame.number == 8148", "timestamp_epoch": "1541624892.994907000" } ], "is_private": null, "observable_id": "observable-21f82320d8c3db9136355278", "last_seen_epoch": "1541624892.994907000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.219621000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/Style%20Library/UCDenverTheme.css", "evidence": [ { "tcp_stream": 104, "frame_number": 4615, "display_filter": "frame.number == 4615", "timestamp_epoch": "1541624859.315195000" } ], "is_private": null, "observable_id": "observable-45e861f737bafccbd30723b9", "last_seen_epoch": "1541624859.315195000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.315195000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/WebResource.axd?d=nK66gdmZPDA-w-JjHyggjO_q5ZVRp7ooiUATeOMUtTMCTlfkvxq8mxRHybfWnA0Swfdbv1YBCieMhY76WgB3McU0Erit7tpi9kGXDOtvazCF8h1BLSyM9r_pT9xkzGtAoB6i_bw2w0dM46xzuwSmUZ9Il-pR8sIBMDjV6n64EKHYbfoJqQA9doUWhsRbzsGCzJ1g7D2-gJrdDaKQJ1H6GipIFEoKwv_UCr3VeSqOsCEXfpiHtt2ZR-Y3UW4oyGmrVOioeA2&t=635701215589701395", "evidence": [ { "tcp_stream": 107, "frame_number": 8154, "display_filter": "frame.number == 8154", "timestamp_epoch": "1541624893.012139000" } ], "is_private": null, "observable_id": "observable-99ad7a10510511c7d4ddf1fa", "last_seen_epoch": "1541624893.012139000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624893.012139000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.ucdenver.edu/WebResource.axd?d=Rr8OZckqtIG1LFJTmW4ygCZ8tMHeGI9-qww7ZH6tsHUf-5ACqmhwY6jnlnidSHBrgMkq7on6x9smildQ9krSVOW4yk41&t=636271455501517547", "evidence": [ { "tcp_stream": 103, "frame_number": 4888, "display_filter": "frame.number == 4888", "timestamp_epoch": "1541624859.741750000" } ], "is_private": null, "observable_id": "observable-d115059af19acc076edd2ec0", "last_seen_epoch": "1541624859.741750000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624859.741750000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Google Chrome/67.0.3396.99 Windows", "evidence": [ { "frame_number": 2696, "display_filter": "frame.number == 2696", "timestamp_epoch": "1541624762.197551000" }, { "frame_number": 2726, "display_filter": "frame.number == 2726", "timestamp_epoch": "1541624763.200415000" }, { "frame_number": 2739, "display_filter": "frame.number == 2739", "timestamp_epoch": "1541624764.215092000" }, { "frame_number": 2740, "display_filter": "frame.number == 2740", "timestamp_epoch": "1541624765.218107000" }, { "frame_number": 2824, "display_filter": "frame.number == 2824", "timestamp_epoch": "1541624793.957286000" }, { "frame_number": 3045, "display_filter": "frame.number == 3045", "timestamp_epoch": "1541624794.958348000" }, { "frame_number": 3435, "display_filter": "frame.number == 3435", "timestamp_epoch": "1541624795.958880000" }, { "frame_number": 3436, "display_filter": "frame.number == 3436", "timestamp_epoch": "1541624796.959614000" }, { "frame_number": 9898, "display_filter": "frame.number == 9898", "timestamp_epoch": "1541624913.892827000" }, { "frame_number": 9904, "display_filter": "frame.number == 9904", "timestamp_epoch": "1541624914.893631000" }, { "frame_number": 9905, "display_filter": "frame.number == 9905", "timestamp_epoch": "1541624915.895001000" }, { "frame_number": 9906, "display_filter": "frame.number == 9906", "timestamp_epoch": "1541624916.896692000" } ], "is_private": null, "observable_id": "observable-8c12a0034f898b7e466a1ecd", "last_seen_epoch": "1541624916.896692000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624762.197551000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft NCSI", "evidence": [ { "tcp_stream": 27, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1541623252.666384000" } ], "is_private": null, "observable_id": "observable-c9ec90558379c01928afa8bd", "last_seen_epoch": "1541623252.666384000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623252.666384000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft-CryptoAPI/6.1", "evidence": [ { "tcp_stream": 58, "frame_number": 2270, "display_filter": "frame.number == 2270", "timestamp_epoch": "1541623798.594440000" } ], "is_private": null, "observable_id": "observable-4d93b32872972c395ef8dc39", "last_seen_epoch": "1541623798.594440000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623798.594440000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)", "evidence": [ { "tcp_stream": 70, "frame_number": 2555, "display_filter": "frame.number == 2555", "timestamp_epoch": "1541624403.848059000" }, { "tcp_stream": 71, "frame_number": 2564, "display_filter": "frame.number == 2564", "timestamp_epoch": "1541624404.370399000" } ], "is_private": null, "observable_id": "observable-d56a0a7c258847f6f42a7e46", "last_seen_epoch": "1541624404.370399000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624403.848059000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "evidence": [ { "tcp_stream": 103, "frame_number": 4552, "display_filter": "frame.number == 4552", "timestamp_epoch": "1541624858.750822000" }, { "tcp_stream": 106, "frame_number": 4577, "display_filter": "frame.number == 4577", "timestamp_epoch": "1541624859.196686000" }, { "tcp_stream": 108, "frame_number": 4581, "display_filter": "frame.number == 4581", "timestamp_epoch": "1541624859.201803000" }, { "tcp_stream": 104, "frame_number": 4585, "display_filter": "frame.number == 4585", "timestamp_epoch": "1541624859.204941000" }, { "tcp_stream": 105, "frame_number": 4589, "display_filter": "frame.number == 4589", "timestamp_epoch": "1541624859.217138000" }, { "tcp_stream": 107, "frame_number": 4593, "display_filter": "frame.number == 4593", "timestamp_epoch": "1541624859.219621000" }, { "tcp_stream": 104, "frame_number": 4615, "display_filter": "frame.number == 4615", "timestamp_epoch": "1541624859.315195000" }, { "tcp_stream": 103, "frame_number": 4636, "display_filter": "frame.number == 4636", "timestamp_epoch": "1541624859.381889000" }, { "tcp_stream": 107, "frame_number": 4668, "display_filter": "frame.number == 4668", "timestamp_epoch": "1541624859.440397000" }, { "tcp_stream": 105, "frame_number": 4676, "display_filter": "frame.number == 4676", "timestamp_epoch": "1541624859.448624000" }, { "tcp_stream": 103, "frame_number": 4710, "display_filter": "frame.number == 4710", "timestamp_epoch": "1541624859.497098000" }, { "tcp_stream": 106, "frame_number": 4749, "display_filter": "frame.number == 4749", "timestamp_epoch": "1541624859.563108000" }, { "tcp_stream": 108, "frame_number": 4768, "display_filter": "frame.number == 4768", "timestamp_epoch": "1541624859.568418000" }, { "tcp_stream": 103, "frame_number": 4788, "display_filter": "frame.number == 4788", "timestamp_epoch": "1541624859.617568000" }, { "tcp_stream": 104, "frame_number": 4794, "display_filter": "frame.number == 4794", "timestamp_epoch": "1541624859.630828000" }, { "tcp_stream": 108, "frame_number": 4871, "display_filter": "frame.number == 4871", "timestamp_epoch": "1541624859.685949000" }, { "tcp_stream": 103, "frame_number": 4888, "display_filter": "frame.number == 4888", "timestamp_epoch": "1541624859.741750000" }, { "tcp_stream": 104, "frame_number": 4899, "display_filter": "frame.number == 4899", "timestamp_epoch": "1541624859.747203000" }, { "tcp_stream": 106, "frame_number": 4947, "display_filter": "frame.number == 4947", "timestamp_epoch": "1541624859.774236000" }, { "tcp_stream": 107, "frame_number": 4958, "display_filter": "frame.number == 4958", "timestamp_epoch": "1541624859.776150000" } ], "is_private": null, "observable_id": "observable-042825a15a6765447d4f15c8", "last_seen_epoch": "1541624906.875946000", "enrichment_state": "not_requested", "first_seen_epoch": "1541624858.750822000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "evidence": [ { "tcp_stream": 53, "frame_number": 1734, "display_filter": "frame.number == 1734", "timestamp_epoch": "1541623725.916965000" }, { "tcp_stream": 53, "frame_number": 1939, "display_filter": "frame.number == 1939", "timestamp_epoch": "1541623727.157447000" }, { "tcp_stream": 56, "frame_number": 1955, "display_filter": "frame.number == 1955", "timestamp_epoch": "1541623728.369908000" }, { "tcp_stream": 53, "frame_number": 2226, "display_filter": "frame.number == 2226", "timestamp_epoch": "1541623730.990957000" } ], "is_private": null, "observable_id": "observable-611881a3b51e4c6aa49413a3", "last_seen_epoch": "1541623730.990957000", "enrichment_state": "not_requested", "first_seen_epoch": "1541623725.916965000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "57ac59ede6c21b271cff5569fb1729d405a4dfed64df8fb1626b4bf8d9d493e2", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [ { "name": "Ingress Tool Transfer", "status": "suggested", "tactic": "command-and-control", "evidence": [ { "tcp_stream": 70, "frame_number": 2555, "display_filter": "frame.number == 2555", "timestamp_epoch": "1541624403.848059000" }, { "tcp_stream": 70, "frame_number": 2557, "display_filter": "frame.number == 2557", "timestamp_epoch": "1541624404.004624000" }, { "tcp_stream": 71, "frame_number": 2564, "display_filter": "frame.number == 2564", "timestamp_epoch": "1541624404.370399000" }, { "tcp_stream": 71, "frame_number": 2566, "display_filter": "frame.number == 2566", "timestamp_epoch": "1541624404.525560000" }, { "tcp_stream": 107, "frame_number": 4668, "display_filter": "frame.number == 4668", "timestamp_epoch": "1541624859.440397000" }, { "tcp_stream": 105, "frame_number": 4676, "display_filter": "frame.number == 4676", "timestamp_epoch": "1541624859.448624000" }, { "tcp_stream": 103, "frame_number": 4710, "display_filter": "frame.number == 4710", "timestamp_epoch": "1541624859.497098000" }, { "tcp_stream": 106, "frame_number": 4749, "display_filter": "frame.number == 4749", "timestamp_epoch": "1541624859.563108000" }, { "tcp_stream": 108, "frame_number": 4768, "display_filter": "frame.number == 4768", "timestamp_epoch": "1541624859.568418000" }, { "tcp_stream": 103, "frame_number": 4786, "display_filter": "frame.number == 4786", "timestamp_epoch": "1541624859.615717000" }, { "tcp_stream": 103, "frame_number": 4788, "display_filter": "frame.number == 4788", "timestamp_epoch": "1541624859.617568000" }, { "tcp_stream": 104, "frame_number": 4794, "display_filter": "frame.number == 4794", "timestamp_epoch": "1541624859.630828000" }, { "tcp_stream": 108, "frame_number": 4869, "display_filter": "frame.number == 4869", "timestamp_epoch": "1541624859.683638000" }, { "tcp_stream": 108, "frame_number": 4871, "display_filter": "frame.number == 4871", "timestamp_epoch": "1541624859.685949000" }, { "tcp_stream": 103, "frame_number": 4886, "display_filter": "frame.number == 4886", "timestamp_epoch": "1541624859.738226000" }, { "tcp_stream": 104, "frame_number": 4897, "display_filter": "frame.number == 4897", "timestamp_epoch": "1541624859.745550000" }, { "tcp_stream": 104, "frame_number": 4899, "display_filter": "frame.number == 4899", "timestamp_epoch": "1541624859.747203000" }, { "tcp_stream": 106, "frame_number": 4932, "display_filter": "frame.number == 4932", "timestamp_epoch": "1541624859.772005000" }, { "tcp_stream": 106, "frame_number": 4947, "display_filter": "frame.number == 4947", "timestamp_epoch": "1541624859.774236000" }, { "tcp_stream": 107, "frame_number": 4951, "display_filter": "frame.number == 4951", "timestamp_epoch": "1541624859.774463000" }, { "tcp_stream": 108, "frame_number": 4957, "display_filter": "frame.number == 4957", "timestamp_epoch": "1541624859.775508000" }, { "tcp_stream": 104, "frame_number": 4987, "display_filter": "frame.number == 4987", "timestamp_epoch": "1541624859.846811000" }, { "tcp_stream": 106, "frame_number": 5045, "display_filter": "frame.number == 5045", "timestamp_epoch": "1541624859.891622000" }, { "tcp_stream": 105, "frame_number": 5074, "display_filter": "frame.number == 5074", "timestamp_epoch": "1541624859.896150000" }, { "tcp_stream": 104, "frame_number": 5123, "display_filter": "frame.number == 5123", "timestamp_epoch": "1541624859.966453000" } ], "attack_id": "T1105", "confidence": 0.8, "finding_ids": [ "finding-11c4ed4cefde9b87b0c877a5", "finding-16f9c9dec659732b24138abc", "finding-1a2f73725e41fe5acbf44c82", "finding-1db38ffc2a89fd193ad4bdb2", "finding-2074dc07d31fd4fcc84cb1d0", "finding-26636f3b01b11dc22d8bf738", "finding-2b18c3304884b1e75fa07f27", "finding-30e5ebe1af18ae0fc127da02", "finding-4bada970304b4abdd4161deb", "finding-56eaccd041ce430de5097878", "finding-66f4de3bef819e3b8721df4a", "finding-6c7000d53e402fddbdfc6b5b", "finding-7c6bc4a7221d1e166387aea2", "finding-951ab7e76d7019e3b8496816", "finding-9a760475ec2282e6c902c0fb", "finding-a51cd93bc70d19306248e493", "finding-a740bcc4525a3dfc898fb716", "finding-aa21768809964f4b28d931af", "finding-b548ac6871cfb79badd894e5", "finding-c583d058164c184ece16e7db", "finding-cc0dd00bb9ad2570403ef7f5", "finding-cf12beec20ab49594b63b728", "finding-d08ff1cdf302193557710a7a", "finding-d7da9087c62463793d9d6302", "finding-d9b4784364d7ba6af0d934a1", "finding-db95b17aaa84c84e27e494ba", "finding-e64811e9887f404c7c5ef860", "finding-ea9cf0bb761e806e0eef1598", "finding-f6222acc85a75e6c8147ff4a" ], "mapping_basis": "versioned-deterministic-rule" } ], "analysis_key_material": { "source_sha256": "79f9a39e2cb38303a7f2e8363d984f727347537a87473679d9c081e79cde527f", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 395, "observable_limit": 5000, "observables_total": 395, "matched_observables": 0, "observables_checked": 395, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:09:37.228263+00:00", "session_id": "7df59b46-baa9-4b80-b1af-df8f693d38a3", "techniques": [ { "url": "https://attack.mitre.org/techniques/T1105", "name": "Ingress Tool Transfer", "status": "catalog-context-not-validation-of-behavior", "attack_id": "T1105", "detection": "", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "WinEventLog:Sysmon", "auditd:SYSCALL", "iptables:LOG", "macos:endpointsecurity", "macos:unifiedlog", "esxi:hostd", "esxi:vmkernel", "NSM:Flow", "snmp:syslog" ], "catalog_version_id": 851, "detection_strategies": [ { "name": "Detect Ingress Tool Transfers via Behavioral Chain", "stix_id": "x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554", "attack_id": "DET0060" } ], "detection_links_truncated": false } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "a350bb1aec8150ebf567b85b61560b6616578c33600d4649d3eb686fd9e4542a", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "57ac59ede6c21b271cff5569fb1729d405a4dfed64df8fb1626b4bf8d9d493e2", "cross_case_correlations": [ { "shared_count": 58, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 15, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 18, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 26, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 15, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 36, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 28, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 16, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 31, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 35, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 1, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 14, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 12, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "57ac59ede6c21b271cff5569fb1729d405a4dfed64df8fb1626b4bf8d9d493e2", "items": [ { "observable_id": "observable-f7b104f58b376a6988e3d22b", "type": "domain", "value": "222.222.67.208.in-addr.arpa", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 2238, "display_filter": "frame.number == 2238", "timestamp_epoch": "1541623797.233056000" }, { "udp_stream": 45, "frame_number": 2239, "display_filter": "frame.number == 2239", "timestamp_epoch": "1541623797.246082000" } ], "roles": [ "dns-query" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8c7714c9663fb13e969b823e", "type": "domain", "value": "8895986.fls.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:34.490719+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:34.315125+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.310495+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 89, "frame_number": 5266, "display_filter": "frame.number == 5266", "timestamp_epoch": "1541624860.363489000" }, { "udp_stream": 89, "frame_number": 5274, "display_filter": "frame.number == 5274", "timestamp_epoch": "1541624860.397101000" }, { "tcp_stream": 110, "frame_number": 5280, "display_filter": "frame.number == 5280", "timestamp_epoch": "1541624860.423381000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:34.305288+00:00" }, { "observable_id": "observable-67465105eb2809011101c666", "type": "domain", "value": "accounts.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:34.506581+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:14.429042+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.497218+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 57, "frame_number": 2698, "display_filter": "frame.number == 2698", "timestamp_epoch": "1541624762.854415000" }, { "udp_stream": 57, "frame_number": 2719, "display_filter": "frame.number == 2719", "timestamp_epoch": "1541624763.152884000" }, { "tcp_stream": 78, "frame_number": 2723, "display_filter": "frame.number == 2723", "timestamp_epoch": "1541624763.173519000" }, { "tcp_stream": 82, "frame_number": 2840, "display_filter": "frame.number == 2840", "timestamp_epoch": "1541624794.508880000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:34.490820+00:00" }, { "observable_id": "observable-b578dfec4888ddf453845f49", "type": "domain", "value": "adservice.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:49.436607+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.662419+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 3415, "display_filter": "frame.number == 3415", "timestamp_epoch": "1541624795.634633000" }, { "udp_stream": 75, "frame_number": 3416, "display_filter": "frame.number == 3416", "timestamp_epoch": "1541624795.663259000" }, { "tcp_stream": 90, "frame_number": 3422, "display_filter": "frame.number == 3422", "timestamp_epoch": "1541624795.684426000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:34.657818+00:00" }, { "observable_id": "observable-2931dff8994ddbdaaaa99c8a", "type": "domain", "value": "api.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 37, "frame_number": 1713, "display_filter": "frame.number == 1713", "timestamp_epoch": "1541623703.045964000" }, { "udp_stream": 40, "frame_number": 1716, "display_filter": "frame.number == 1716", "timestamp_epoch": "1541623703.058312000" }, { "udp_stream": 40, "frame_number": 1719, "display_filter": "frame.number == 1719", "timestamp_epoch": "1541623703.066561000" }, { "udp_stream": 37, "frame_number": 1720, "display_filter": "frame.number == 1720", "timestamp_epoch": "1541623703.066674000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-62b026f73495a5b2eefe016b", "type": "domain", "value": "apis.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:52.412014+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.670580+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 3301, "display_filter": "frame.number == 3301", "timestamp_epoch": "1541624795.412335000" }, { "udp_stream": 74, "frame_number": 3302, "display_filter": "frame.number == 3302", "timestamp_epoch": "1541624795.441778000" }, { "tcp_stream": 89, "frame_number": 3306, "display_filter": "frame.number == 3306", "timestamp_epoch": "1541624795.471389000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:34.666747+00:00" }, { "observable_id": "observable-122cb53407c2e674a4f471ea", "type": "domain", "value": "bcp.crwdcntrl.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:34.683484+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.679656+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 6444, "display_filter": "frame.number == 6444", "timestamp_epoch": "1541624861.321007000" }, { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" }, { "tcp_stream": 123, "frame_number": 6464, "display_filter": "frame.number == 6464", "timestamp_epoch": "1541624861.384572000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:34.675293+00:00" }, { "observable_id": "observable-1e673700f33c2c3abd27fd3c", "type": "domain", "value": "clas.ucdenver.edu", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:34.922724+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.917508+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 9027, "display_filter": "frame.number == 9027", "timestamp_epoch": "1541624907.089653000" }, { "udp_stream": 105, "frame_number": 9028, "display_filter": "frame.number == 9028", "timestamp_epoch": "1541624907.124684000" }, { "tcp_stream": 127, "frame_number": 9034, "display_filter": "frame.number == 9034", "timestamp_epoch": "1541624907.199832000" }, { "tcp_stream": 130, "frame_number": 9081, "display_filter": "frame.number == 9081", "timestamp_epoch": "1541624907.845875000" }, { "tcp_stream": 128, "frame_number": 9084, "display_filter": "frame.number == 9084", "timestamp_epoch": "1541624907.846160000" }, { "tcp_stream": 131, "frame_number": 9086, "display_filter": "frame.number == 9086", "timestamp_epoch": "1541624907.846496000" }, { "tcp_stream": 132, "frame_number": 9097, "display_filter": "frame.number == 9097", "timestamp_epoch": "1541624907.861241000" }, { "tcp_stream": 129, "frame_number": 9106, "display_filter": "frame.number == 9106", "timestamp_epoch": "1541624907.867635000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:34.912692+00:00" }, { "observable_id": "observable-eabc02445e3fc5de7cbfd411", "type": "domain", "value": "clients.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 4501, "display_filter": "frame.number == 4501", "timestamp_epoch": "1541624853.951935000" }, { "udp_stream": 91, "frame_number": 5477, "display_filter": "frame.number == 5477", "timestamp_epoch": "1541624860.547098000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-35630b515d9ad5769a73256f", "type": "domain", "value": "clients1.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:17.998377+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.121442+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 91, "frame_number": 5457, "display_filter": "frame.number == 5457", "timestamp_epoch": "1541624860.516907000" }, { "udp_stream": 91, "frame_number": 5477, "display_filter": "frame.number == 5477", "timestamp_epoch": "1541624860.547098000" }, { "tcp_stream": 111, "frame_number": 5485, "display_filter": "frame.number == 5485", "timestamp_epoch": "1541624860.563916000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:35.116053+00:00" }, { "observable_id": "observable-12cd3660baa52069462972d2", "type": "domain", "value": "clients4.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:35.134248+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.130498+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 4491, "display_filter": "frame.number == 4491", "timestamp_epoch": "1541624853.912838000" }, { "udp_stream": 87, "frame_number": 4501, "display_filter": "frame.number == 4501", "timestamp_epoch": "1541624853.951935000" }, { "tcp_stream": 102, "frame_number": 4505, "display_filter": "frame.number == 4505", "timestamp_epoch": "1541624853.969898000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:35.126158+00:00" }, { "observable_id": "observable-a3d213d50ded7c2e91e96df3", "type": "domain", "value": "clientservices.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:35.307559+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.302944+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 56, "frame_number": 2697, "display_filter": "frame.number == 2697", "timestamp_epoch": "1541624762.530738000" }, { "udp_stream": 56, "frame_number": 2699, "display_filter": "frame.number == 2699", "timestamp_epoch": "1541624762.856918000" }, { "tcp_stream": 77, "frame_number": 2705, "display_filter": "frame.number == 2705", "timestamp_epoch": "1541624762.900485000" }, { "tcp_stream": 81, "frame_number": 2828, "display_filter": "frame.number == 2828", "timestamp_epoch": "1541624794.379580000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:35.297205+00:00" }, { "observable_id": "observable-f9f11af8f854548312ef7397", "type": "domain", "value": "cm.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:13.189219+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.531470+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 96, "frame_number": 6038, "display_filter": "frame.number == 6038", "timestamp_epoch": "1541624860.873606000" }, { "udp_stream": 96, "frame_number": 6044, "display_filter": "frame.number == 6044", "timestamp_epoch": "1541624860.904837000" }, { "tcp_stream": 117, "frame_number": 6052, "display_filter": "frame.number == 6052", "timestamp_epoch": "1541624860.926710000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:35.526597+00:00" }, { "observable_id": "observable-43af33f3ae1dc4478a39a34b", "type": "domain", "value": "cyanteread.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1704, "display_filter": "frame.number == 1704", "timestamp_epoch": "1541623699.520395000" }, { "udp_stream": 36, "frame_number": 1705, "display_filter": "frame.number == 1705", "timestamp_epoch": "1541623699.591391000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-301587461d33f4e8c1f39244", "type": "domain", "value": "d.turn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:35.544496+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.540168+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 93, "frame_number": 5691, "display_filter": "frame.number == 5691", "timestamp_epoch": "1541624860.659079000" }, { "udp_stream": 93, "frame_number": 5925, "display_filter": "frame.number == 5925", "timestamp_epoch": "1541624860.792162000" }, { "tcp_stream": 116, "frame_number": 5994, "display_filter": "frame.number == 5994", "timestamp_epoch": "1541624860.828547000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:35.535877+00:00" }, { "observable_id": "observable-3d1c142cdbc289ed2866b033", "type": "domain", "value": "d.turn.com.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 93, "frame_number": 5925, "display_filter": "frame.number == 5925", "timestamp_epoch": "1541624860.792162000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9e26be5f96957be15122dcdc", "type": "domain", "value": "danger-win-pc.geeographic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 435, "display_filter": "frame.number == 435", "timestamp_epoch": "1541623254.972102000" }, { "udp_stream": 25, "frame_number": 436, "display_filter": "frame.number == 436", "timestamp_epoch": "1541623254.972506000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d475b4f47d8aebd69cf6f83d", "type": "domain", "value": "dart.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 89, "frame_number": 5274, "display_filter": "frame.number == 5274", "timestamp_epoch": "1541624860.397101000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7ae438e8626189b74c9c6565", "type": "domain", "value": "dhsiwyqdlskwsqo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:35.715270+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.713493+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 1728, "display_filter": "frame.number == 1728", "timestamp_epoch": "1541623725.437476000" }, { "udp_stream": 43, "frame_number": 1729, "display_filter": "frame.number == 1729", "timestamp_epoch": "1541623725.722135000" }, { "tcp_stream": 53, "frame_number": 1734, "display_filter": "frame.number == 1734", "timestamp_epoch": "1541623725.916965000" }, { "tcp_stream": 53, "frame_number": 1939, "display_filter": "frame.number == 1939", "timestamp_epoch": "1541623727.157447000" }, { "tcp_stream": 56, "frame_number": 1955, "display_filter": "frame.number == 1955", "timestamp_epoch": "1541623728.369908000" }, { "tcp_stream": 53, "frame_number": 2226, "display_filter": "frame.number == 2226", "timestamp_epoch": "1541623730.990957000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:35.711304+00:00" }, { "observable_id": "observable-58602ce8927e2a213a4ef412", "type": "domain", "value": "dns.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 680, "display_filter": "frame.number == 680", "timestamp_epoch": "1541623291.773708000" }, { "udp_stream": 29, "frame_number": 681, "display_filter": "frame.number == 681", "timestamp_epoch": "1541623291.790021000" }, { "udp_stream": 30, "frame_number": 682, "display_filter": "frame.number == 682", "timestamp_epoch": "1541623291.790344000" }, { "udp_stream": 30, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1541623291.810157000" }, { "udp_stream": 34, "frame_number": 1697, "display_filter": "frame.number == 1697", "timestamp_epoch": "1541623657.506880000" }, { "udp_stream": 34, "frame_number": 1698, "display_filter": "frame.number == 1698", "timestamp_epoch": "1541623657.522464000" }, { "udp_stream": 35, "frame_number": 1699, "display_filter": "frame.number == 1699", "timestamp_epoch": "1541623657.523123000" }, { "udp_stream": 35, "frame_number": 1700, "display_filter": "frame.number == 1700", "timestamp_epoch": "1541623657.523396000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c3ff049d6f0f870213a3176c", "type": "domain", "value": "dpm.demdex.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:16.880908+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.104314+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 6440, "display_filter": "frame.number == 6440", "timestamp_epoch": "1541624861.311811000" }, { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" }, { "tcp_stream": 122, "frame_number": 6499, "display_filter": "frame.number == 6499", "timestamp_epoch": "1541624861.460273000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:36.099221+00:00" }, { "observable_id": "observable-401b761c8d6def0363683e3e", "type": "domain", "value": "dsum-sec.casalemedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:17.077543+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.113351+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 6437, "display_filter": "frame.number == 6437", "timestamp_epoch": "1541624861.269826000" }, { "udp_stream": 99, "frame_number": 6445, "display_filter": "frame.number == 6445", "timestamp_epoch": "1541624861.327626000" }, { "tcp_stream": 121, "frame_number": 6453, "display_filter": "frame.number == 6453", "timestamp_epoch": "1541624861.343026000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:36.109151+00:00" }, { "observable_id": "observable-8283bcde47981a990a8a330f", "type": "domain", "value": "edbmwhcwe.geeographic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 3454, "display_filter": "frame.number == 3454", "timestamp_epoch": "1541624800.934850000" }, { "udp_stream": 77, "frame_number": 3456, "display_filter": "frame.number == 3456", "timestamp_epoch": "1541624800.935321000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b2ef3c2997bed73b7cd94029", "type": "domain", "value": "edbmwhcwe.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 79, "frame_number": 3458, "display_filter": "frame.number == 3458", "timestamp_epoch": "1541624800.935933000" }, { "udp_stream": 79, "frame_number": 3462, "display_filter": "frame.number == 3462", "timestamp_epoch": "1541624800.976625000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d7f19f8f3ad18e111995475f", "type": "domain", "value": "encrypted-tbn0.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:36.122796+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.119516+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 86, "frame_number": 3810, "display_filter": "frame.number == 3810", "timestamp_epoch": "1541624811.266452000" }, { "udp_stream": 86, "frame_number": 3827, "display_filter": "frame.number == 3827", "timestamp_epoch": "1541624811.300199000" }, { "tcp_stream": 96, "frame_number": 3841, "display_filter": "frame.number == 3841", "timestamp_epoch": "1541624811.316700000" }, { "tcp_stream": 95, "frame_number": 3848, "display_filter": "frame.number == 3848", "timestamp_epoch": "1541624811.318524000" }, { "tcp_stream": 94, "frame_number": 3850, "display_filter": "frame.number == 3850", "timestamp_epoch": "1541624811.318892000" }, { "tcp_stream": 97, "frame_number": 3852, "display_filter": "frame.number == 3852", "timestamp_epoch": "1541624811.319555000" }, { "tcp_stream": 98, "frame_number": 3854, "display_filter": "frame.number == 3854", "timestamp_epoch": "1541624811.319863000" }, { "tcp_stream": 99, "frame_number": 3858, "display_filter": "frame.number == 3858", "timestamp_epoch": "1541624811.322264000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:36.116352+00:00" }, { "observable_id": "observable-20db76c9fa45a8a6c1564856", "type": "domain", "value": "fast.fonts.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:36.297808+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.293042+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 106, "frame_number": 9068, "display_filter": "frame.number == 9068", "timestamp_epoch": "1541624907.773895000" }, { "udp_stream": 106, "frame_number": 9070, "display_filter": "frame.number == 9070", "timestamp_epoch": "1541624907.820322000" }, { "tcp_stream": 133, "frame_number": 9074, "display_filter": "frame.number == 9074", "timestamp_epoch": "1541624907.838644000" }, { "tcp_stream": 136, "frame_number": 9359, "display_filter": "frame.number == 9359", "timestamp_epoch": "1541624908.372161000" }, { "tcp_stream": 139, "frame_number": 9364, "display_filter": "frame.number == 9364", "timestamp_epoch": "1541624908.372476000" }, { "tcp_stream": 135, "frame_number": 9366, "display_filter": "frame.number == 9366", "timestamp_epoch": "1541624908.372709000" }, { "tcp_stream": 137, "frame_number": 9368, "display_filter": "frame.number == 9368", "timestamp_epoch": "1541624908.372911000" }, { "tcp_stream": 138, "frame_number": 9370, "display_filter": "frame.number == 9370", "timestamp_epoch": "1541624908.373123000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:36.285390+00:00" }, { "observable_id": "observable-caa6f83142fc298c4f8d6504", "type": "domain", "value": "ferranorga.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:36.516907+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.512288+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 2550, "display_filter": "frame.number == 2550", "timestamp_epoch": "1541624403.524417000" }, { "udp_stream": 52, "frame_number": 2551, "display_filter": "frame.number == 2551", "timestamp_epoch": "1541624403.692275000" }, { "tcp_stream": 70, "frame_number": 2555, "display_filter": "frame.number == 2555", "timestamp_epoch": "1541624403.848059000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:36.507919+00:00" }, { "observable_id": "observable-f0c2c98739377c14851c6e78", "type": "domain", "value": "fonts.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:19.985832+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.688622+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 2954, "display_filter": "frame.number == 2954", "timestamp_epoch": "1541624794.787349000" }, { "udp_stream": 71, "frame_number": 2962, "display_filter": "frame.number == 2962", "timestamp_epoch": "1541624794.815584000" }, { "tcp_stream": 84, "frame_number": 2966, "display_filter": "frame.number == 2966", "timestamp_epoch": "1541624794.830765000" }, { "tcp_stream": 85, "frame_number": 2980, "display_filter": "frame.number == 2980", "timestamp_epoch": "1541624794.886781000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:36.683720+00:00" }, { "observable_id": "observable-c81f277ed56b871944bf40fd", "type": "domain", "value": "geeographic-dc.geeographic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1541623247.095753000" }, { "udp_stream": 3, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1541623247.096007000" }, { "udp_stream": 20, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1541623250.618469000" }, { "udp_stream": 20, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1541623250.618757000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fb2fb7f3e57387b2a384320b", "type": "domain", "value": "geeographic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:34.305225+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:34.132589+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.128121+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 437, "display_filter": "frame.number == 437", "timestamp_epoch": "1541623254.974894000" }, { "udp_stream": 26, "frame_number": 438, "display_filter": "frame.number == 438", "timestamp_epoch": "1541623254.977431000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:34.121196+00:00" }, { "observable_id": "observable-927075e4570c73901fc890ea", "type": "domain", "value": "gstaticadssl.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 2962, "display_filter": "frame.number == 2962", "timestamp_epoch": "1541624794.815584000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-134ab603116d577cb84b3abf", "type": "domain", "value": "id.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:36.697516+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.694745+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 85, "frame_number": 3703, "display_filter": "frame.number == 3703", "timestamp_epoch": "1541624810.869330000" }, { "udp_stream": 85, "frame_number": 3706, "display_filter": "frame.number == 3706", "timestamp_epoch": "1541624810.900411000" }, { "tcp_stream": 93, "frame_number": 3711, "display_filter": "frame.number == 3711", "timestamp_epoch": "1541624810.915240000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:36.692069+00:00" }, { "observable_id": "observable-2ec5ce5638b273e2fc69bd9e", "type": "domain", "value": "id.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 85, "frame_number": 3706, "display_filter": "frame.number == 3706", "timestamp_epoch": "1541624810.900411000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b69e3469f6f679e84580c258", "type": "domain", "value": "imap.aol.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:36.880362+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.876270+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 684, "display_filter": "frame.number == 684", "timestamp_epoch": "1541623305.055861000" }, { "udp_stream": 31, "frame_number": 685, "display_filter": "frame.number == 685", "timestamp_epoch": "1541623305.080372000" }, { "tcp_stream": 44, "frame_number": 689, "display_filter": "frame.number == 689", "timestamp_epoch": "1541623305.152933000" }, { "tcp_stream": 45, "frame_number": 717, "display_filter": "frame.number == 717", "timestamp_epoch": "1541623306.028695000" }, { "tcp_stream": 49, "frame_number": 1131, "display_filter": "frame.number == 1131", "timestamp_epoch": "1541623531.994660000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:36.871963+00:00" }, { "observable_id": "observable-9e2d9d2504ccc2c01b6451be", "type": "domain", "value": "insight-760077375.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2571d9fa8179fcc9138c955e", "type": "domain", "value": "insight.adsrvr.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:23.280099+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.050886+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 5689, "display_filter": "frame.number == 5689", "timestamp_epoch": "1541624860.650537000" }, { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" }, { "tcp_stream": 112, "frame_number": 5843, "display_filter": "frame.number == 5843", "timestamp_epoch": "1541624860.734280000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:37.048032+00:00" }, { "observable_id": "observable-8ea53542fc7a141e790b4f82", "type": "domain", "value": "internal-aol.imap.mail.g03.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 685, "display_filter": "frame.number == 685", "timestamp_epoch": "1541623305.080372000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a3b4702643dc5acea095fede", "type": "domain", "value": "isatap.geeographic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 21, "frame_number": 415, "display_filter": "frame.number == 415", "timestamp_epoch": "1541623250.627375000" }, { "udp_stream": 21, "frame_number": 416, "display_filter": "frame.number == 416", "timestamp_epoch": "1541623250.627639000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-755d2fe7448e4ca825360e2f", "type": "domain", "value": "isatap.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 417, "display_filter": "frame.number == 417", "timestamp_epoch": "1541623250.774107000" }, { "udp_stream": 22, "frame_number": 418, "display_filter": "frame.number == 418", "timestamp_epoch": "1541623250.791929000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-47020b9605b5e1edd8450f8f", "type": "domain", "value": "ivtqfoqdro.geeographic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 2762, "display_filter": "frame.number == 2762", "timestamp_epoch": "1541624769.235989000" }, { "udp_stream": 60, "frame_number": 2763, "display_filter": "frame.number == 2763", "timestamp_epoch": "1541624769.236532000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-27c3e2c7e8b4e3e2e2316642", "type": "domain", "value": "ivtqfoqdro.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 2765, "display_filter": "frame.number == 2765", "timestamp_epoch": "1541624769.238088000" }, { "udp_stream": 62, "frame_number": 2771, "display_filter": "frame.number == 2771", "timestamp_epoch": "1541624769.445040000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e972fea16b78401a5908f612", "type": "domain", "value": "link.sandwseafood.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:37.058363+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.056410+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 54, "frame_number": 2627, "display_filter": "frame.number == 2627", "timestamp_epoch": "1541624602.394148000" }, { "udp_stream": 54, "frame_number": 2628, "display_filter": "frame.number == 2628", "timestamp_epoch": "1541624602.506125000" }, { "tcp_stream": 74, "frame_number": 2632, "display_filter": "frame.number == 2632", "timestamp_epoch": "1541624602.665026000" }, { "tcp_stream": 75, "frame_number": 2654, "display_filter": "frame.number == 2654", "timestamp_epoch": "1541624603.809458000" }, { "tcp_stream": 76, "frame_number": 2673, "display_filter": "frame.number == 2673", "timestamp_epoch": "1541624614.990563000" }, { "tcp_stream": 141, "frame_number": 10188, "display_filter": "frame.number == 10188", "timestamp_epoch": "1541625603.803940000" }, { "tcp_stream": 142, "frame_number": 10203, "display_filter": "frame.number == 10203", "timestamp_epoch": "1541625614.954030000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:37.054114+00:00" }, { "observable_id": "observable-4663fbcd1880377d6c888fe2", "type": "domain", "value": "loadm.exelator.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:37.438315+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.433701+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 6442, "display_filter": "frame.number == 6442", "timestamp_epoch": "1541624861.318587000" }, { "udp_stream": 102, "frame_number": 6456, "display_filter": "frame.number == 6456", "timestamp_epoch": "1541624861.362801000" }, { "tcp_stream": 124, "frame_number": 6484, "display_filter": "frame.number == 6484", "timestamp_epoch": "1541624861.422233000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:37.428771+00:00" }, { "observable_id": "observable-551ad5b02ec2c58d1fd58f7a", "type": "domain", "value": "match-975362022.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fd17edd3a7909b774bd4d51c", "type": "domain", "value": "match.adsrvr.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:37.626520+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.622199+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 6307, "display_filter": "frame.number == 6307", "timestamp_epoch": "1541624861.058439000" }, { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" }, { "tcp_stream": 120, "frame_number": 6400, "display_filter": "frame.number == 6400", "timestamp_epoch": "1541624861.137244000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:37.616206+00:00" }, { "observable_id": "observable-7974c5100630fcfb9d3542e3", "type": "domain", "value": "myip.opendns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 48, "frame_number": 2244, "display_filter": "frame.number == 2244", "timestamp_epoch": "1541623797.408013000" }, { "udp_stream": 48, "frame_number": 2245, "display_filter": "frame.number == 2245", "timestamp_epoch": "1541623797.426200000" }, { "udp_stream": 49, "frame_number": 2246, "display_filter": "frame.number == 2246", "timestamp_epoch": "1541623797.429411000" }, { "udp_stream": 49, "frame_number": 2247, "display_filter": "frame.number == 2247", "timestamp_epoch": "1541623797.443366000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-868f3c184b822687e2d47ae1", "type": "domain", "value": "myip.opendns.com.geeographic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 2240, "display_filter": "frame.number == 2240", "timestamp_epoch": "1541623797.246789000" }, { "udp_stream": 46, "frame_number": 2241, "display_filter": "frame.number == 2241", "timestamp_epoch": "1541623797.371219000" }, { "udp_stream": 47, "frame_number": 2242, "display_filter": "frame.number == 2242", "timestamp_epoch": "1541623797.371808000" }, { "udp_stream": 47, "frame_number": 2243, "display_filter": "frame.number == 2243", "timestamp_epoch": "1541623797.407306000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad82dd55de80ef0b80f5b11b", "type": "domain", "value": "pagead.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 96, "frame_number": 6044, "display_filter": "frame.number == 6044", "timestamp_epoch": "1541624860.904837000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ba08407c922e0c0aaf50bda7", "type": "domain", "value": "pagead46.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 3416, "display_filter": "frame.number == 3416", "timestamp_epoch": "1541624795.663259000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-18efee90dbc224c812f4d720", "type": "domain", "value": "pixel-a.basis.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:37.821359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.816812+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 94, "frame_number": 5714, "display_filter": "frame.number == 5714", "timestamp_epoch": "1541624860.665729000" }, { "udp_stream": 94, "frame_number": 5835, "display_filter": "frame.number == 5835", "timestamp_epoch": "1541624860.731333000" }, { "tcp_stream": 114, "frame_number": 5923, "display_filter": "frame.number == 5923", "timestamp_epoch": "1541624860.790028000" }, { "tcp_stream": 115, "frame_number": 5936, "display_filter": "frame.number == 5936", "timestamp_epoch": "1541624860.797458000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:37.812393+00:00" }, { "observable_id": "observable-09ba2869e24c38b49f7f0ad1", "type": "domain", "value": "pixel.sitescout.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:38.050346+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.045163+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 97, "frame_number": 6296, "display_filter": "frame.number == 6296", "timestamp_epoch": "1541624861.024210000" }, { "udp_stream": 97, "frame_number": 6297, "display_filter": "frame.number == 6297", "timestamp_epoch": "1541624861.024460000" }, { "tcp_stream": 118, "frame_number": 6312, "display_filter": "frame.number == 6312", "timestamp_epoch": "1541624861.082125000" }, { "tcp_stream": 119, "frame_number": 6317, "display_filter": "frame.number == 6317", "timestamp_epoch": "1541624861.082743000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:38.040614+00:00" }, { "observable_id": "observable-6b213329f8d22d5bad109f74", "type": "domain", "value": "pixel.tapad.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:38.238141+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.233314+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 101, "frame_number": 6441, "display_filter": "frame.number == 6441", "timestamp_epoch": "1541624861.312992000" }, { "udp_stream": 101, "frame_number": 6460, "display_filter": "frame.number == 6460", "timestamp_epoch": "1541624861.372243000" }, { "tcp_stream": 126, "frame_number": 6468, "display_filter": "frame.number == 6468", "timestamp_epoch": "1541624861.391564000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:38.228384+00:00" }, { "observable_id": "observable-d06ade1561025e6077eb8525", "type": "domain", "value": "plus.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 3302, "display_filter": "frame.number == 3302", "timestamp_epoch": "1541624795.441778000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9d49e155431abab2cf841cd9", "type": "domain", "value": "qigpzlvhnkqxpl.geeographic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 2764, "display_filter": "frame.number == 2764", "timestamp_epoch": "1541624769.238004000" }, { "udp_stream": 61, "frame_number": 2766, "display_filter": "frame.number == 2766", "timestamp_epoch": "1541624769.238347000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-55809c00873a0abf57178408", "type": "domain", "value": "qigpzlvhnkqxpl.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 2769, "display_filter": "frame.number == 2769", "timestamp_epoch": "1541624769.239971000" }, { "udp_stream": 64, "frame_number": 2772, "display_filter": "frame.number == 2772", "timestamp_epoch": "1541624769.445501000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-26e5b1aeff31f687528bb655", "type": "domain", "value": "qwpvlqamqfnzxfk.geeographic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 2767, "display_filter": "frame.number == 2767", "timestamp_epoch": "1541624769.238681000" }, { "udp_stream": 63, "frame_number": 2768, "display_filter": "frame.number == 2768", "timestamp_epoch": "1541624769.238877000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4500c065091a9f7c5281d54b", "type": "domain", "value": "qwpvlqamqfnzxfk.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 2770, "display_filter": "frame.number == 2770", "timestamp_epoch": "1541624769.240233000" }, { "udp_stream": 65, "frame_number": 2775, "display_filter": "frame.number == 2775", "timestamp_epoch": "1541624769.529988000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ea2200a8ad9b4f16d8e6ad6e", "type": "domain", "value": "resolver1.opendns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 2236, "display_filter": "frame.number == 2236", "timestamp_epoch": "1541623797.206687000" }, { "udp_stream": 44, "frame_number": 2237, "display_filter": "frame.number == 2237", "timestamp_epoch": "1541623797.226998000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-62d4ef8b4d73fa960059bd78", "type": "domain", "value": "rtelyse.geeographic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 76, "frame_number": 3453, "display_filter": "frame.number == 3453", "timestamp_epoch": "1541624800.934735000" }, { "udp_stream": 76, "frame_number": 3455, "display_filter": "frame.number == 3455", "timestamp_epoch": "1541624800.935184000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b7048f537968a47172b9d54c", "type": "domain", "value": "rtelyse.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 3457, "display_filter": "frame.number == 3457", "timestamp_epoch": "1541624800.935729000" }, { "udp_stream": 78, "frame_number": 3465, "display_filter": "frame.number == 3465", "timestamp_epoch": "1541624800.977934000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6968f4fb2f3c066fbd38903e", "type": "domain", "value": "shumbildac.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:33.483164+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:33.219839+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.216908+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 1242, "display_filter": "frame.number == 1242", "timestamp_epoch": "1541623630.882323000" }, { "udp_stream": 33, "frame_number": 1243, "display_filter": "frame.number == 1243", "timestamp_epoch": "1541623631.425241000" }, { "tcp_stream": 51, "frame_number": 1247, "display_filter": "frame.number == 1247", "timestamp_epoch": "1541623631.752689000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:33.213911+00:00" }, { "observable_id": "observable-7c0dbfd21c4682b2054a9f52", "type": "domain", "value": "smtp.aol.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:38.419950+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.415176+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1028, "display_filter": "frame.number == 1028", "timestamp_epoch": "1541623378.925900000" }, { "udp_stream": 32, "frame_number": 1029, "display_filter": "frame.number == 1029", "timestamp_epoch": "1541623379.015119000" }, { "tcp_stream": 48, "frame_number": 1033, "display_filter": "frame.number == 1033", "timestamp_epoch": "1541623379.090748000" }, { "tcp_stream": 50, "frame_number": 1190, "display_filter": "frame.number == 1190", "timestamp_epoch": "1541623552.063814000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:38.410199+00:00" }, { "observable_id": "observable-5e9c2ec899b3ebb34dbaccf0", "type": "domain", "value": "ssl.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:44.559966+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.590976+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 3005, "display_filter": "frame.number == 3005", "timestamp_epoch": "1541624794.905693000" }, { "udp_stream": 73, "frame_number": 3028, "display_filter": "frame.number == 3028", "timestamp_epoch": "1541624794.934417000" }, { "tcp_stream": 87, "frame_number": 3036, "display_filter": "frame.number == 3036", "timestamp_epoch": "1541624794.952834000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:38.588914+00:00" }, { "observable_id": "observable-6dd04867ae87187c3f27ca5d", "type": "domain", "value": "stats.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:38.596218+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.594573+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 95, "frame_number": 5715, "display_filter": "frame.number == 5715", "timestamp_epoch": "1541624860.667178000" }, { "udp_stream": 95, "frame_number": 5783, "display_filter": "frame.number == 5783", "timestamp_epoch": "1541624860.705335000" }, { "tcp_stream": 113, "frame_number": 5895, "display_filter": "frame.number == 5895", "timestamp_epoch": "1541624860.759852000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:38.592919+00:00" }, { "observable_id": "observable-7869f6ad61164639fda129c0", "type": "domain", "value": "stats.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 95, "frame_number": 5783, "display_filter": "frame.number == 5783", "timestamp_epoch": "1541624860.705335000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f5b6ee48e7d40263a95b34b5", "type": "domain", "value": "sync.teads.tv", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:38.794851+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.791684+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 6443, "display_filter": "frame.number == 6443", "timestamp_epoch": "1541624861.318677000" }, { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" }, { "tcp_stream": 125, "frame_number": 6478, "display_filter": "frame.number == 6478", "timestamp_epoch": "1541624861.417726000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:38.787215+00:00" }, { "observable_id": "observable-5ae3daa0e9eb17c965f20dd2", "type": "domain", "value": "tmencedfur.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:38.977425+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.973257+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 50, "frame_number": 2249, "display_filter": "frame.number == 2249", "timestamp_epoch": "1541623797.536622000" }, { "udp_stream": 50, "frame_number": 2252, "display_filter": "frame.number == 2252", "timestamp_epoch": "1541623797.918025000" }, { "tcp_stream": 57, "frame_number": 2256, "display_filter": "frame.number == 2256", "timestamp_epoch": "1541623798.099564000" }, { "tcp_stream": 59, "frame_number": 2335, "display_filter": "frame.number == 2335", "timestamp_epoch": "1541623799.430172000" }, { "tcp_stream": 60, "frame_number": 2354, "display_filter": "frame.number == 2354", "timestamp_epoch": "1541623810.459537000" }, { "tcp_stream": 61, "frame_number": 2380, "display_filter": "frame.number == 2380", "timestamp_epoch": "1541623999.415441000" }, { "tcp_stream": 62, "frame_number": 2395, "display_filter": "frame.number == 2395", "timestamp_epoch": "1541624000.439640000" }, { "tcp_stream": 64, "frame_number": 2440, "display_filter": "frame.number == 2440", "timestamp_epoch": "1541624200.447606000" }, { "tcp_stream": 65, "frame_number": 2455, "display_filter": "frame.number == 2455", "timestamp_epoch": "1541624201.459241000" }, { "tcp_stream": 66, "frame_number": 2472, "display_filter": "frame.number == 2472", "timestamp_epoch": "1541624212.416891000" }, { "tcp_stream": 67, "frame_number": 2495, "display_filter": "frame.number == 2495", "timestamp_epoch": "1541624223.761992000" }, { "tcp_stream": 68, "frame_number": 2523, "display_filter": "frame.number == 2523", "timestamp_epoch": "1541624401.469751000" }, { "tcp_stream": 69, "frame_number": 2538, "display_filter": "frame.number == 2538", "timestamp_epoch": "1541624402.562901000" }, { "tcp_stream": 72, "frame_number": 2573, "display_filter": "frame.number == 2573", "timestamp_epoch": "1541624414.707664000" }, { "tcp_stream": 73, "frame_number": 2600, "display_filter": "frame.number == 2600", "timestamp_epoch": "1541624425.693132000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:38.967792+00:00" }, { "observable_id": "observable-ec542fdb8af56d18e58b5d45", "type": "domain", "value": "translate.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:39.290280+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.288231+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 69, "frame_number": 2789, "display_filter": "frame.number == 2789", "timestamp_epoch": "1541624778.193456000" }, { "udp_stream": 69, "frame_number": 2790, "display_filter": "frame.number == 2790", "timestamp_epoch": "1541624778.225835000" }, { "tcp_stream": 80, "frame_number": 2794, "display_filter": "frame.number == 2794", "timestamp_epoch": "1541624778.242052000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:39.285415+00:00" }, { "observable_id": "observable-b58b39a6773e532d00f719cc", "type": "domain", "value": "wpad.geeographic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 18, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1541623249.980468000" }, { "udp_stream": 18, "frame_number": 407, "display_filter": "frame.number == 407", "timestamp_epoch": "1541623249.980801000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5e60ce220fc2f405d8148d64", "type": "domain", "value": "www-google-analytics.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 5275, "display_filter": "frame.number == 5275", "timestamp_epoch": "1541624860.397205000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-615388b4ee66a255a27857f4", "type": "domain", "value": "www.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 1714, "display_filter": "frame.number == 1714", "timestamp_epoch": "1541623703.056771000" }, { "udp_stream": 39, "frame_number": 1715, "display_filter": "frame.number == 1715", "timestamp_epoch": "1541623703.057682000" }, { "udp_stream": 41, "frame_number": 1717, "display_filter": "frame.number == 1717", "timestamp_epoch": "1541623703.060728000" }, { "udp_stream": 42, "frame_number": 1718, "display_filter": "frame.number == 1718", "timestamp_epoch": "1541623703.061311000" }, { "udp_stream": 39, "frame_number": 1721, "display_filter": "frame.number == 1721", "timestamp_epoch": "1541623703.101869000" }, { "udp_stream": 41, "frame_number": 1722, "display_filter": "frame.number == 1722", "timestamp_epoch": "1541623703.101986000" }, { "udp_stream": 42, "frame_number": 1723, "display_filter": "frame.number == 1723", "timestamp_epoch": "1541623703.102105000" }, { "udp_stream": 38, "frame_number": 1724, "display_filter": "frame.number == 1724", "timestamp_epoch": "1541623703.102190000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0a3bb044e7438ac406e39af2", "type": "domain", "value": "www.download.windowsupdate.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:30.124643+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.454137+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 51, "frame_number": 2265, "display_filter": "frame.number == 2265", "timestamp_epoch": "1541623798.514101000" }, { "udp_stream": 51, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1541623798.576317000" }, { "tcp_stream": 58, "frame_number": 2270, "display_filter": "frame.number == 2270", "timestamp_epoch": "1541623798.594440000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:39.447797+00:00" }, { "observable_id": "observable-94c40bdfee6ade1aab13c77d", "type": "domain", "value": "www.ferranorga.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:39.470054+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.465372+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 53, "frame_number": 2559, "display_filter": "frame.number == 2559", "timestamp_epoch": "1541624404.006477000" }, { "udp_stream": 53, "frame_number": 2560, "display_filter": "frame.number == 2560", "timestamp_epoch": "1541624404.222937000" }, { "tcp_stream": 71, "frame_number": 2564, "display_filter": "frame.number == 2564", "timestamp_epoch": "1541624404.370399000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:39.459807+00:00" }, { "observable_id": "observable-1e31c933b7cc675cb0ce5d21", "type": "domain", "value": "www.google-analytics.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:55.888530+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.648573+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 5271, "display_filter": "frame.number == 5271", "timestamp_epoch": "1541624860.364107000" }, { "udp_stream": 90, "frame_number": 5275, "display_filter": "frame.number == 5275", "timestamp_epoch": "1541624860.397205000" }, { "tcp_stream": 109, "frame_number": 5284, "display_filter": "frame.number == 5284", "timestamp_epoch": "1541624860.425130000" }, { "tcp_stream": 109, "frame_number": 5617, "display_filter": "frame.number == 5617", "timestamp_epoch": "1541624860.618251000" }, { "tcp_stream": 109, "frame_number": 8057, "display_filter": "frame.number == 8057", "timestamp_epoch": "1541624866.166359000" }, { "tcp_stream": 109, "frame_number": 8105, "display_filter": "frame.number == 8105", "timestamp_epoch": "1541624887.715261000" }, { "tcp_stream": 109, "frame_number": 8669, "display_filter": "frame.number == 8669", "timestamp_epoch": "1541624894.195169000" }, { "tcp_stream": 134, "frame_number": 9350, "display_filter": "frame.number == 9350", "timestamp_epoch": "1541624908.366512000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:39.646337+00:00" }, { "observable_id": "observable-d70db8e6142b8baa844ac221", "type": "domain", "value": "www.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:45.279334+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "www.google.com", "target": "meet.google.com-join.us", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.usercontent.google.com/download?id=1RsoI3BAuH3uMNc6wdwwamUtsJhL6hHiB&export=download&confirm=t&uuid=32ec83bf-6d8e-4069-ac04-2cc059ae19e5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/claudemacos", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/brewpage", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/version-0105", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/hiddenhub", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xnewbrenow", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/mellerbrew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clodemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbreshamewmew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/onemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clavdenbewvews", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-deskt-ver-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/deutchbremac", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-ver-un-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-ver-un-v25", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbrewmacboe", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/claumacxvsz", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/payforwin", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbiernlk", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/newpayservices.com/cdx-biz-ver-un-v27", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/newappclaude.com/clau-ver-un-30", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7T", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/mehrmarkenwerkstattheiligensta/home", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/facturacion2026mx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.652487+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 59, "frame_number": 2742, "display_filter": "frame.number == 2742", "timestamp_epoch": "1541624767.161679000" }, { "udp_stream": 59, "frame_number": 2743, "display_filter": "frame.number == 2743", "timestamp_epoch": "1541624767.479203000" }, { "tcp_stream": 79, "frame_number": 2747, "display_filter": "frame.number == 2747", "timestamp_epoch": "1541624767.495250000" }, { "tcp_stream": 83, "frame_number": 2844, "display_filter": "frame.number == 2844", "timestamp_epoch": "1541624794.519353000" }, { "tcp_stream": 88, "frame_number": 3048, "display_filter": "frame.number == 3048", "timestamp_epoch": "1541624794.961269000" }, { "tcp_stream": 91, "frame_number": 3576, "display_filter": "frame.number == 3576", "timestamp_epoch": "1541624810.118090000" }, { "tcp_stream": 92, "frame_number": 3590, "display_filter": "frame.number == 3590", "timestamp_epoch": "1541624810.149072000" }, { "tcp_stream": 100, "frame_number": 4467, "display_filter": "frame.number == 4467", "timestamp_epoch": "1541624844.620256000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:39.650701+00:00" }, { "observable_id": "observable-0c371a019d4be3c62e4ba2a7", "type": "domain", "value": "www.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:45.870621+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.656487+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 72, "frame_number": 3002, "display_filter": "frame.number == 3002", "timestamp_epoch": "1541624794.904273000" }, { "udp_stream": 72, "frame_number": 3029, "display_filter": "frame.number == 3029", "timestamp_epoch": "1541624794.934525000" }, { "tcp_stream": 86, "frame_number": 3040, "display_filter": "frame.number == 3040", "timestamp_epoch": "1541624794.954277000" }, { "tcp_stream": 101, "frame_number": 4489, "display_filter": "frame.number == 4489", "timestamp_epoch": "1541624853.888354000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:39.654921+00:00" }, { "observable_id": "observable-99aef14f278eca3ac854985c", "type": "domain", "value": "www.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.659633+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 423, "display_filter": "frame.number == 423", "timestamp_epoch": "1541623252.570392000" }, { "udp_stream": 24, "frame_number": 424, "display_filter": "frame.number == 424", "timestamp_epoch": "1541623252.644208000" }, { "tcp_stream": 27, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1541623252.666384000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:39.658128+00:00" }, { "observable_id": "observable-8d3ef54ed0a77d7397cf3097", "type": "domain", "value": "www.ucdenver.edu", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:33.663359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:33.492496+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.488133+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 88, "frame_number": 4538, "display_filter": "frame.number == 4538", "timestamp_epoch": "1541624858.580540000" }, { "udp_stream": 88, "frame_number": 4544, "display_filter": "frame.number == 4544", "timestamp_epoch": "1541624858.654111000" }, { "tcp_stream": 103, "frame_number": 4552, "display_filter": "frame.number == 4552", "timestamp_epoch": "1541624858.750822000" }, { "tcp_stream": 106, "frame_number": 4577, "display_filter": "frame.number == 4577", "timestamp_epoch": "1541624859.196686000" }, { "tcp_stream": 108, "frame_number": 4581, "display_filter": "frame.number == 4581", "timestamp_epoch": "1541624859.201803000" }, { "tcp_stream": 104, "frame_number": 4585, "display_filter": "frame.number == 4585", "timestamp_epoch": "1541624859.204941000" }, { "tcp_stream": 105, "frame_number": 4589, "display_filter": "frame.number == 4589", "timestamp_epoch": "1541624859.217138000" }, { "tcp_stream": 107, "frame_number": 4593, "display_filter": "frame.number == 4593", "timestamp_epoch": "1541624859.219621000" }, { "tcp_stream": 104, "frame_number": 4615, "display_filter": "frame.number == 4615", "timestamp_epoch": "1541624859.315195000" }, { "tcp_stream": 103, "frame_number": 4636, "display_filter": "frame.number == 4636", "timestamp_epoch": "1541624859.381889000" }, { "tcp_stream": 107, "frame_number": 4668, "display_filter": "frame.number == 4668", "timestamp_epoch": "1541624859.440397000" }, { "tcp_stream": 105, "frame_number": 4676, "display_filter": "frame.number == 4676", "timestamp_epoch": "1541624859.448624000" }, { "tcp_stream": 103, "frame_number": 4710, "display_filter": "frame.number == 4710", "timestamp_epoch": "1541624859.497098000" }, { "tcp_stream": 106, "frame_number": 4749, "display_filter": "frame.number == 4749", "timestamp_epoch": "1541624859.563108000" }, { "tcp_stream": 108, "frame_number": 4768, "display_filter": "frame.number == 4768", "timestamp_epoch": "1541624859.568418000" }, { "tcp_stream": 103, "frame_number": 4788, "display_filter": "frame.number == 4788", "timestamp_epoch": "1541624859.617568000" }, { "tcp_stream": 104, "frame_number": 4794, "display_filter": "frame.number == 4794", "timestamp_epoch": "1541624859.630828000" }, { "tcp_stream": 108, "frame_number": 4871, "display_filter": "frame.number == 4871", "timestamp_epoch": "1541624859.685949000" }, { "tcp_stream": 103, "frame_number": 4888, "display_filter": "frame.number == 4888", "timestamp_epoch": "1541624859.741750000" }, { "tcp_stream": 104, "frame_number": 4899, "display_filter": "frame.number == 4899", "timestamp_epoch": "1541624859.747203000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:33.483230+00:00" }, { "observable_id": "observable-62ddb04a807edcf58f91d080", "type": "domain", "value": "zotwyog.geeographic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 80, "frame_number": 3459, "display_filter": "frame.number == 3459", "timestamp_epoch": "1541624800.937038000" }, { "udp_stream": 80, "frame_number": 3460, "display_filter": "frame.number == 3460", "timestamp_epoch": "1541624800.937265000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b63c5f8ca7620e5c6438358", "type": "domain", "value": "zotwyog.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 3461, "display_filter": "frame.number == 3461", "timestamp_epoch": "1541624800.938209000" }, { "udp_stream": 81, "frame_number": 3464, "display_filter": "frame.number == 3464", "timestamp_epoch": "1541624800.977490000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-240037d2b9d191d2c54f92a6", "type": "ipv4", "value": "10.22.15.119", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 437, "display_filter": "frame.number == 437", "timestamp_epoch": "1541623254.974894000" }, { "udp_stream": 26, "frame_number": 438, "display_filter": "frame.number == 438", "timestamp_epoch": "1541623254.977431000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1b11e980c206a4a4638a6f00", "type": "ipv4", "value": "10.22.15.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1541623247.090323000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1541623247.091195000" }, { "udp_stream": 3, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1541623247.096007000" }, { "udp_stream": 7, "frame_number": 172, "display_filter": "frame.number == 172", "timestamp_epoch": "1541623247.429977000" }, { "udp_stream": 9, "frame_number": 176, "display_filter": "frame.number == 176", "timestamp_epoch": "1541623247.460829000" }, { "udp_stream": 11, "frame_number": 188, "display_filter": "frame.number == 188", "timestamp_epoch": "1541623247.541306000" }, { "udp_stream": 20, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1541623250.618757000" }, { "udp_stream": 25, "frame_number": 436, "display_filter": "frame.number == 436", "timestamp_epoch": "1541623254.972506000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a830bc3e9c272022bae610df", "type": "ipv4", "value": "10.22.15.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d5a590291f810175c03f0ede", "type": "ipv4", "value": "107.178.246.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:39.664824+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.663044+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 101, "frame_number": 6460, "display_filter": "frame.number == 6460", "timestamp_epoch": "1541624861.372243000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:39.661303+00:00" }, { "observable_id": "observable-d5ba35a22969dcc52b9136c7", "type": "ipv4", "value": "13.107.21.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 39, "frame_number": 1721, "display_filter": "frame.number == 1721", "timestamp_epoch": "1541623703.101869000" }, { "udp_stream": 41, "frame_number": 1722, "display_filter": "frame.number == 1722", "timestamp_epoch": "1541623703.101986000" }, { "udp_stream": 42, "frame_number": 1723, "display_filter": "frame.number == 1723", "timestamp_epoch": "1541623703.102105000" }, { "udp_stream": 38, "frame_number": 1724, "display_filter": "frame.number == 1724", "timestamp_epoch": "1541623703.102190000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1ea96aa254574842aab8bacd", "type": "ipv4", "value": "13.107.5.80", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 40, "frame_number": 1719, "display_filter": "frame.number == 1719", "timestamp_epoch": "1541623703.066561000" }, { "udp_stream": 37, "frame_number": 1720, "display_filter": "frame.number == 1720", "timestamp_epoch": "1541623703.066674000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4da0026cb9e4f177cea03e01", "type": "ipv4", "value": "131.107.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 681, "display_filter": "frame.number == 681", "timestamp_epoch": "1541623291.790021000" }, { "udp_stream": 34, "frame_number": 1698, "display_filter": "frame.number == 1698", "timestamp_epoch": "1541623657.522464000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5d0ed2184af875d1459e0664", "type": "ipv4", "value": "132.194.39.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:39.839555+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.835130+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 9028, "display_filter": "frame.number == 9028", "timestamp_epoch": "1541624907.124684000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:39.830115+00:00" }, { "observable_id": "observable-a5e011eaf34a9f65fb65b8dc", "type": "ipv4", "value": "132.194.7.45", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:33.892575+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:33.671792+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.667511+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 88, "frame_number": 4544, "display_filter": "frame.number == 4544", "timestamp_epoch": "1541624858.654111000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:33.663420+00:00" }, { "observable_id": "observable-0ff728c34b9268feadcac6bf", "type": "ipv4", "value": "172.217.15.194", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:40.025877+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:40.021621+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 96, "frame_number": 6044, "display_filter": "frame.number == 6044", "timestamp_epoch": "1541624860.904837000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:40.017077+00:00" }, { "observable_id": "observable-2020ab22b49b0fefabb9e0d2", "type": "ipv4", "value": "172.217.193.154", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 95, "frame_number": 5783, "display_filter": "frame.number == 5783", "timestamp_epoch": "1541624860.705335000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aa6c9123c582d80d90d3beee", "type": "ipv4", "value": "172.217.193.155", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:40.442285+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:40.437884+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 95, "frame_number": 5783, "display_filter": "frame.number == 5783", "timestamp_epoch": "1541624860.705335000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:40.430388+00:00" }, { "observable_id": "observable-4272154b7cc3ac9d68e91b44", "type": "ipv4", "value": "172.217.193.156", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 95, "frame_number": 5783, "display_filter": "frame.number == 5783", "timestamp_epoch": "1541624860.705335000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-35a46fa76936e2e39c26a9ed", "type": "ipv4", "value": "172.217.193.157", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 95, "frame_number": 5783, "display_filter": "frame.number == 5783", "timestamp_epoch": "1541624860.705335000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-088fb0e25ac0ffac788570e0", "type": "ipv4", "value": "172.217.2.68", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:40.642371+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:40.638077+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 59, "frame_number": 2743, "display_filter": "frame.number == 2743", "timestamp_epoch": "1541624767.479203000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:40.633365+00:00" }, { "observable_id": "observable-86921d45dce416f492ffe77d", "type": "ipv4", "value": "172.217.3.66", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:40.828983+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:40.826895+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 3416, "display_filter": "frame.number == 3416", "timestamp_epoch": "1541624795.663259000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:40.824688+00:00" }, { "observable_id": "observable-c0981e2d028bc3f9c59dd1c6", "type": "ipv4", "value": "172.217.3.67", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:41.044739+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.040800+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 3028, "display_filter": "frame.number == 3028", "timestamp_epoch": "1541624794.934417000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:41.036139+00:00" }, { "observable_id": "observable-3b6808bbf4b5b6620b4326d0", "type": "ipv4", "value": "192.162.244.171", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:41.261508+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.259802+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 1729, "display_filter": "frame.number == 1729", "timestamp_epoch": "1541623725.722135000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:41.257796+00:00" }, { "observable_id": "observable-e5b855bc8158da1812068f75", "type": "ipv4", "value": "204.79.197.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 39, "frame_number": 1721, "display_filter": "frame.number == 1721", "timestamp_epoch": "1541623703.101869000" }, { "udp_stream": 41, "frame_number": 1722, "display_filter": "frame.number == 1722", "timestamp_epoch": "1541623703.101986000" }, { "udp_stream": 42, "frame_number": 1723, "display_filter": "frame.number == 1723", "timestamp_epoch": "1541623703.102105000" }, { "udp_stream": 38, "frame_number": 1724, "display_filter": "frame.number == 1724", "timestamp_epoch": "1541623703.102190000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-85e4c4121a9e2dd073f8b77b", "type": "ipv4", "value": "208.67.222.222", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 2237, "display_filter": "frame.number == 2237", "timestamp_epoch": "1541623797.226998000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a35a2f1aa19a676ef93af986", "type": "ipv4", "value": "209.15.36.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:41.441659+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.437458+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 94, "frame_number": 5835, "display_filter": "frame.number == 5835", "timestamp_epoch": "1541624860.731333000" }, { "udp_stream": 97, "frame_number": 6297, "display_filter": "frame.number == 6297", "timestamp_epoch": "1541624861.024460000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:41.432520+00:00" }, { "observable_id": "observable-d7d11cd1fc9f237913cab2f6", "type": "ipv4", "value": "216.58.192.35", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:41.678099+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.674142+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 56, "frame_number": 2699, "display_filter": "frame.number == 2699", "timestamp_epoch": "1541624762.856918000" }, { "udp_stream": 71, "frame_number": 2962, "display_filter": "frame.number == 2962", "timestamp_epoch": "1541624794.815584000" }, { "udp_stream": 72, "frame_number": 3029, "display_filter": "frame.number == 3029", "timestamp_epoch": "1541624794.934525000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:41.669386+00:00" }, { "observable_id": "observable-deda4d116456054eff68fac8", "type": "ipv4", "value": "216.58.192.38", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:41.891343+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.887293+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 89, "frame_number": 5274, "display_filter": "frame.number == 5274", "timestamp_epoch": "1541624860.397101000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:41.882293+00:00" }, { "observable_id": "observable-74fbd116c6652cd54f09bc08", "type": "ipv4", "value": "216.58.192.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:42.194591+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:42.190425+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 69, "frame_number": 2790, "display_filter": "frame.number == 2790", "timestamp_epoch": "1541624778.225835000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:42.184332+00:00" }, { "observable_id": "observable-668f20c520a82d4f171bc13f", "type": "ipv4", "value": "216.58.192.45", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:42.394463+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:42.390430+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 57, "frame_number": 2719, "display_filter": "frame.number == 2719", "timestamp_epoch": "1541624763.152884000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:42.384650+00:00" }, { "observable_id": "observable-00d0b56c8c27cc813e704fd6", "type": "ipv4", "value": "216.58.192.46", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:42.767150+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:42.765185+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 3302, "display_filter": "frame.number == 3302", "timestamp_epoch": "1541624795.441778000" }, { "udp_stream": 86, "frame_number": 3827, "display_filter": "frame.number == 3827", "timestamp_epoch": "1541624811.300199000" }, { "udp_stream": 87, "frame_number": 4501, "display_filter": "frame.number == 4501", "timestamp_epoch": "1541624853.951935000" }, { "udp_stream": 90, "frame_number": 5275, "display_filter": "frame.number == 5275", "timestamp_epoch": "1541624860.397205000" }, { "udp_stream": 91, "frame_number": 5477, "display_filter": "frame.number == 5477", "timestamp_epoch": "1541624860.547098000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:42.761404+00:00" }, { "observable_id": "observable-00e6b1eab9f0fd7d4245946d", "type": "ipv4", "value": "216.58.192.67", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:42.955650+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:42.951136+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 85, "frame_number": 3706, "display_filter": "frame.number == 3706", "timestamp_epoch": "1541624810.900411000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:42.946419+00:00" }, { "observable_id": "observable-4d4ce0877215bfffa891b12a", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e849c5bf960dad3056d49e9e", "type": "ipv4", "value": "224.0.0.251", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3dffeb9c977b31b385fe6539", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a9daf1b54f3867ddcc7a6e82", "type": "ipv4", "value": "23.56.194.57", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:43.150147+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.144375+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 6445, "display_filter": "frame.number == 6445", "timestamp_epoch": "1541624861.327626000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:43.139047+00:00" }, { "observable_id": "observable-438b9022d048586258bde056", "type": "ipv4", "value": "239.255.255.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 2696, "display_filter": "frame.number == 2696", "timestamp_epoch": "1541624762.197551000" }, { "frame_number": 2726, "display_filter": "frame.number == 2726", "timestamp_epoch": "1541624763.200415000" }, { "frame_number": 2739, "display_filter": "frame.number == 2739", "timestamp_epoch": "1541624764.215092000" }, { "frame_number": 2740, "display_filter": "frame.number == 2740", "timestamp_epoch": "1541624765.218107000" }, { "frame_number": 2824, "display_filter": "frame.number == 2824", "timestamp_epoch": "1541624793.957286000" }, { "frame_number": 3045, "display_filter": "frame.number == 3045", "timestamp_epoch": "1541624794.958348000" }, { "frame_number": 3435, "display_filter": "frame.number == 3435", "timestamp_epoch": "1541624795.958880000" }, { "frame_number": 3436, "display_filter": "frame.number == 3436", "timestamp_epoch": "1541624796.959614000" }, { "frame_number": 9898, "display_filter": "frame.number == 9898", "timestamp_epoch": "1541624913.892827000" }, { "frame_number": 9904, "display_filter": "frame.number == 9904", "timestamp_epoch": "1541624914.893631000" }, { "frame_number": 9905, "display_filter": "frame.number == 9905", "timestamp_epoch": "1541624915.895001000" }, { "frame_number": 9906, "display_filter": "frame.number == 9906", "timestamp_epoch": "1541624916.896692000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4c59f19e5cdbfc1b1c151005", "type": "ipv4", "value": "255.255.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-36aae558a6cbd96b4ac20c18", "type": "ipv4", "value": "34.192.39.141", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:43.350424+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.345087+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:43.340832+00:00" }, { "observable_id": "observable-a96d57583105445b7e025ce9", "type": "ipv4", "value": "34.192.90.231", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5063a8135db33567ad13441c", "type": "ipv4", "value": "34.198.191.149", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2fe4c9d090f11f4bced89b60", "type": "ipv4", "value": "34.198.228.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8c4625b1431bf9e62048f2e8", "type": "ipv4", "value": "34.199.147.194", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e3e861f982f1964af8a47a10", "type": "ipv4", "value": "34.202.147.29", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c42f4f0e5081de895ec60ebe", "type": "ipv4", "value": "34.203.74.207", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d3af9f2951996373301fdcfc", "type": "ipv4", "value": "34.204.248.161", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-81649eae5a41469b60e29231", "type": "ipv4", "value": "34.205.99.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0461f6271b5f9c68eb5d5320", "type": "ipv4", "value": "34.224.172.188", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-55276904c0cca8e9ef7c902b", "type": "ipv4", "value": "34.227.43.215", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:43.540276+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.538539+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:43.535745+00:00" }, { "observable_id": "observable-d2c1c40d9e8c4b2b19307eb8", "type": "ipv4", "value": "34.236.63.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-16300952ed8342089811711b", "type": "ipv4", "value": "34.237.159.145", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bab59c6c22f7edabb0f3d668", "type": "ipv4", "value": "34.239.206.211", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e5a3048a0a292c7d2712825b", "type": "ipv4", "value": "35.168.218.13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-64b1fee25d38f3d2c13f19ed", "type": "ipv4", "value": "35.168.53.247", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-237a41d1d0424703199cacdf", "type": "ipv4", "value": "35.168.67.88", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 6449, "display_filter": "frame.number == 6449", "timestamp_epoch": "1541624861.335497000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5359461d8786517f3527f2b1", "type": "ipv4", "value": "35.171.180.138", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c8e93d4cfcd896ee9b62e06d", "type": "ipv4", "value": "46.229.214.92", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:43.733252+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.729119+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 54, "frame_number": 2628, "display_filter": "frame.number == 2628", "timestamp_epoch": "1541624602.506125000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:43.724347+00:00" }, { "observable_id": "observable-c3c30bb4425a57c616eceff2", "type": "ipv4", "value": "46.29.160.132", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:34.121111+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:33.900519+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.896621+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 1243, "display_filter": "frame.number == 1243", "timestamp_epoch": "1541623631.425241000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:33.892645+00:00" }, { "observable_id": "observable-0334862e1b5d13ee6652b009", "type": "ipv4", "value": "50.116.194.23", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:43.927593+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.923122+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 93, "frame_number": 5925, "display_filter": "frame.number == 5925", "timestamp_epoch": "1541624860.792162000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:43.918667+00:00" }, { "observable_id": "observable-3a5acee315413f1a53032c55", "type": "ipv4", "value": "52.0.244.217", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8d5d1f389eab9908c8d79e26", "type": "ipv4", "value": "52.20.145.225", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-87f4d98eceb1b246f654b9c8", "type": "ipv4", "value": "52.204.152.189", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9125d75bcf4d5ed0298ec84", "type": "ipv4", "value": "52.207.122.163", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3d0b7894639af765bef93085", "type": "ipv4", "value": "52.208.135.160", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bf43d7d277dbb3bf3ab9f3c9", "type": "ipv4", "value": "52.210.213.208", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-48308645d80dd8350defac8b", "type": "ipv4", "value": "52.210.34.59", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fe01852081f89ba181e400bb", "type": "ipv4", "value": "52.213.58.51", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c145993b649196eb7a3aa8c7", "type": "ipv4", "value": "52.214.151.124", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-abb2a3bfad9f88e2b25ea9ed", "type": "ipv4", "value": "52.30.113.91", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f344292eba6a0286ce82d581", "type": "ipv4", "value": "52.31.219.56", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7f643758348f5fe07be1474b", "type": "ipv4", "value": "52.4.55.137", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bc1ba3b8d697db9e480e94d3", "type": "ipv4", "value": "52.7.21.186", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 6458, "display_filter": "frame.number == 6458", "timestamp_epoch": "1541624861.368818000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-637914063aeed587fb60a80a", "type": "ipv4", "value": "52.72.190.60", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-635c6394d648b043115f8b7e", "type": "ipv4", "value": "54.194.108.5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 6447, "display_filter": "frame.number == 6447", "timestamp_epoch": "1541624861.329520000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8caacdd683ac68ead1ce5f37", "type": "ipv4", "value": "54.236.245.79", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-042756cea7f163316a81a755", "type": "ipv4", "value": "54.81.75.176", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 6328, "display_filter": "frame.number == 6328", "timestamp_epoch": "1541624861.092413000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5b47acd66181154a49b19b23", "type": "ipv4", "value": "54.85.197.245", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d8450b608418405e3788a125", "type": "ipv4", "value": "54.85.233.91", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1d7da79bbb8c0c045c69bf3e", "type": "ipv4", "value": "54.85.96.132", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-61b2fd9ec287fb2a38e01447", "type": "ipv4", "value": "54.86.197.0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 5746, "display_filter": "frame.number == 5746", "timestamp_epoch": "1541624860.680901000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1f22579e90fc92c7afba86e1", "type": "ipv4", "value": "62.149.140.59", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 2551, "display_filter": "frame.number == 2551", "timestamp_epoch": "1541624403.692275000" }, { "udp_stream": 53, "frame_number": 2560, "display_filter": "frame.number == 2560", "timestamp_epoch": "1541624404.222937000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-de949209917a7096fd60b219", "type": "ipv4", "value": "63.251.240.12", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 6456, "display_filter": "frame.number == 6456", "timestamp_epoch": "1541624861.362801000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-175f80099b2abc96ee4ea3eb", "type": "ipv4", "value": "66.218.86.51", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 685, "display_filter": "frame.number == 685", "timestamp_epoch": "1541623305.080372000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d5d5ec59c6e8f76eb497e155", "type": "ipv4", "value": "72.246.64.147", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 51, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1541623798.576317000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7a9bfce6cc5e3f74286ce188", "type": "ipv4", "value": "72.246.64.187", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 424, "display_filter": "frame.number == 424", "timestamp_epoch": "1541623252.644208000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2a80492895b8dc9f70b838ec", "type": "ipv4", "value": "72.246.64.227", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 424, "display_filter": "frame.number == 424", "timestamp_epoch": "1541623252.644208000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a2e944d6a0f34c63dc9a18aa", "type": "ipv4", "value": "72.246.64.48", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 51, "frame_number": 2266, "display_filter": "frame.number == 2266", "timestamp_epoch": "1541623798.576317000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cddf6b6870d0c6f3920d7e2b", "type": "ipv4", "value": "72.45.33.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 48, "frame_number": 2245, "display_filter": "frame.number == 2245", "timestamp_epoch": "1541623797.426200000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5fae8a8fc5e16aadb921ea24", "type": "ipv4", "value": "74.6.141.28", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 685, "display_filter": "frame.number == 685", "timestamp_epoch": "1541623305.080372000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-37aa9523f7ebb6f58a96a4a0", "type": "ipv4", "value": "74.6.141.50", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1029, "display_filter": "frame.number == 1029", "timestamp_epoch": "1541623379.015119000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3f7aa774d41205e14974187a", "type": "ipv4", "value": "93.184.216.182", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 106, "frame_number": 9070, "display_filter": "frame.number == 9070", "timestamp_epoch": "1541624907.820322000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-52c9a568bf49a162bc149d24", "type": "ipv4", "value": "95.181.198.115", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 50, "frame_number": 2252, "display_filter": "frame.number == 2252", "timestamp_epoch": "1541623797.918025000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-750a4ec20c4568ef5fb26567", "type": "ipv4", "value": "95.181.198.116", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a847ced3c6a38e63a5a68f58", "type": "ipv6", "value": "fd3e:4f5a:5b81::1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1541623291.810157000" }, { "udp_stream": 35, "frame_number": 1700, "display_filter": "frame.number == 1700", "timestamp_epoch": "1541623657.523396000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dba90df3dbc48406ba4d1b3a", "type": "sha256", "value": "009d4cdb69f30688198c7a19b25ef0667c5f7b172d65b2273ed2274bc8eb5425", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3d39863ed6cb5b6e89176b46", "type": "sha256", "value": "022d0a09ef989821ccf3e8bd48be89355052024fc688fe3c4c84c3da00a6e082", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-05803f057140ea5177605c2e", "type": "sha256", "value": "02717a94a92b22f6715c10f1483a4b252f61bd705675ae250af5411ff01de437", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3d936a86a11b17f6b18bff8f", "type": "sha256", "value": "05d5af0ab07517396f53c3e161f0ebc23c09242eae0c2372d7da26dd5786953e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c962ad1ad6f4f56986be2d55", "type": "sha256", "value": "0ba2f6756001669bdf934f9d79e8fd1ccf2028130c33a0510279581ec9dfd73a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2629b953cbafd24b26cc21c5", "type": "sha256", "value": "0c6da6b5d4f5db2accb9c1847cd2686c683d0875750b069f14339c5f75c93029", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:25.494748+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:25.184598+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:25.179826+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:25.174798+00:00" }, { "observable_id": "observable-9190e50a937f7382940b8897", "type": "sha256", "value": "10570ac15a02224c4743309c48c8b8eefeaa931d9f1db7238edd7b3fa6cd2ff7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8fc4c5a21b5077f013c9d40a", "type": "sha256", "value": "11065daca98f9840f58be03dd0fa78c710b9509ad517857acacf715c491de6d6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-49e7fc1b6ac7226959d94b17", "type": "sha256", "value": "1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c74b89c3722a8a04a0b43646", "type": "sha256", "value": "1519c5e27fa45f1ceb90ae78923c474e3f5597d45e6a8c61ad73367a432333b8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-360096253ad148edb5f7cf03", "type": "sha256", "value": "158494850d445b90585ee2d25e2969b3218808ccb0897c79ca240f7c3556d92b", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-707f5b38e3e2f4bdc68ebbb3", "type": "sha256", "value": "185f2b901d68c7451a492d90ed38aa2c1de840061735a06836c2587f958ed31c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:26.108862+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:25.903998+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:25.902023+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:25.899274+00:00" }, { "observable_id": "observable-d17f63fea1dfcbdac44d8d36", "type": "sha256", "value": "190a90d96675f28bb6ab1bab072f3b61ec321af3a8c3843a70248d9bb71bcdfe", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9a110cb010e47d0ecdcdee9f", "type": "sha256", "value": "198f44920d0d51bc49281f580acc760fd88a96e2422c8784114df6dab93ecc09", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-965f002a708861a6ef35c162", "type": "sha256", "value": "19fda88c2df63d85b7762799904408d0703f7efe7d6956d70c776458075747f3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e6568fb4359a07c59863e2c4", "type": "sha256", "value": "20f3807f724bf5bb6c8a2cf7f62bc8003717104ef480c7dfd1b8dab767144bbc", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:26.827609+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:26.524681+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:26.520652+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:26.515625+00:00" }, { "observable_id": "observable-ba88b51b69ded7cd01450392", "type": "sha256", "value": "2453e31f9c5e0dbee528d11f97a85edf897ed93406954ce8e475f0244abf249a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0413d87d41ad0e97055b56b0", "type": "sha256", "value": "24e819821e2f9afcfed4ad0e8490935378abfb0df723850078e731cfd9ef6edd", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8a280a9d89a1da1829dcd87b", "type": "sha256", "value": "25d7dc2c15716821face8630fbf2c166969dc0852e19c822e07982ea512da981", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a787d4b7a6ad68c2fc2ba933", "type": "sha256", "value": "2976d80beac91eed779d1f204cb2e1be813c53bb2e1dfe03334f2c30b4f995be", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-89784d2a9f78e1283cfb4e34", "type": "sha256", "value": "2e2e544728c5e5f5cfdc9ad2faf6063af99088e1c3edc32e5074e7ad541c18a0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2dca0b1460e3377b5d33c407", "type": "sha256", "value": "36d8e52a141bc54658ed41dde1654343bbd008af29f889f6e0a2f41441457ba6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b1a586e85f861c991c80ee5", "type": "sha256", "value": "37e9250c18e218e58fb1818a608e9ad463a4b4743ebf3c08ca738001cc8970e0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c642e3e67bb205b2d4a6355f", "type": "sha256", "value": "398cea3dc83051c117a65a9897bd17c84dace5d700ecd01943d1e47af57b5490", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3734e0a84465c84950b1813f", "type": "sha256", "value": "3c19c9d085f085252c974a1ae0637fa809cf09d3c461c64cbae6a011f7d0b78a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:27.334332+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:27.060266+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:27.056013+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:27.051166+00:00" }, { "observable_id": "observable-6e6f45a18c164450f71aee7f", "type": "sha256", "value": "3cd1a2527c206665892f1e9837f4e7cff960d7e5fa9df017c7b49e84845c0097", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b0fbdffde052a52558078e98", "type": "sha256", "value": "4004293f081201ead3df6f86daa9d3974bde048ae8187cda602dffb256324124", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac3297cbabd7340810f09eb1", "type": "sha256", "value": "46868c166bdd75230bd20064033f281d2d6ca30a512eee717871dac9da416955", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5704d3efe250ee2a5c32f85b", "type": "sha256", "value": "4935fdc24e4a4873c078817732e45651c05091b946eff4fb774476a31d52e769", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5a7753556598a85eb124b487", "type": "sha256", "value": "4e3d1cd476ae289fb9a9f4ce26b781659410914c81d11b4befc7735f4c71b2b1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-757d6f5410c57e42147362e8", "type": "sha256", "value": "517319eb8ff3d0b11dc60d148babdc714087e386977101e1d76428cdbff6b9c7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-109fd89e4573912aec62aba2", "type": "sha256", "value": "550ceb9559bb4237527909ff21e719804f6b9df337f741f756821c0c9963392b", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-373c0e9d969fb41a3785b167", "type": "sha256", "value": "561ffc13ce19398e938a84992b3791d95e9d6f7b904e3f79c9728dc0c23a8297", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-55ff1fca1270e6ab67083395", "type": "sha256", "value": "56bbf5dbefa7919f0b8666d9cfc272b0ddbc9e920a373c1ab701d960dc09ce3a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bd555395ad468d006faa0556", "type": "sha256", "value": "58c778f59b121390544d07cc4ff6948eb35045eafe376247ef285d4f72cfe167", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8c0da513bcfd5ccc427db6ca", "type": "sha256", "value": "5b107e17113a4c5a547d98a30bcd47aa3ad52317856828c762a67fda9f34baa0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:27.951731+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:27.754678+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:27.750839+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:27.746278+00:00" }, { "observable_id": "observable-23e1f495b2e41baac57a77f6", "type": "sha256", "value": "5c9486d0aa62b50180e77e62b15f9977b3b0fd3f7d9b1f797de4c41b7da02b7d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-adc148ebe12cc329dbf94409", "type": "sha256", "value": "5fedc714f715123098edf3d8ceffcc6f6c1d503513e3dee6077c0fb3a6fcdbec", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a61a641025e0c366165a5f1a", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c30345c9eb0f29185a48adfe", "type": "sha256", "value": "61f39b4c6a88443103c0260f69dfc9484012f6bddad680b567c3ababcf416b4e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-da6ae9cc1d75e4c6b7f8226b", "type": "sha256", "value": "65f5df3cd45f3b8bf27731651a76b32bdef821fdb79451fa160ee55ff30467e2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:28.548013+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:28.362091+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:28.360073+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:28.357531+00:00" }, { "observable_id": "observable-633b716aa40589397583cfc7", "type": "sha256", "value": "6cba436e9e5adbe296a382ece4309eb469ec3a0d37d3b14058800f9fd57338ab", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f05b30b3f2289d80cebec292", "type": "sha256", "value": "6f7307aed5e6e60222ef7d66e258362e1df71eabd5f7af0f33afa0fc6b8f65dd", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-431427755d624a5b68b2a65e", "type": "sha256", "value": "71ea89144415bcb2ea2585d7a5ca95b27ab2a10d7f826647bee8c9e78922c5a5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d4b9b0cdece8dc1d3a4ed573", "type": "sha256", "value": "72c3d8a0ee2408bcb595f51ec68806252c9b60a6be25b091f1d0a88655517f12", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4ddc4a97e98881564c48f3c6", "type": "sha256", "value": "7796b5c1eb8d9c8a896b17db41ae969690f2924a8690439ac4d5511935b236c3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5196dcb8050c21df8409a99a", "type": "sha256", "value": "79ff1591234ea9434d7f96516781130625b1880ba4fa8eb965b278337e11f8ae", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:29.088239+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:28.888821+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:28.887041+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:28.884741+00:00" }, { "observable_id": "observable-e3c4cf8100ab028800e504f7", "type": "sha256", "value": "7bacd1e07f7de2e51fcd1eafbcd9ec0aaad5c16ac4c4d846a86a5654a00506b4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1e3bfc95e633eff9cd4af48e", "type": "sha256", "value": "7df7e6f7c22f1938c2313beb743eb60040f607f2a703a5134c8842ce7e7946ab", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9146839524cf1a0e5e44021", "type": "sha256", "value": "7e0baff43a753a2dce0e85dbbd562a503c9f558f846784f3626c0b5d31c9d6d3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-78ea2da7ebef3d6af7671ff2", "type": "sha256", "value": "80bad0ee862dd92912bbecb161c17ce3d072b22aef1d48c3ab4c90f55939acae", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9c00a7cbc1127858732800ac", "type": "sha256", "value": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3de3dee2f2286414a98d19f4", "type": "sha256", "value": "833aae2efa9e7eb97334c8596c07bd22c09ffa2e771dc64fadcfa66d2ed2330e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dc539e2e53dda1c834b32a45", "type": "sha256", "value": "86a4c543d749c972e930c08df70d17f81c7eae19ea9854476eda897fd33fbfc5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bb0f4fd6b599a1df4bb1e63e", "type": "sha256", "value": "8768d73b262d33c7dceaedcbf83576d31129c8bef0d03be58e92a57a65bd81c2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:29.716033+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:29.497365+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:29.492068+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:29.486371+00:00" }, { "observable_id": "observable-8fb9a286794024771f820c02", "type": "sha256", "value": "8b6eb285d3afcd5e4d485846c70b442f4b6df4a636533493a6b45ff4808c8364", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0d733468c3d00c31850db7c7", "type": "sha256", "value": "8ba51e69c99c8a2fee83d5cd85f86d044a51c9979f845ca6abf75901ad83f84c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dc954f3cad0b3183fe7c5d4e", "type": "sha256", "value": "9145ac411c9596c70f7a57d91ddf00f4888aae4d852209ed6efdf99afad1f904", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6f419b0434a061a755e4695a", "type": "sha256", "value": "9557385d62733e77c3bb5b473d9bb2fa29bd51f8b010d221cbefe8297a454291", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d84934048cf597232891d317", "type": "sha256", "value": "97f149f146b0ec63c32abff204ae27638f0310536172b0f718f1a91a5672fe71", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:30.296308+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:30.086433+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:30.084166+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:30.081933+00:00" }, { "observable_id": "observable-5a0d94747b314d8d3b46e5cc", "type": "sha256", "value": "9a4e9990d71244aaa68b4bff6d5910665e7df9051cd4ee030e61b8e7f16180c1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5dfe4dabaa0aae2877f00d8d", "type": "sha256", "value": "9be5b65b630c074027b64f5544e24575e36aba498ee43b12167e82b40872e01f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e08f820be93834e7fb47e99b", "type": "sha256", "value": "9c086d962c942cff645dbd48b700191e96e3371b3d006e4eb3c7ac3c842057c9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9e69eebce2567c4eaf728987", "type": "sha256", "value": "9c16b72304e8dbf5ddce0e0614934eac07d641ef12c654398eda8df088f3c296", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8c88451fb1913a18dd4580d0", "type": "sha256", "value": "9d7c79b24ac12a185212ccab8741f4acdbd7ab160099e719bedd682806886ac9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d7896a8e1efc637b561dc13e", "type": "sha256", "value": "a417a78e9d645ffa38f11bbcd1e4bdd0295bb71e5a7dfd692b3495dac2ef4107", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aad877860927a75d909e1473", "type": "sha256", "value": "a630dac9b5b0fbea3974ad09401522aeda12f11bbe5344508829d575c03cd644", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2fe260de13b10d4960d2451c", "type": "sha256", "value": "aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ca1588f39b96b83cd0251bae", "type": "sha256", "value": "ac508fa266db568a28c4e52d7dd1fcc85dbfdc38f97e39892e60f94d904e11d5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-920519a2d890fbe34f26c0a2", "type": "sha256", "value": "b24190e46072d124308b908776b21a50d4cefa396934bf5fb788bf26c2e67c33", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4bd681bda4dd5af8825cdb03", "type": "sha256", "value": "b2aba18ac53e4abc1a631c98959e5411fc64efe761dbe216e1f559b1e2d7aef2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9fa2e5d5eba6174221797cce", "type": "sha256", "value": "b43e75f48fa68b71ee6e66751c0c3822314ca6dc592fce9309495baada78de54", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:30.924712+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:30.618260+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:30.614570+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:30.611049+00:00" }, { "observable_id": "observable-8efd3f188ee2fb742f8a9fdf", "type": "sha256", "value": "b5fcfa087b1cc0b1f61c17437c0a533c027dd68bb1e42898682bad189bacdf67", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-084d5dacb132a63c6f0472d9", "type": "sha256", "value": "b729bb6d682bc3df8fb04c7a940b3da0140284811d168a92929cfec7232237be", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-31ed6f1cfb021b5f88bc0e2e", "type": "sha256", "value": "b74056eea98bad621835b90b80499dad886c07ef70b5213bcde0408e63908c6f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:31.740334+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:31.442505+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:31.439136+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:31.434475+00:00" }, { "observable_id": "observable-b560c069a4053dfc9b0ed976", "type": "sha256", "value": "b943dd2830226be743c9bfcb5ffa4eec591e55d09a736ffecdfd3d8b6581da31", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6024d4d914088974e2db78e3", "type": "sha256", "value": "bd9ea8a38face9cb05cb209900b16b09b3bda1c247ddd7d2e2c95a82a3615cd3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9fa85d6da593203531ed2526", "type": "sha256", "value": "bfedb831c9a4afb407a127b04080c8f649d2134e713d4a1f810d9f670295cf7d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-576a2e73288d57b70ed6f000", "type": "sha256", "value": "c4d8dbe77feb63e5a61bee0bead4e5f66e8fa6a927599bd1b74aced52467273c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ee1668516c1bdb6002d59832", "type": "sha256", "value": "c4e63117b5fac36c75799cae97f4f0464bd9d6978b442fe6cf28078d0be7ac31", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bb2f58c47ed1d3f5854a15d3", "type": "sha256", "value": "c8e9a8b2cf530cc873941944744e8d053a34d2759194dae198e579c9e17399a2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-58a647220ad784a501e80f8b", "type": "sha256", "value": "ca0405f6832d0b1aaf7e5c00aa3241cccf19859dc47ca15ab3a90a9ffcbdf150", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9e438367c403e3736556685e", "type": "sha256", "value": "cbf768030ad75e8aec0263d9d2286c2b0106cf7ac4daa17396129b172a93d1a9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:32.295490+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:32.089801+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:32.087290+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:32.085219+00:00" }, { "observable_id": "observable-d00d6d4971cf8ac3b91d3296", "type": "sha256", "value": "d2e3bd61e7e0d4f908192813267d98927cc31043d84387b1a941e3b5b15f9134", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0a2b1ed7b1eacde687b7a739", "type": "sha256", "value": "d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-34b5de7d93c9a95475509fb5", "type": "sha256", "value": "d60aea1fe282db3ac579713c98d24d46850375db28ccfec0793d10f275b860a5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3fb263b544bb6ffc5344afb7", "type": "sha256", "value": "d78b0583ff00e0b8e6caac5c236fdf795fd447208cfea7f23abd528a26a57674", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-77e3e32a43eb980bc8407e49", "type": "sha256", "value": "d7db23ac49a03eb060bc6a928b5a9044218bed6c7add87406b8867f95938aef5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3e6dee4603a4515a01a1b84a", "type": "sha256", "value": "d9f5dfcc2555a6e6c530c190b3c6f1cac2a0af97b3689547713dc28bece0e7cd", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:32.867619+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:48:32.662505+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:32.660609+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:48:32.657459+00:00" }, { "observable_id": "observable-c340ae34853cbae3a209a7fe", "type": "sha256", "value": "da725c97aae07686110485c776b5ebb1733fb26674466d07417aa2ee3c0e09a9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-251d92daa1642f0cd20f4b33", "type": "sha256", "value": "e1f409fdaac72c188fa638ac4be1958322f1dfe8b2b7b076c4ff95f026f47a4f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fd1c26e0683d30fed520661d", "type": "sha256", "value": "e2f4ebe008e4e29b0695a4cf033f5bc45d5ab70ca43bf0873580a7c4fd500b96", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-028c237b3954c205b9934386", "type": "sha256", "value": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-04ed2e8882f508cf668ab27c", "type": "sha256", "value": "ea34443271cb87b667af587dc8b344c211458dc0616abdf48a49b14c4fde9b1a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-061616a527b9ec92c0732d58", "type": "sha256", "value": "ea99682af1f2ca9bb54887a9cc1ced7c09b2f6d7feb277f2c3d6f3b57af25fc1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-519602f6803c93faf1a8e088", "type": "sha256", "value": "eac280b1fd4d84b2b386d93b51f9193c42f10fe9c3cb0dd1e67ebff66fd31952", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7a5602226c3d6f390a50b4a7", "type": "sha256", "value": "ec8202663864f3744450858c1e5a51826427b7b7b082b5d182d7be0dc47f2c4e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-18c203cf07fd695d7074e1f9", "type": "sha256", "value": "ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-70c828998254a9d052a2a829", "type": "sha256", "value": "f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-74b7918234c860d38de8884c", "type": "sha256", "value": "f099877e9778681f5ca0c77b7f18b5aa675caa6d5cd50abc28dfe6136ac3b8ac", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-968a9d6a9f86004e0ac9985d", "type": "sha256", "value": "f4fbf7d12ec5db69f6a21a8323602fe7e8aa8c4f59baea6115fe1323c3e1358f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8df30cf259f32485b3c2653a", "type": "sha256", "value": "f9985bf8754e921e90a0c63e3458daf79c492f25bbaf3cf13bb14d18ca27fd5a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cc2f044d30d3473e13e66706", "type": "sha256", "value": "fb229f5700cae4392b42fe23e328ba5e697a7c84f4678670791a22ead70a9d09", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-60db55451937af26d00bbde2", "type": "sha256", "value": "fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d3f02fb8377d6f8d75adce17", "type": "sha256", "value": "ff7d32dd7321a2b3c5597c69caae82409019ac22e11ecc4530188d4e3b144302", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f66568abef937334bbaf548b", "type": "sha256", "value": "ff8619dad2bbbf61330224649844a7ff7665785c3f174913729961d77ba5facc", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4b77edc823018a17403b9a52", "type": "url", "value": "http://239.255.255.250:1900*", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 2696, "display_filter": "frame.number == 2696", "timestamp_epoch": "1541624762.197551000" }, { "frame_number": 2726, "display_filter": "frame.number == 2726", "timestamp_epoch": "1541624763.200415000" }, { "frame_number": 2739, "display_filter": "frame.number == 2739", "timestamp_epoch": "1541624764.215092000" }, { "frame_number": 2740, "display_filter": "frame.number == 2740", "timestamp_epoch": "1541624765.218107000" }, { "frame_number": 2824, "display_filter": "frame.number == 2824", "timestamp_epoch": "1541624793.957286000" }, { "frame_number": 3045, "display_filter": "frame.number == 3045", "timestamp_epoch": "1541624794.958348000" }, { "frame_number": 3435, "display_filter": "frame.number == 3435", "timestamp_epoch": "1541624795.958880000" }, { "frame_number": 3436, "display_filter": "frame.number == 3436", "timestamp_epoch": "1541624796.959614000" }, { "frame_number": 9898, "display_filter": "frame.number == 9898", "timestamp_epoch": "1541624913.892827000" }, { "frame_number": 9904, "display_filter": "frame.number == 9904", "timestamp_epoch": "1541624914.893631000" }, { "frame_number": 9905, "display_filter": "frame.number == 9905", "timestamp_epoch": "1541624915.895001000" }, { "frame_number": 9906, "display_filter": "frame.number == 9906", "timestamp_epoch": "1541624916.896692000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6b83d005e4ae7c3d45331921", "type": "url", "value": "http://dhsiwyqdlskwsqo.com/favicon.ico", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 53, "frame_number": 1939, "display_filter": "frame.number == 1939", "timestamp_epoch": "1541623727.157447000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-640682a504a70121fa02aa20", "type": "url", "value": "http://dhsiwyqdlskwsqo.com/images/oHxu3OjFB6DuXsB336/xwuexjnHY/P5VoU9fs1NStyMFZ_2FZ/6s8umkBGsQOSsZgZiqQ/Jnp65UJ_2B9Qq9qo_2BCxl/LpqyFXF9TVVz_/2BLffdp3/TW_2B64CmxBQ7r03un00c1o/B2mvu2ig9G/7GcZJn_2FNTO8/6Kwy7mw.avi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 56, "frame_number": 1955, "display_filter": "frame.number == 1955", "timestamp_epoch": "1541623728.369908000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5962e9f578bf72a00f2ae865", "type": "url", "value": "http://dhsiwyqdlskwsqo.com/images/Owsg6NXtcG4F/aQTGTFRGYCk/mwdnmTGg8q5u_2/B23I8WXH1qhcd_2BC7kNQ/SplwlVD2F3jUMRCB/dTSK84tk3PapDt7/wErikpmrkQw2_2Bhba/FTtz6Avew/ty3DREXbyq083JlIg3zM/TEYrA_2BNXjAICO93pa/QGJ.avi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 53, "frame_number": 1734, "display_filter": "frame.number == 1734", "timestamp_epoch": "1541623725.916965000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9170f5a6b6634d9ada1d14a", "type": "url", "value": "http://dhsiwyqdlskwsqo.com/images/UIL_2BVxj_2FFv/cAgM9ZivBfYRBhzmpmqE8/gTexqC1Lh_2F0iW2/AATDXP0c4G4qcxV/_2FXAAoF8eHHNZ8c43/RrSntOi0N/4VTdgqIWbPwlUsd3uIxL/BZP_2Bzh085fEx639Yq/B1kvRr_2FOEM0k57tlZ1QS/8lw2Htym.avi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 53, "frame_number": 2226, "display_filter": "frame.number == 2226", "timestamp_epoch": "1541623730.990957000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2d1c2509d7ddb2c13a59af36", "type": "url", "value": "http://ferranorga.net/img/client.rar", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 70, "frame_number": 2555, "display_filter": "frame.number == 2555", "timestamp_epoch": "1541624403.848059000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac91084b5ee0db9fa3f43d89", "type": "url", "value": "http://shumbildac.com/WES/fatog.php?l=ngul5.xap", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 51, "frame_number": 1247, "display_filter": "frame.number == 1247", "timestamp_epoch": "1541623631.752689000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-470622274c788b27d8dedddb", "type": "url", "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 58, "frame_number": 2270, "display_filter": "frame.number == 2270", "timestamp_epoch": "1541623798.594440000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4e83b063c8f5454589305a24", "type": "url", "value": "http://www.ferranorga.net/img/client.rar", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 71, "frame_number": 2564, "display_filter": "frame.number == 2564", "timestamp_epoch": "1541624404.370399000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-14edf492ab578eec7b3f85eb", "type": "url", "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=2&utmn=1279953315&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Degrees%20%26%20Programs)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624866037&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 109, "frame_number": 8057, "display_filter": "frame.number == 8057", "timestamp_epoch": "1541624866.166359000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a3debbd930a1506b92923c88", "type": "url", "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=3&utmn=1832691277&utmhn=www.ucdenver.edu&utmt=event&utme=5(UCD%20Homepage*Nav%20-%20Primary*Bachelor%270s%20Degrees)&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624887589&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=6BAAAAAAAAAAAAAAAAAAAAQE~", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 109, "frame_number": 8105, "display_filter": "frame.number == 8105", "timestamp_epoch": "1541624887.715261000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-744cb16a3b15f34c0eff5a83", "type": "url", "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=4&utmn=1892096743&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x446&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Bachelor%27s%20degrees%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=326256236&utmr=0&utmp=%2Fprograms%2Fundergraduate%2FPages%2Fdefault.aspx&utmht=1541624894067&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=&utmu=qBAAAAAAAAAAAAAAAAAAAAAE~", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 109, "frame_number": 8669, "display_filter": "frame.number == 8669", "timestamp_epoch": "1541624894.195169000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-83fb3d1f69fe37c9c2e93815", "type": "url", "value": "http://www.google-analytics.com/ga.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 109, "frame_number": 5284, "display_filter": "frame.number == 5284", "timestamp_epoch": "1541624860.425130000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-006ac61090134020539eb7b4", "type": "url", "value": "http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=362717400&utmhn=www.ucdenver.edu&utmcs=UTF-8&utmsr=1280x768&utmvp=1023x463&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=University%20of%20Colorado%20Denver%20%7C%20%7C%20Accredited%20Degrees%2C%20Research%20and%20Health%20Care%20%7C%20Denver%2C%20Colorado%20%7C%20University%20of%20Colorado%20Denver&utmhid=1761952836&utmr=https%3A%2F%2Fwww.google.com%2F&utmp=%2Fpages%2Fucdwelcomepage.aspx&utmht=1541624860490&utmac=UA-4027023-7&utmcc=__utma%3D56856181.1198525585.1541624860.1541624860.1541624860.1%3B%2B__utmz%3D56856181.1541624860.1.1.utmcsr%3Dgoogle%7Cutmccn%3D(organic)%7Cutmcmd%3Dorganic%7Cutmctr%3D(not%2520provided)%3B&utmjid=408037419&utmredir=1&utmu=qBAAAAAAAAAAAAAAAAAAAAQE~", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 109, "frame_number": 5617, "display_filter": "frame.number == 5617", "timestamp_epoch": "1541624860.618251000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3828a9b42730caa118f9c659", "type": "url", "value": "http://www.msftncsi.com/ncsi.txt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 27, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1541623252.666384000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c0f469fd39018fac9b4ba72e", "type": "url", "value": "http://www.ucdenver.edu/_layouts/1033/core.js?rev=Emb5hNX1RZMNXk9oS82yvA%3D%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 6577, "display_filter": "frame.number == 6577", "timestamp_epoch": "1541624862.071589000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7a9c2d575473b7478a384f6b", "type": "url", "value": "http://www.ucdenver.edu/_layouts/1033/init.js?rev=wgiyW1GQqDQZTITaawvYoA%3D%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 4947, "display_filter": "frame.number == 4947", "timestamp_epoch": "1541624859.774236000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2ecbf9e51706535b69945480", "type": "url", "value": "http://www.ucdenver.edu/_layouts/blank.js?rev=QGOYAJlouiWgFRlhHVlMKA%3D%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 4899, "display_filter": "frame.number == 4899", "timestamp_epoch": "1541624859.747203000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6f94117eb937c5c6de998f5f", "type": "url", "value": "http://www.ucdenver.edu/_layouts/cui.js?rev=OOyJv78CADNBeet%2FvTvniQ%3D%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 6583, "display_filter": "frame.number == 6583", "timestamp_epoch": "1541624862.075493000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4669e231a1a9e32356e429f4", "type": "url", "value": "http://www.ucdenver.edu/_layouts/images/bgximg.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 5567, "display_filter": "frame.number == 5567", "timestamp_epoch": "1541624860.602366000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3ca7708e4c879151eab11cab", "type": "url", "value": "http://www.ucdenver.edu/_layouts/images/fgimg.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 4994, "display_filter": "frame.number == 4994", "timestamp_epoch": "1541624859.850761000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b57d82709a2db2f17e0f4692", "type": "url", "value": "http://www.ucdenver.edu/_layouts/inplview.js?rev=WB6Gy8a027aeNCq7koVCUg%3D%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 6905, "display_filter": "frame.number == 6905", "timestamp_epoch": "1541624862.770720000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6ffb4715c06e40ececbbf3c8", "type": "url", "value": "http://www.ucdenver.edu/_layouts/kwizcom.sharepoint.foundation/jquery.js?v=13.4.81&source=kwizcomsharepointutilities", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 8188, "display_filter": "frame.number == 8188", "timestamp_epoch": "1541624893.168255000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c4c0845927176ed696aa5d84", "type": "url", "value": "http://www.ucdenver.edu/_layouts/kwizcom.sharepoint.foundation/kwizcom_jsutility.js?v=13.4.81&source=kwizcomsharepointutilities", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 8182, "display_filter": "frame.number == 8182", "timestamp_epoch": "1541624893.163167000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cc1464d1949915185ec7a71c", "type": "url", "value": "http://www.ucdenver.edu/_layouts/kwizcom_aggregator/kwizcom_listaggregator.js?v=12.1.12&source=kwizcomsharepointutilities", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 107, "frame_number": 8190, "display_filter": "frame.number == 8190", "timestamp_epoch": "1541624893.170050000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ba58e5cdc77b1b3e4e15a13c", "type": "url", "value": "http://www.ucdenver.edu/_layouts/KWizCom_Aggregator/loading.gif", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 8585, "display_filter": "frame.number == 8585", "timestamp_epoch": "1541624894.031664000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1bff2ce3bafaa6aacede2b0c", "type": "url", "value": "http://www.ucdenver.edu/_layouts/mediaplayer.js?rev=Q6vfD9BNL%2B9PvwgrVEcc%2FA%3D%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 6903, "display_filter": "frame.number == 6903", "timestamp_epoch": "1541624862.769105000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-055c49a8138e6f6cd9fe638c", "type": "url", "value": "http://www.ucdenver.edu/_layouts/ScriptResx.ashx?culture=en%2Dus&name=SP%2ERes&rev=b6%2FcRx1a6orhAQ%2FcF%2B0ytQ%3D%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 6581, "display_filter": "frame.number == 6581", "timestamp_epoch": "1541624862.074280000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8139fd81784c695ad34736a6", "type": "url", "value": "http://www.ucdenver.edu/_layouts/sp.core.js?rev=7ByNlH%2BvcgRJg%2BRCctdC0w%3D%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 6579, "display_filter": "frame.number == 6579", "timestamp_epoch": "1541624862.073012000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d604772f85d12f96e1b6e4d0", "type": "url", "value": "http://www.ucdenver.edu/_layouts/sp.js?rev=%2B4ZEyA892P3T0504qi0paw%3D%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 6798, "display_filter": "frame.number == 6798", "timestamp_epoch": "1541624862.397142000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3f0b8f9bf5e1c56cd57db2e1", "type": "url", "value": "http://www.ucdenver.edu/_layouts/sp.ribbon.js?rev=F%2BUEJ66rbXzSvpf7nN69wQ%3D%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 6930, "display_filter": "frame.number == 6930", "timestamp_epoch": "1541624862.896966000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6b06b54325fe7da1aff8e771", "type": "url", "value": "http://www.ucdenver.edu/_layouts/sp.runtime.js?rev=IGffcZfunndj0247nOxKVg%3D%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 6742, "display_filter": "frame.number == 6742", "timestamp_epoch": "1541624862.290081000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-71af899844297de0aad3f2c1", "type": "url", "value": "http://www.ucdenver.edu/_layouts/sp.ui.dialog.js?rev=Tpcmo1%2FSu6R0yewHowDl5g%3D%3D", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 6601, "display_filter": "frame.number == 6601", "timestamp_epoch": "1541624862.185947000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3a2caa2cdccff1a1db8f3cdf", "type": "url", "value": "http://www.ucdenver.edu/_vti_bin/sites.asmx", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 6889, "display_filter": "frame.number == 6889", "timestamp_epoch": "1541624862.663283000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7cf5b2cba28f789743f300fd", "type": "url", "value": "http://www.ucdenver.edu/academics/colleges/CLAS/Departments/english/Programs/BachelorOfArts/BAEnglish/Pages/CreativeWriting.aspx", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 9022, "display_filter": "frame.number == 9022", "timestamp_epoch": "1541624906.875946000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ba7fa371379031367421201c", "type": "url", "value": "http://www.ucdenver.edu/academics/degrees/_vti_bin/client.svc/ProcessQuery", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 6900, "display_filter": "frame.number == 6900", "timestamp_epoch": "1541624862.758014000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8e219a2e464d3ed2933a5ef0", "type": "url", "value": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/06InfoGraphic/image/factBack3.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 6005, "display_filter": "frame.number == 6005", "timestamp_epoch": "1541624860.841068000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2c3d0e9101d3441cfafc9cd5", "type": "url", "value": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/carousel.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 5123, "display_filter": "frame.number == 5123", "timestamp_epoch": "1541624859.966453000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a7550aa45530d7edd4f48470", "type": "url", "value": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/data.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 5160, "display_filter": "frame.number == 5160", "timestamp_epoch": "1541624860.128717000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e071b4108971cbb7475c7415", "type": "url", "value": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-app.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 4636, "display_filter": "frame.number == 4636", "timestamp_epoch": "1541624859.381889000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-18410bf6bcaf340a8060b2c2", "type": "url", "value": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/07DegreeArea/dynamicV2/degree-search-ng.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 5129, "display_filter": "frame.number == 5129", "timestamp_epoch": "1541624859.971247000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6e1f24f722fb5f9c7d3c47c5", "type": "url", "value": "http://www.ucdenver.edu/Documents/WebParts2015Redesign/16HeroImage/images/ResearchRoundupHero.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 107, "frame_number": 5333, "display_filter": "frame.number == 5333", "timestamp_epoch": "1541624860.459487000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7262d0bc213ab7ca1c15551", "type": "url", "value": "http://www.ucdenver.edu/favicon.ico", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 107, "frame_number": 6585, "display_filter": "frame.number == 6585", "timestamp_epoch": "1541624862.076528000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0a0f7c69edf75d29549fbbc9", "type": "url", "value": "http://www.ucdenver.edu/Javascript%20Library/angular-animate.min.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 4768, "display_filter": "frame.number == 4768", "timestamp_epoch": "1541624859.568418000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5c791d09fbeb0a36bbf936b1", "type": "url", "value": "http://www.ucdenver.edu/Javascript%20Library/angular.min.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 4749, "display_filter": "frame.number == 4749", "timestamp_epoch": "1541624859.563108000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cdacdb30441f2d857ef206a7", "type": "url", "value": "http://www.ucdenver.edu/Javascript%20Library/jquery-1.11.3.min.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 107, "frame_number": 4668, "display_filter": "frame.number == 4668", "timestamp_epoch": "1541624859.440397000" }, { "tcp_stream": 107, "frame_number": 8125, "display_filter": "frame.number == 8125", "timestamp_epoch": "1541624892.841922000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-04e0d0050884d9af40c0b661", "type": "url", "value": "http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 4589, "display_filter": "frame.number == 4589", "timestamp_epoch": "1541624859.217138000" }, { "tcp_stream": 104, "frame_number": 8135, "display_filter": "frame.number == 8135", "timestamp_epoch": "1541624892.958159000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7d244b7efd6819b21119b9c5", "type": "url", "value": "http://www.ucdenver.edu/Javascript%20Library/jquery-ui-1-11-4/jquery-ui.min.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 4676, "display_filter": "frame.number == 4676", "timestamp_epoch": "1541624859.448624000" }, { "tcp_stream": 103, "frame_number": 8127, "display_filter": "frame.number == 8127", "timestamp_epoch": "1541624892.845416000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7c84a4a73800242a85a1f587", "type": "url", "value": "http://www.ucdenver.edu/Javascript%20Library/jquery.jcarousel.min.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 4788, "display_filter": "frame.number == 4788", "timestamp_epoch": "1541624859.617568000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bbf4e862670cdf1139907327", "type": "url", "value": "http://www.ucdenver.edu/Javascript%20Library/responsive/jsBaseResponsive.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 4794, "display_filter": "frame.number == 4794", "timestamp_epoch": "1541624859.630828000" }, { "tcp_stream": 103, "frame_number": 8157, "display_filter": "frame.number == 8157", "timestamp_epoch": "1541624893.057986000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b9516a19c1e47c19658863b6", "type": "url", "value": "http://www.ucdenver.edu/Javascript%20Library/UCDJS.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 4871, "display_filter": "frame.number == 4871", "timestamp_epoch": "1541624859.685949000" }, { "tcp_stream": 104, "frame_number": 8160, "display_filter": "frame.number == 8160", "timestamp_epoch": "1541624893.060607000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-48ffa53ede7003d3ed33d5e6", "type": "url", "value": "http://www.ucdenver.edu/pages/ucdwelcomepage.aspx", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 4552, "display_filter": "frame.number == 4552", "timestamp_epoch": "1541624858.750822000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf388ab3074617beb151f33d", "type": "url", "value": "http://www.ucdenver.edu/programs/undergraduate", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 8107, "display_filter": "frame.number == 8107", "timestamp_epoch": "1541624887.720790000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f40661e8e28189484bbb64e9", "type": "url", "value": "http://www.ucdenver.edu/programs/undergraduate/Documents/Styles_Scripts/local.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 8178, "display_filter": "frame.number == 8178", "timestamp_epoch": "1541624893.130675000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad6cc709a2c63f066d498b9b", "type": "url", "value": "http://www.ucdenver.edu/programs/undergraduate/Pages/_layouts/images/minus.gif", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 8583, "display_filter": "frame.number == 8583", "timestamp_epoch": "1541624894.030037000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2d8bc64c10b438aa39f94f7a", "type": "url", "value": "http://www.ucdenver.edu/programs/undergraduate/Pages/default.aspx", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 8111, "display_filter": "frame.number == 8111", "timestamp_epoch": "1541624887.810832000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2c7b5bc728ce48e3fabc5ac6", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 107, "frame_number": 5996, "display_filter": "frame.number == 5996", "timestamp_epoch": "1541624860.831216000" }, { "tcp_stream": 107, "frame_number": 8629, "display_filter": "frame.number == 8629", "timestamp_epoch": "1541624894.139813000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f22bb339c072b3e8b93bb620", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_apply_small.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 5195, "display_filter": "frame.number == 5195", "timestamp_epoch": "1541624860.255371000" }, { "tcp_stream": 107, "frame_number": 8529, "display_filter": "frame.number == 8529", "timestamp_epoch": "1541624893.648687000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-037861897da39967b4edab37", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_appStatus_small.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 5199, "display_filter": "frame.number == 5199", "timestamp_epoch": "1541624860.259689000" }, { "tcp_stream": 107, "frame_number": 8568, "display_filter": "frame.number == 8568", "timestamp_epoch": "1541624893.918735000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-55d698bdb1b273e6c9af619b", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_calendar_small.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 5170, "display_filter": "frame.number == 5170", "timestamp_epoch": "1541624860.237436000" }, { "tcp_stream": 107, "frame_number": 8407, "display_filter": "frame.number == 8407", "timestamp_epoch": "1541624893.493619000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-72b24a7cfd304121ea8690e3", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 8673, "display_filter": "frame.number == 8673", "timestamp_epoch": "1541624894.206873000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-38dbfaec330c08161fb10338", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_catalog_small.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 107, "frame_number": 5168, "display_filter": "frame.number == 5168", "timestamp_epoch": "1541624860.233813000" }, { "tcp_stream": 105, "frame_number": 8405, "display_filter": "frame.number == 8405", "timestamp_epoch": "1541624893.492068000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-436e386a67acf2426c12c3ea", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_requestInfo.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 6000, "display_filter": "frame.number == 6000", "timestamp_epoch": "1541624860.835661000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ba2da1bb0ba087c72e8839f5", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 5998, "display_filter": "frame.number == 5998", "timestamp_epoch": "1541624860.832935000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e5850a86c678aba9ff71a461", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/cta_visit_small.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 5197, "display_filter": "frame.number == 5197", "timestamp_epoch": "1541624860.258241000" }, { "tcp_stream": 105, "frame_number": 8531, "display_filter": "frame.number == 8531", "timestamp_epoch": "1541624893.650403000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e801c27d6fcdca2963a84363", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUAnschutz.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 5201, "display_filter": "frame.number == 5201", "timestamp_epoch": "1541624860.260824000" }, { "tcp_stream": 104, "frame_number": 8570, "display_filter": "frame.number == 8570", "timestamp_epoch": "1541624893.920995000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d4fa7cdcd524c359585cfbc0", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUDenver.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 5289, "display_filter": "frame.number == 5289", "timestamp_epoch": "1541624860.432498000" }, { "tcp_stream": 107, "frame_number": 8575, "display_filter": "frame.number == 8575", "timestamp_epoch": "1541624894.025495000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f3045b8d48d8282ec6eb5332", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/CTA/CUSouth.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 5355, "display_filter": "frame.number == 5355", "timestamp_epoch": "1541624860.469628000" }, { "tcp_stream": 104, "frame_number": 8577, "display_filter": "frame.number == 8577", "timestamp_epoch": "1541624894.026539000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4c68cf9c31fcfa4576e9beb2", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/Hero/48_hero.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 8621, "display_filter": "frame.number == 8621", "timestamp_epoch": "1541624894.136456000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d96bedbf66d725768f68ca6e", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/Testimonial/48_testimonial_kliese.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 8581, "display_filter": "frame.number == 8581", "timestamp_epoch": "1541624894.029046000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-03035a857889fae367117c2e", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/CriticalPath/Testimonial/48_testimonial_klimper.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 8579, "display_filter": "frame.number == 8579", "timestamp_epoch": "1541624894.027821000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ef78f8113682169e70ef76d9", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/cta-triple-buttons/cta2.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 8645, "display_filter": "frame.number == 8645", "timestamp_epoch": "1541624894.149518000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8576b3f8433d9930f40a9072", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/balancedbudget.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 5412, "display_filter": "frame.number == 5412", "timestamp_epoch": "1541624860.492735000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-678d3d33a7f2878e5f92df13", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/StCajetans-ig.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 5495, "display_filter": "frame.number == 5495", "timestamp_epoch": "1541624860.570466000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2c50a8c98feef4b073913c4d", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/ThreeGuys.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 5385, "display_filter": "frame.number == 5385", "timestamp_epoch": "1541624860.481944000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-efe772a50544a7f0f0675cd0", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/homepage/2015StoryCards/whitepines.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 5471, "display_filter": "frame.number == 5471", "timestamp_epoch": "1541624860.524980000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8f29e79b6127f92aff5fca99", "type": "url", "value": "http://www.ucdenver.edu/PublishingImages/UCDLayoutImages/searchButton.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 107, "frame_number": 5162, "display_filter": "frame.number == 5162", "timestamp_epoch": "1541624860.130512000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a50c86b3cd1cf420cbc9b69f", "type": "url", "value": "http://www.ucdenver.edu/ScriptResource.axd?d=1QDyKS9h_RiM240HMbYjM6ODCJOKhzpWzUoeDZ16t3d487fp531Bj79wvRUTrpe40Sb2WC34BUqekTySkaN5JfKY-KmMcnh1StfQCVLNGKh9bApp04C1q9RX01pYhWwBp5cQe9b_UUDsH1MpnrV6Qpz6c1ILT-tGnGCdfhY6NJVDQZ2p0&t=2e2045e2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 4975, "display_filter": "frame.number == 4975", "timestamp_epoch": "1541624859.779592000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-02ab7b1fe9df7df84187096b", "type": "url", "value": "http://www.ucdenver.edu/ScriptResource.axd?d=9di2kcBnRer6u7CuZUM7AfDDbzWMOK7upyNjbmE5Pdu3o5BHVtGXRC91MpdMm5XnQKxQdUdYrD0lcXagGlKdOSu2-gvQh1sQkr9VBx5eiph2ui3XCKHywHXzD91UpgfJQscXyag6PMfkkSUAwV5oTxM-pRGaKbplVIquRmAvCsECm7UwxgbHqr5oRifTbuwyorCrDIb3SKMarpQyLWAcwc1HYq01&t=3cb8783c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 8216, "display_filter": "frame.number == 8216", "timestamp_epoch": "1541624893.192548000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-87117e67135eee620cbdfc29", "type": "url", "value": "http://www.ucdenver.edu/ScriptResource.axd?d=kbtxWN87DQ1VIylVprHAWnyKaGLTA4pXlXTHlCuJIMsMYgKaYAHacVcYWnfHdzexemLANVUTb9RCqYHuFVYEeMMivsq9U8GpgkkDFsA3RU3W-vDHMWw2gDPk5jSrhT-rAV4PHKkL432QiTzOJMscy2b0-_w-jLBdS2fQZi5KQMX9r-i8Y6ucvvNoN81ML1rcIiQZneq5Y7wGC-UMWsKoXE1IejlZ1LpGQdWma9ut0iUIFPwY0&t=3cb8783c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 8235, "display_filter": "frame.number == 8235", "timestamp_epoch": "1541624893.271519000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6ff3850b56fd179b6b6bae43", "type": "url", "value": "http://www.ucdenver.edu/ScriptResource.axd?d=nDIPXhUC97iGOuHV1bSa3g9PgqtW-xIy12fJV_T8vVy7js2xrAy8ccqwmnXPgF-xNQgkyT7tmsbDKVfT8ifdxCFRXJAu8n8jnliYraK21_he0x3K2sbtAORIu3mC-DFdoxOp3B5OGN3NzbzrPG28T1haK-w1&t=2e2045e2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 107, "frame_number": 4958, "display_filter": "frame.number == 4958", "timestamp_epoch": "1541624859.776150000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fbc25fee6fe516f4a90b18e1", "type": "url", "value": "http://www.ucdenver.edu/SiteCollectionImages/Logos/CUDenver_cuitc-300.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 4996, "display_filter": "frame.number == 4996", "timestamp_epoch": "1541624859.853521000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-016f054613253ffb549a9b11", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap-theme.min.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 4585, "display_filter": "frame.number == 4585", "timestamp_epoch": "1541624859.204941000" }, { "tcp_stream": 103, "frame_number": 8133, "display_filter": "frame.number == 8133", "timestamp_epoch": "1541624892.956106000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aec83e09a85437f54976ea87", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/bootstrap334/css/bootstrap.min.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 4581, "display_filter": "frame.number == 4581", "timestamp_epoch": "1541624859.201803000" }, { "tcp_stream": 104, "frame_number": 8123, "display_filter": "frame.number == 8123", "timestamp_epoch": "1541624892.840098000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d6c92932d25096a0a0fca1c3", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/bootstrap334/fonts/glyphicons-halflings-regular.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 8059, "display_filter": "frame.number == 8059", "timestamp_epoch": "1541624866.169891000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5fc1e645fc9bf4c7ca901659", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/bootstrap334/js/bootstrap.min.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 4710, "display_filter": "frame.number == 4710", "timestamp_epoch": "1541624859.497098000" }, { "tcp_stream": 106, "frame_number": 8129, "display_filter": "frame.number == 8129", "timestamp_epoch": "1541624892.849579000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-df73db006fd77350a6e9c4fe", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/corev4Anonymous.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 4577, "display_filter": "frame.number == 4577", "timestamp_epoch": "1541624859.196686000" }, { "tcp_stream": 105, "frame_number": 8121, "display_filter": "frame.number == 8121", "timestamp_epoch": "1541624892.838345000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5d0362f666b44551246d3e78", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/BetaUCDenverTheme.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 8152, "display_filter": "frame.number == 8152", "timestamp_epoch": "1541624893.010022000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a359c8533438c35e67ded4ab", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/DDCthemeMain.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 5158, "display_filter": "frame.number == 5158", "timestamp_epoch": "1541624860.126535000" }, { "tcp_stream": 105, "frame_number": 8566, "display_filter": "frame.number == 8566", "timestamp_epoch": "1541624893.915915000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-90ddc5544311f99119a56fd1", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/facebook.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 5889, "display_filter": "frame.number == 5889", "timestamp_epoch": "1541624860.754925000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-027e99673cdf01971f9fd9d9", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/googleplus.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 5807, "display_filter": "frame.number == 5807", "timestamp_epoch": "1541624860.712635000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e1e20426b6ecb0fe7fe8b3c3", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/instagram.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 5845, "display_filter": "frame.number == 5845", "timestamp_epoch": "1541624860.735835000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f89f8af8e53ac6a1ff6f91e7", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/linkedin.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 5642, "display_filter": "frame.number == 5642", "timestamp_epoch": "1541624860.627830000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-78ae0f2e43ed1abd9adcdca9", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/QLtab.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 5235, "display_filter": "frame.number == 5235", "timestamp_epoch": "1541624860.347934000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1f7cdd0a1fca38aa58f526eb", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/searchButton.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 5245, "display_filter": "frame.number == 5245", "timestamp_epoch": "1541624860.353114000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d74d78dec172361398644fe5", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/twitter.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 5887, "display_filter": "frame.number == 5887", "timestamp_epoch": "1541624860.752218000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e0c77a1eb14966ead907400d", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/icons/youtube.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 5841, "display_filter": "frame.number == 5841", "timestamp_epoch": "1541624860.733368000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-55220dee675ceffa39e7a35c", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/leftChevron.gif", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 6034, "display_filter": "frame.number == 6034", "timestamp_epoch": "1541624860.865620000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6404e07c498bdd87e6745b1f", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/DDCthemes/images/shared/rightChevron.gif", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 6011, "display_filter": "frame.number == 6011", "timestamp_epoch": "1541624860.847864000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-18beaed1067aec972bfd6a5a", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/fonts/fontawesome-fontfacekit/fontawesome-webfont.woff2?v=4.3.0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 5262, "display_filter": "frame.number == 5262", "timestamp_epoch": "1541624860.363198000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-22dfdf8c0237c938c33e0ce7", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-bold-webfont.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 5247, "display_filter": "frame.number == 5247", "timestamp_epoch": "1541624860.359313000" }, { "tcp_stream": 106, "frame_number": 8609, "display_filter": "frame.number == 8609", "timestamp_epoch": "1541624894.127435000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9215d29184a7197fb8d16e7f", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-light-webfont.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 5272, "display_filter": "frame.number == 5272", "timestamp_epoch": "1541624860.366019000" }, { "tcp_stream": 104, "frame_number": 8612, "display_filter": "frame.number == 8612", "timestamp_epoch": "1541624894.130411000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4753b0d2ce79f535d1cb7da4", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/fonts/sourcesanspro-fontfacekit/sourcesanspro-regular-webfont.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 107, "frame_number": 5210, "display_filter": "frame.number == 5210", "timestamp_epoch": "1541624860.340649000" }, { "tcp_stream": 108, "frame_number": 8588, "display_filter": "frame.number == 8588", "timestamp_epoch": "1541624894.114920000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c821f92bb1c45e257d2e75e4", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/responsive/print.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 6074, "display_filter": "frame.number == 6074", "timestamp_epoch": "1541624860.952712000" }, { "tcp_stream": 106, "frame_number": 8676, "display_filter": "frame.number == 8676", "timestamp_epoch": "1541624894.214024000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-21f82320d8c3db9136355278", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/responsive/responsiveBase.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 107, "frame_number": 4593, "display_filter": "frame.number == 4593", "timestamp_epoch": "1541624859.219621000" }, { "tcp_stream": 106, "frame_number": 8148, "display_filter": "frame.number == 8148", "timestamp_epoch": "1541624892.994907000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-45e861f737bafccbd30723b9", "type": "url", "value": "http://www.ucdenver.edu/Style%20Library/UCDenverTheme.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 104, "frame_number": 4615, "display_filter": "frame.number == 4615", "timestamp_epoch": "1541624859.315195000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-99ad7a10510511c7d4ddf1fa", "type": "url", "value": "http://www.ucdenver.edu/WebResource.axd?d=nK66gdmZPDA-w-JjHyggjO_q5ZVRp7ooiUATeOMUtTMCTlfkvxq8mxRHybfWnA0Swfdbv1YBCieMhY76WgB3McU0Erit7tpi9kGXDOtvazCF8h1BLSyM9r_pT9xkzGtAoB6i_bw2w0dM46xzuwSmUZ9Il-pR8sIBMDjV6n64EKHYbfoJqQA9doUWhsRbzsGCzJ1g7D2-gJrdDaKQJ1H6GipIFEoKwv_UCr3VeSqOsCEXfpiHtt2ZR-Y3UW4oyGmrVOioeA2&t=635701215589701395", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 107, "frame_number": 8154, "display_filter": "frame.number == 8154", "timestamp_epoch": "1541624893.012139000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d115059af19acc076edd2ec0", "type": "url", "value": "http://www.ucdenver.edu/WebResource.axd?d=Rr8OZckqtIG1LFJTmW4ygCZ8tMHeGI9-qww7ZH6tsHUf-5ACqmhwY6jnlnidSHBrgMkq7on6x9smildQ9krSVOW4yk41&t=636271455501517547", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 103, "frame_number": 4888, "display_filter": "frame.number == 4888", "timestamp_epoch": "1541624859.741750000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 383 }, "ioc_candidate_count": 0, "summary": "383 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-d9125d75bcf4d5ed0298ec84", "type": "ipv4", "value": "52.207.122.163", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c145993b649196eb7a3aa8c7", "type": "ipv4", "value": "52.214.151.124", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-61b2fd9ec287fb2a38e01447", "type": "ipv4", "value": "54.86.197.0", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1f22579e90fc92c7afba86e1", "type": "ipv4", "value": "62.149.140.59", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-de949209917a7096fd60b219", "type": "ipv4", "value": "63.251.240.12", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d5d5ec59c6e8f76eb497e155", "type": "ipv4", "value": "72.246.64.147", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7a9bfce6cc5e3f74286ce188", "type": "ipv4", "value": "72.246.64.187", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5fae8a8fc5e16aadb921ea24", "type": "ipv4", "value": "74.6.141.28", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-37aa9523f7ebb6f58a96a4a0", "type": "ipv4", "value": "74.6.141.50", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3f7aa774d41205e14974187a", "type": "ipv4", "value": "93.184.216.182", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52c9a568bf49a162bc149d24", "type": "ipv4", "value": "95.181.198.115", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dba90df3dbc48406ba4d1b3a", "type": "sha256", "value": "009d4cdb69f30688198c7a19b25ef0667c5f7b172d65b2273ed2274bc8eb5425", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3d39863ed6cb5b6e89176b46", "type": "sha256", "value": "022d0a09ef989821ccf3e8bd48be89355052024fc688fe3c4c84c3da00a6e082", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-05803f057140ea5177605c2e", "type": "sha256", "value": "02717a94a92b22f6715c10f1483a4b252f61bd705675ae250af5411ff01de437", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3d936a86a11b17f6b18bff8f", "type": "sha256", "value": "05d5af0ab07517396f53c3e161f0ebc23c09242eae0c2372d7da26dd5786953e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c962ad1ad6f4f56986be2d55", "type": "sha256", "value": "0ba2f6756001669bdf934f9d79e8fd1ccf2028130c33a0510279581ec9dfd73a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9190e50a937f7382940b8897", "type": "sha256", "value": "10570ac15a02224c4743309c48c8b8eefeaa931d9f1db7238edd7b3fa6cd2ff7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8fc4c5a21b5077f013c9d40a", "type": "sha256", "value": "11065daca98f9840f58be03dd0fa78c710b9509ad517857acacf715c491de6d6", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-49e7fc1b6ac7226959d94b17", "type": "sha256", "value": "1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c74b89c3722a8a04a0b43646", "type": "sha256", "value": "1519c5e27fa45f1ceb90ae78923c474e3f5597d45e6a8c61ad73367a432333b8", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-360096253ad148edb5f7cf03", "type": "sha256", "value": "158494850d445b90585ee2d25e2969b3218808ccb0897c79ca240f7c3556d92b", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d17f63fea1dfcbdac44d8d36", "type": "sha256", "value": "190a90d96675f28bb6ab1bab072f3b61ec321af3a8c3843a70248d9bb71bcdfe", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9a110cb010e47d0ecdcdee9f", "type": "sha256", "value": "198f44920d0d51bc49281f580acc760fd88a96e2422c8784114df6dab93ecc09", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-965f002a708861a6ef35c162", "type": "sha256", "value": "19fda88c2df63d85b7762799904408d0703f7efe7d6956d70c776458075747f3", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ba88b51b69ded7cd01450392", "type": "sha256", "value": "2453e31f9c5e0dbee528d11f97a85edf897ed93406954ce8e475f0244abf249a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0413d87d41ad0e97055b56b0", "type": "sha256", "value": "24e819821e2f9afcfed4ad0e8490935378abfb0df723850078e731cfd9ef6edd", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8a280a9d89a1da1829dcd87b", "type": "sha256", "value": "25d7dc2c15716821face8630fbf2c166969dc0852e19c822e07982ea512da981", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a787d4b7a6ad68c2fc2ba933", "type": "sha256", "value": "2976d80beac91eed779d1f204cb2e1be813c53bb2e1dfe03334f2c30b4f995be", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-89784d2a9f78e1283cfb4e34", "type": "sha256", "value": "2e2e544728c5e5f5cfdc9ad2faf6063af99088e1c3edc32e5074e7ad541c18a0", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2dca0b1460e3377b5d33c407", "type": "sha256", "value": "36d8e52a141bc54658ed41dde1654343bbd008af29f889f6e0a2f41441457ba6", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2b1a586e85f861c991c80ee5", "type": "sha256", "value": "37e9250c18e218e58fb1818a608e9ad463a4b4743ebf3c08ca738001cc8970e0", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c642e3e67bb205b2d4a6355f", "type": "sha256", "value": "398cea3dc83051c117a65a9897bd17c84dace5d700ecd01943d1e47af57b5490", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6e6f45a18c164450f71aee7f", "type": "sha256", "value": "3cd1a2527c206665892f1e9837f4e7cff960d7e5fa9df017c7b49e84845c0097", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b0fbdffde052a52558078e98", "type": "sha256", "value": "4004293f081201ead3df6f86daa9d3974bde048ae8187cda602dffb256324124", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ac3297cbabd7340810f09eb1", "type": "sha256", "value": "46868c166bdd75230bd20064033f281d2d6ca30a512eee717871dac9da416955", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5704d3efe250ee2a5c32f85b", "type": "sha256", "value": "4935fdc24e4a4873c078817732e45651c05091b946eff4fb774476a31d52e769", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5a7753556598a85eb124b487", "type": "sha256", "value": "4e3d1cd476ae289fb9a9f4ce26b781659410914c81d11b4befc7735f4c71b2b1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-757d6f5410c57e42147362e8", "type": "sha256", "value": "517319eb8ff3d0b11dc60d148babdc714087e386977101e1d76428cdbff6b9c7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-109fd89e4573912aec62aba2", "type": "sha256", "value": "550ceb9559bb4237527909ff21e719804f6b9df337f741f756821c0c9963392b", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-373c0e9d969fb41a3785b167", "type": "sha256", "value": "561ffc13ce19398e938a84992b3791d95e9d6f7b904e3f79c9728dc0c23a8297", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-55ff1fca1270e6ab67083395", "type": "sha256", "value": "56bbf5dbefa7919f0b8666d9cfc272b0ddbc9e920a373c1ab701d960dc09ce3a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bd555395ad468d006faa0556", "type": "sha256", "value": "58c778f59b121390544d07cc4ff6948eb35045eafe376247ef285d4f72cfe167", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-23e1f495b2e41baac57a77f6", "type": "sha256", "value": "5c9486d0aa62b50180e77e62b15f9977b3b0fd3f7d9b1f797de4c41b7da02b7d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-adc148ebe12cc329dbf94409", "type": "sha256", "value": "5fedc714f715123098edf3d8ceffcc6f6c1d503513e3dee6077c0fb3a6fcdbec", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a61a641025e0c366165a5f1a", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c30345c9eb0f29185a48adfe", "type": "sha256", "value": "61f39b4c6a88443103c0260f69dfc9484012f6bddad680b567c3ababcf416b4e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-633b716aa40589397583cfc7", "type": "sha256", "value": "6cba436e9e5adbe296a382ece4309eb469ec3a0d37d3b14058800f9fd57338ab", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f05b30b3f2289d80cebec292", "type": "sha256", "value": "6f7307aed5e6e60222ef7d66e258362e1df71eabd5f7af0f33afa0fc6b8f65dd", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-431427755d624a5b68b2a65e", "type": "sha256", "value": "71ea89144415bcb2ea2585d7a5ca95b27ab2a10d7f826647bee8c9e78922c5a5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4b9b0cdece8dc1d3a4ed573", "type": "sha256", "value": "72c3d8a0ee2408bcb595f51ec68806252c9b60a6be25b091f1d0a88655517f12", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4ddc4a97e98881564c48f3c6", "type": "sha256", "value": "7796b5c1eb8d9c8a896b17db41ae969690f2924a8690439ac4d5511935b236c3", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e3c4cf8100ab028800e504f7", "type": "sha256", "value": "7bacd1e07f7de2e51fcd1eafbcd9ec0aaad5c16ac4c4d846a86a5654a00506b4", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e3bfc95e633eff9cd4af48e", "type": "sha256", "value": "7df7e6f7c22f1938c2313beb743eb60040f607f2a703a5134c8842ce7e7946ab", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d9146839524cf1a0e5e44021", "type": "sha256", "value": "7e0baff43a753a2dce0e85dbbd562a503c9f558f846784f3626c0b5d31c9d6d3", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-78ea2da7ebef3d6af7671ff2", "type": "sha256", "value": "80bad0ee862dd92912bbecb161c17ce3d072b22aef1d48c3ab4c90f55939acae", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9c00a7cbc1127858732800ac", "type": "sha256", "value": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3de3dee2f2286414a98d19f4", "type": "sha256", "value": "833aae2efa9e7eb97334c8596c07bd22c09ffa2e771dc64fadcfa66d2ed2330e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dc539e2e53dda1c834b32a45", "type": "sha256", "value": "86a4c543d749c972e930c08df70d17f81c7eae19ea9854476eda897fd33fbfc5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8fb9a286794024771f820c02", "type": "sha256", "value": "8b6eb285d3afcd5e4d485846c70b442f4b6df4a636533493a6b45ff4808c8364", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0d733468c3d00c31850db7c7", "type": "sha256", "value": "8ba51e69c99c8a2fee83d5cd85f86d044a51c9979f845ca6abf75901ad83f84c", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dc954f3cad0b3183fe7c5d4e", "type": "sha256", "value": "9145ac411c9596c70f7a57d91ddf00f4888aae4d852209ed6efdf99afad1f904", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6f419b0434a061a755e4695a", "type": "sha256", "value": "9557385d62733e77c3bb5b473d9bb2fa29bd51f8b010d221cbefe8297a454291", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5a0d94747b314d8d3b46e5cc", "type": "sha256", "value": "9a4e9990d71244aaa68b4bff6d5910665e7df9051cd4ee030e61b8e7f16180c1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5dfe4dabaa0aae2877f00d8d", "type": "sha256", "value": "9be5b65b630c074027b64f5544e24575e36aba498ee43b12167e82b40872e01f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e08f820be93834e7fb47e99b", "type": "sha256", "value": "9c086d962c942cff645dbd48b700191e96e3371b3d006e4eb3c7ac3c842057c9", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9e69eebce2567c4eaf728987", "type": "sha256", "value": "9c16b72304e8dbf5ddce0e0614934eac07d641ef12c654398eda8df088f3c296", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8c88451fb1913a18dd4580d0", "type": "sha256", "value": "9d7c79b24ac12a185212ccab8741f4acdbd7ab160099e719bedd682806886ac9", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d7896a8e1efc637b561dc13e", "type": "sha256", "value": "a417a78e9d645ffa38f11bbcd1e4bdd0295bb71e5a7dfd692b3495dac2ef4107", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aad877860927a75d909e1473", "type": "sha256", "value": "a630dac9b5b0fbea3974ad09401522aeda12f11bbe5344508829d575c03cd644", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2fe260de13b10d4960d2451c", "type": "sha256", "value": "aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ca1588f39b96b83cd0251bae", "type": "sha256", "value": "ac508fa266db568a28c4e52d7dd1fcc85dbfdc38f97e39892e60f94d904e11d5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-920519a2d890fbe34f26c0a2", "type": "sha256", "value": "b24190e46072d124308b908776b21a50d4cefa396934bf5fb788bf26c2e67c33", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4bd681bda4dd5af8825cdb03", "type": "sha256", "value": "b2aba18ac53e4abc1a631c98959e5411fc64efe761dbe216e1f559b1e2d7aef2", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8efd3f188ee2fb742f8a9fdf", "type": "sha256", "value": "b5fcfa087b1cc0b1f61c17437c0a533c027dd68bb1e42898682bad189bacdf67", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-084d5dacb132a63c6f0472d9", "type": "sha256", "value": "b729bb6d682bc3df8fb04c7a940b3da0140284811d168a92929cfec7232237be", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b560c069a4053dfc9b0ed976", "type": "sha256", "value": "b943dd2830226be743c9bfcb5ffa4eec591e55d09a736ffecdfd3d8b6581da31", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6024d4d914088974e2db78e3", "type": "sha256", "value": "bd9ea8a38face9cb05cb209900b16b09b3bda1c247ddd7d2e2c95a82a3615cd3", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9fa85d6da593203531ed2526", "type": "sha256", "value": "bfedb831c9a4afb407a127b04080c8f649d2134e713d4a1f810d9f670295cf7d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-576a2e73288d57b70ed6f000", "type": "sha256", "value": "c4d8dbe77feb63e5a61bee0bead4e5f66e8fa6a927599bd1b74aced52467273c", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ee1668516c1bdb6002d59832", "type": "sha256", "value": "c4e63117b5fac36c75799cae97f4f0464bd9d6978b442fe6cf28078d0be7ac31", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bb2f58c47ed1d3f5854a15d3", "type": "sha256", "value": "c8e9a8b2cf530cc873941944744e8d053a34d2759194dae198e579c9e17399a2", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-58a647220ad784a501e80f8b", "type": "sha256", "value": "ca0405f6832d0b1aaf7e5c00aa3241cccf19859dc47ca15ab3a90a9ffcbdf150", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d00d6d4971cf8ac3b91d3296", "type": "sha256", "value": "d2e3bd61e7e0d4f908192813267d98927cc31043d84387b1a941e3b5b15f9134", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0a2b1ed7b1eacde687b7a739", "type": "sha256", "value": "d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-34b5de7d93c9a95475509fb5", "type": "sha256", "value": "d60aea1fe282db3ac579713c98d24d46850375db28ccfec0793d10f275b860a5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3fb263b544bb6ffc5344afb7", "type": "sha256", "value": "d78b0583ff00e0b8e6caac5c236fdf795fd447208cfea7f23abd528a26a57674", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-77e3e32a43eb980bc8407e49", "type": "sha256", "value": "d7db23ac49a03eb060bc6a928b5a9044218bed6c7add87406b8867f95938aef5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c340ae34853cbae3a209a7fe", "type": "sha256", "value": "da725c97aae07686110485c776b5ebb1733fb26674466d07417aa2ee3c0e09a9", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-251d92daa1642f0cd20f4b33", "type": "sha256", "value": "e1f409fdaac72c188fa638ac4be1958322f1dfe8b2b7b076c4ff95f026f47a4f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fd1c26e0683d30fed520661d", "type": "sha256", "value": "e2f4ebe008e4e29b0695a4cf033f5bc45d5ab70ca43bf0873580a7c4fd500b96", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-028c237b3954c205b9934386", "type": "sha256", "value": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-04ed2e8882f508cf668ab27c", "type": "sha256", "value": "ea34443271cb87b667af587dc8b344c211458dc0616abdf48a49b14c4fde9b1a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-061616a527b9ec92c0732d58", "type": "sha256", "value": "ea99682af1f2ca9bb54887a9cc1ced7c09b2f6d7feb277f2c3d6f3b57af25fc1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-519602f6803c93faf1a8e088", "type": "sha256", "value": "eac280b1fd4d84b2b386d93b51f9193c42f10fe9c3cb0dd1e67ebff66fd31952", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7a5602226c3d6f390a50b4a7", "type": "sha256", "value": "ec8202663864f3744450858c1e5a51826427b7b7b082b5d182d7be0dc47f2c4e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-18c203cf07fd695d7074e1f9", "type": "sha256", "value": "ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-70c828998254a9d052a2a829", "type": "sha256", "value": "f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74b7918234c860d38de8884c", "type": "sha256", "value": "f099877e9778681f5ca0c77b7f18b5aa675caa6d5cd50abc28dfe6136ac3b8ac", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-968a9d6a9f86004e0ac9985d", "type": "sha256", "value": "f4fbf7d12ec5db69f6a21a8323602fe7e8aa8c4f59baea6115fe1323c3e1358f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8df30cf259f32485b3c2653a", "type": "sha256", "value": "f9985bf8754e921e90a0c63e3458daf79c492f25bbaf3cf13bb14d18ca27fd5a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cc2f044d30d3473e13e66706", "type": "sha256", "value": "fb229f5700cae4392b42fe23e328ba5e697a7c84f4678670791a22ead70a9d09", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-60db55451937af26d00bbde2", "type": "sha256", "value": "fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d3f02fb8377d6f8d75adce17", "type": "sha256", "value": "ff7d32dd7321a2b3c5597c69caae82409019ac22e11ecc4530188d4e3b144302", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f66568abef937334bbaf548b", "type": "sha256", "value": "ff8619dad2bbbf61330224649844a7ff7665785c3f174913729961d77ba5facc", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2931dff8994ddbdaaaa99c8a", "type": "domain", "value": "api.bing.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-43af33f3ae1dc4478a39a34b", "type": "domain", "value": "cyanteread.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9e26be5f96957be15122dcdc", "type": "domain", "value": "danger-win-pc.geeographic.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-58602ce8927e2a213a4ef412", "type": "domain", "value": "dns.msftncsi.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8283bcde47981a990a8a330f", "type": "domain", "value": "edbmwhcwe.geeographic.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b2ef3c2997bed73b7cd94029", "type": "domain", "value": "edbmwhcwe.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c81f277ed56b871944bf40fd", "type": "domain", "value": "geeographic-dc.geeographic.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a3b4702643dc5acea095fede", "type": "domain", "value": "isatap.geeographic.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-755d2fe7448e4ca825360e2f", "type": "domain", "value": "isatap.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-47020b9605b5e1edd8450f8f", "type": "domain", "value": "ivtqfoqdro.geeographic.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-27c3e2c7e8b4e3e2e2316642", "type": "domain", "value": "ivtqfoqdro.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7974c5100630fcfb9d3542e3", "type": "domain", "value": "myip.opendns.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-868f3c184b822687e2d47ae1", "type": "domain", "value": "myip.opendns.com.geeographic.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9d49e155431abab2cf841cd9", "type": "domain", "value": "qigpzlvhnkqxpl.geeographic.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-55809c00873a0abf57178408", "type": "domain", "value": "qigpzlvhnkqxpl.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-26e5b1aeff31f687528bb655", "type": "domain", "value": "qwpvlqamqfnzxfk.geeographic.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4500c065091a9f7c5281d54b", "type": "domain", "value": "qwpvlqamqfnzxfk.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ea2200a8ad9b4f16d8e6ad6e", "type": "domain", "value": "resolver1.opendns.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-62d4ef8b4d73fa960059bd78", "type": "domain", "value": "rtelyse.geeographic.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b7048f537968a47172b9d54c", "type": "domain", "value": "rtelyse.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b58b39a6773e532d00f719cc", "type": "domain", "value": "wpad.geeographic.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-615388b4ee66a255a27857f4", "type": "domain", "value": "www.bing.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-62ddb04a807edcf58f91d080", "type": "domain", "value": "zotwyog.geeographic.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2b63c5f8ca7620e5c6438358", "type": "domain", "value": "zotwyog.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eabc02445e3fc5de7cbfd411", "type": "domain", "value": "clients.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3d1c142cdbc289ed2866b033", "type": "domain", "value": "d.turn.com.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d475b4f47d8aebd69cf6f83d", "type": "domain", "value": "dart.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-927075e4570c73901fc890ea", "type": "domain", "value": "gstaticadssl.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2ec5ce5638b273e2fc69bd9e", "type": "domain", "value": "id.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9e2d9d2504ccc2c01b6451be", "type": "domain", "value": "insight-760077375.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8ea53542fc7a141e790b4f82", "type": "domain", "value": "internal-aol.imap.mail.g03.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-551ad5b02ec2c58d1fd58f7a", "type": "domain", "value": "match-975362022.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ad82dd55de80ef0b80f5b11b", "type": "domain", "value": "pagead.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ba08407c922e0c0aaf50bda7", "type": "domain", "value": "pagead46.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d06ade1561025e6077eb8525", "type": "domain", "value": "plus.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7869f6ad61164639fda129c0", "type": "domain", "value": "stats.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5e60ce220fc2f405d8148d64", "type": "domain", "value": "www-google-analytics.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d5ba35a22969dcc52b9136c7", "type": "ipv4", "value": "13.107.21.200", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1ea96aa254574842aab8bacd", "type": "ipv4", "value": "13.107.5.80", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4da0026cb9e4f177cea03e01", "type": "ipv4", "value": "131.107.255.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2020ab22b49b0fefabb9e0d2", "type": "ipv4", "value": "172.217.193.154", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4272154b7cc3ac9d68e91b44", "type": "ipv4", "value": "172.217.193.156", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-35a46fa76936e2e39c26a9ed", "type": "ipv4", "value": "172.217.193.157", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e5b855bc8158da1812068f75", "type": "ipv4", "value": "204.79.197.200", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-85e4c4121a9e2dd073f8b77b", "type": "ipv4", "value": "208.67.222.222", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a96d57583105445b7e025ce9", "type": "ipv4", "value": "34.192.90.231", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5063a8135db33567ad13441c", "type": "ipv4", "value": "34.198.191.149", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2fe4c9d090f11f4bced89b60", "type": "ipv4", "value": "34.198.228.49", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8c4625b1431bf9e62048f2e8", "type": "ipv4", "value": "34.199.147.194", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e3e861f982f1964af8a47a10", "type": "ipv4", "value": "34.202.147.29", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c42f4f0e5081de895ec60ebe", "type": "ipv4", "value": "34.203.74.207", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d3af9f2951996373301fdcfc", "type": "ipv4", "value": "34.204.248.161", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-81649eae5a41469b60e29231", "type": "ipv4", "value": "34.205.99.3", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0461f6271b5f9c68eb5d5320", "type": "ipv4", "value": "34.224.172.188", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d2c1c40d9e8c4b2b19307eb8", "type": "ipv4", "value": "34.236.63.37", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-16300952ed8342089811711b", "type": "ipv4", "value": "34.237.159.145", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bab59c6c22f7edabb0f3d668", "type": "ipv4", "value": "34.239.206.211", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e5a3048a0a292c7d2712825b", "type": "ipv4", "value": "35.168.218.13", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-64b1fee25d38f3d2c13f19ed", "type": "ipv4", "value": "35.168.53.247", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-237a41d1d0424703199cacdf", "type": "ipv4", "value": "35.168.67.88", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5359461d8786517f3527f2b1", "type": "ipv4", "value": "35.171.180.138", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a5acee315413f1a53032c55", "type": "ipv4", "value": "52.0.244.217", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d5d1f389eab9908c8d79e26", "type": "ipv4", "value": "52.20.145.225", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-87f4d98eceb1b246f654b9c8", "type": "ipv4", "value": "52.204.152.189", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3d0b7894639af765bef93085", "type": "ipv4", "value": "52.208.135.160", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bf43d7d277dbb3bf3ab9f3c9", "type": "ipv4", "value": "52.210.213.208", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-48308645d80dd8350defac8b", "type": "ipv4", "value": "52.210.34.59", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fe01852081f89ba181e400bb", "type": "ipv4", "value": "52.213.58.51", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-abb2a3bfad9f88e2b25ea9ed", "type": "ipv4", "value": "52.30.113.91", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f344292eba6a0286ce82d581", "type": "ipv4", "value": "52.31.219.56", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7f643758348f5fe07be1474b", "type": "ipv4", "value": "52.4.55.137", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bc1ba3b8d697db9e480e94d3", "type": "ipv4", "value": "52.7.21.186", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-637914063aeed587fb60a80a", "type": "ipv4", "value": "52.72.190.60", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-635c6394d648b043115f8b7e", "type": "ipv4", "value": "54.194.108.5", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8caacdd683ac68ead1ce5f37", "type": "ipv4", "value": "54.236.245.79", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-042756cea7f163316a81a755", "type": "ipv4", "value": "54.81.75.176", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5b47acd66181154a49b19b23", "type": "ipv4", "value": "54.85.197.245", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d8450b608418405e3788a125", "type": "ipv4", "value": "54.85.233.91", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d7da79bbb8c0c045c69bf3e", "type": "ipv4", "value": "54.85.96.132", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-175f80099b2abc96ee4ea3eb", "type": "ipv4", "value": "66.218.86.51", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2a80492895b8dc9f70b838ec", "type": "ipv4", "value": "72.246.64.227", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a2e944d6a0f34c63dc9a18aa", "type": "ipv4", "value": "72.246.64.48", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cddf6b6870d0c6f3920d7e2b", "type": "ipv4", "value": "72.45.33.49", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-750a4ec20c4568ef5fb26567", "type": "ipv4", "value": "95.181.198.116", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2629b953cbafd24b26cc21c5", "type": "sha256", "value": "0c6da6b5d4f5db2accb9c1847cd2686c683d0875750b069f14339c5f75c93029", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-707f5b38e3e2f4bdc68ebbb3", "type": "sha256", "value": "185f2b901d68c7451a492d90ed38aa2c1de840061735a06836c2587f958ed31c", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e6568fb4359a07c59863e2c4", "type": "sha256", "value": "20f3807f724bf5bb6c8a2cf7f62bc8003717104ef480c7dfd1b8dab767144bbc", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3734e0a84465c84950b1813f", "type": "sha256", "value": "3c19c9d085f085252c974a1ae0637fa809cf09d3c461c64cbae6a011f7d0b78a", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8c0da513bcfd5ccc427db6ca", "type": "sha256", "value": "5b107e17113a4c5a547d98a30bcd47aa3ad52317856828c762a67fda9f34baa0", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-da6ae9cc1d75e4c6b7f8226b", "type": "sha256", "value": "65f5df3cd45f3b8bf27731651a76b32bdef821fdb79451fa160ee55ff30467e2", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5196dcb8050c21df8409a99a", "type": "sha256", "value": "79ff1591234ea9434d7f96516781130625b1880ba4fa8eb965b278337e11f8ae", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bb0f4fd6b599a1df4bb1e63e", "type": "sha256", "value": "8768d73b262d33c7dceaedcbf83576d31129c8bef0d03be58e92a57a65bd81c2", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d84934048cf597232891d317", "type": "sha256", "value": "97f149f146b0ec63c32abff204ae27638f0310536172b0f718f1a91a5672fe71", "priority": 95, "reasons": [ "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9fa2e5d5eba6174221797cce", "type": "sha256", "value": "b43e75f48fa68b71ee6e66751c0c3822314ca6dc592fce9309495baada78de54", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31ed6f1cfb021b5f88bc0e2e", "type": "sha256", "value": "b74056eea98bad621835b90b80499dad886c07ef70b5213bcde0408e63908c6f", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9e438367c403e3736556685e", "type": "sha256", "value": "cbf768030ad75e8aec0263d9d2286c2b0106cf7ac4daa17396129b172a93d1a9", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3e6dee4603a4515a01a1b84a", "type": "sha256", "value": "d9f5dfcc2555a6e6c530c190b3c6f1cac2a0af97b3689547713dc28bece0e7cd", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6968f4fb2f3c066fbd38903e", "type": "domain", "value": "shumbildac.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d3ef54ed0a77d7397cf3097", "type": "domain", "value": "www.ucdenver.edu", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a5e011eaf34a9f65fb65b8dc", "type": "ipv4", "value": "132.194.7.45", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c3c30bb4425a57c616eceff2", "type": "ipv4", "value": "46.29.160.132", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fb2fb7f3e57387b2a384320b", "type": "domain", "value": "geeographic.com", "priority": 60, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8c7714c9663fb13e969b823e", "type": "domain", "value": "8895986.fls.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-67465105eb2809011101c666", "type": "domain", "value": "accounts.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b578dfec4888ddf453845f49", "type": "domain", "value": "adservice.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-62b026f73495a5b2eefe016b", "type": "domain", "value": "apis.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-122cb53407c2e674a4f471ea", "type": "domain", "value": "bcp.crwdcntrl.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e673700f33c2c3abd27fd3c", "type": "domain", "value": "clas.ucdenver.edu", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-35630b515d9ad5769a73256f", "type": "domain", "value": "clients1.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-12cd3660baa52069462972d2", "type": "domain", "value": "clients4.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a3d213d50ded7c2e91e96df3", "type": "domain", "value": "clientservices.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f9f11af8f854548312ef7397", "type": "domain", "value": "cm.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-301587461d33f4e8c1f39244", "type": "domain", "value": "d.turn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7ae438e8626189b74c9c6565", "type": "domain", "value": "dhsiwyqdlskwsqo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c3ff049d6f0f870213a3176c", "type": "domain", "value": "dpm.demdex.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-401b761c8d6def0363683e3e", "type": "domain", "value": "dsum-sec.casalemedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d7f19f8f3ad18e111995475f", "type": "domain", "value": "encrypted-tbn0.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-20db76c9fa45a8a6c1564856", "type": "domain", "value": "fast.fonts.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-caa6f83142fc298c4f8d6504", "type": "domain", "value": "ferranorga.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f0c2c98739377c14851c6e78", "type": "domain", "value": "fonts.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-134ab603116d577cb84b3abf", "type": "domain", "value": "id.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b69e3469f6f679e84580c258", "type": "domain", "value": "imap.aol.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2571d9fa8179fcc9138c955e", "type": "domain", "value": "insight.adsrvr.org", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e972fea16b78401a5908f612", "type": "domain", "value": "link.sandwseafood.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4663fbcd1880377d6c888fe2", "type": "domain", "value": "loadm.exelator.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fd17edd3a7909b774bd4d51c", "type": "domain", "value": "match.adsrvr.org", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-18efee90dbc224c812f4d720", "type": "domain", "value": "pixel-a.basis.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-09ba2869e24c38b49f7f0ad1", "type": "domain", "value": "pixel.sitescout.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6b213329f8d22d5bad109f74", "type": "domain", "value": "pixel.tapad.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7c0dbfd21c4682b2054a9f52", "type": "domain", "value": "smtp.aol.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5e9c2ec899b3ebb34dbaccf0", "type": "domain", "value": "ssl.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6dd04867ae87187c3f27ca5d", "type": "domain", "value": "stats.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f5b6ee48e7d40263a95b34b5", "type": "domain", "value": "sync.teads.tv", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5ae3daa0e9eb17c965f20dd2", "type": "domain", "value": "tmencedfur.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ec542fdb8af56d18e58b5d45", "type": "domain", "value": "translate.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0a3bb044e7438ac406e39af2", "type": "domain", "value": "www.download.windowsupdate.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-94c40bdfee6ade1aab13c77d", "type": "domain", "value": "www.ferranorga.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e31c933b7cc675cb0ce5d21", "type": "domain", "value": "www.google-analytics.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d70db8e6142b8baa844ac221", "type": "domain", "value": "www.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0c371a019d4be3c62e4ba2a7", "type": "domain", "value": "www.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-99aef14f278eca3ac854985c", "type": "domain", "value": "www.msftncsi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d5a590291f810175c03f0ede", "type": "ipv4", "value": "107.178.246.49", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5d0ed2184af875d1459e0664", "type": "ipv4", "value": "132.194.39.10", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ff728c34b9268feadcac6bf", "type": "ipv4", "value": "172.217.15.194", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aa6c9123c582d80d90d3beee", "type": "ipv4", "value": "172.217.193.155", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-088fb0e25ac0ffac788570e0", "type": "ipv4", "value": "172.217.2.68", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-86921d45dce416f492ffe77d", "type": "ipv4", "value": "172.217.3.66", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c0981e2d028bc3f9c59dd1c6", "type": "ipv4", "value": "172.217.3.67", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3b6808bbf4b5b6620b4326d0", "type": "ipv4", "value": "192.162.244.171", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a35a2f1aa19a676ef93af986", "type": "ipv4", "value": "209.15.36.22", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d7d11cd1fc9f237913cab2f6", "type": "ipv4", "value": "216.58.192.35", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-deda4d116456054eff68fac8", "type": "ipv4", "value": "216.58.192.38", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74fbd116c6652cd54f09bc08", "type": "ipv4", "value": "216.58.192.42", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-668f20c520a82d4f171bc13f", "type": "ipv4", "value": "216.58.192.45", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-00d0b56c8c27cc813e704fd6", "type": "ipv4", "value": "216.58.192.46", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-00e6b1eab9f0fd7d4245946d", "type": "ipv4", "value": "216.58.192.67", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a9daf1b54f3867ddcc7a6e82", "type": "ipv4", "value": "23.56.194.57", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-36aae558a6cbd96b4ac20c18", "type": "ipv4", "value": "34.192.39.141", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-55276904c0cca8e9ef7c902b", "type": "ipv4", "value": "34.227.43.215", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c8e93d4cfcd896ee9b62e06d", "type": "ipv4", "value": "46.229.214.92", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0334862e1b5d13ee6652b009", "type": "ipv4", "value": "50.116.194.23", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 265, "next_batch": [ "observable-d9125d75bcf4d5ed0298ec84", "observable-c145993b649196eb7a3aa8c7", "observable-61b2fd9ec287fb2a38e01447", "observable-1f22579e90fc92c7afba86e1", "observable-de949209917a7096fd60b219", "observable-d5d5ec59c6e8f76eb497e155", "observable-7a9bfce6cc5e3f74286ce188", "observable-5fae8a8fc5e16aadb921ea24", "observable-37aa9523f7ebb6f58a96a4a0", "observable-3f7aa774d41205e14974187a" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "3487d1b73191f71b5bd55ce0e78b961e7e804d6c3a39fb3b350c8b775dfa8a5b" }, "enrichment": { "items": [ { "type": "ipv4", "value": "50.116.194.23", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.927593+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.923122+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:43.918667+00:00", "observable_id": "observable-0334862e1b5d13ee6652b009" }, { "type": "ipv4", "value": "46.229.214.92", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.733252+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.729119+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:43.724347+00:00", "observable_id": "observable-c8e93d4cfcd896ee9b62e06d" }, { "type": "ipv4", "value": "34.227.43.215", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.540276+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.538539+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:43.535745+00:00", "observable_id": "observable-55276904c0cca8e9ef7c902b" }, { "type": "ipv4", "value": "34.192.39.141", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.350424+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.345087+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:43.340832+00:00", "observable_id": "observable-36aae558a6cbd96b4ac20c18" }, { "type": "ipv4", "value": "23.56.194.57", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.150147+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:43.144375+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:43.139047+00:00", "observable_id": "observable-a9daf1b54f3867ddcc7a6e82" }, { "type": "ipv4", "value": "216.58.192.67", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:42.955650+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:42.951136+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:42.946419+00:00", "observable_id": "observable-00e6b1eab9f0fd7d4245946d" }, { "type": "ipv4", "value": "216.58.192.46", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:42.767150+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:42.765185+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:42.761404+00:00", "observable_id": "observable-00d0b56c8c27cc813e704fd6" }, { "type": "ipv4", "value": "216.58.192.45", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:42.394463+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:42.390430+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:42.384650+00:00", "observable_id": "observable-668f20c520a82d4f171bc13f" }, { "type": "ipv4", "value": "216.58.192.42", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:42.194591+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:42.190425+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:42.184332+00:00", "observable_id": "observable-74fbd116c6652cd54f09bc08" }, { "type": "ipv4", "value": "216.58.192.38", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.891343+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.887293+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:41.882293+00:00", "observable_id": "observable-deda4d116456054eff68fac8" }, { "type": "ipv4", "value": "216.58.192.35", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.678099+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.674142+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:41.669386+00:00", "observable_id": "observable-d7d11cd1fc9f237913cab2f6" }, { "type": "ipv4", "value": "209.15.36.22", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.441659+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.437458+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:41.432520+00:00", "observable_id": "observable-a35a2f1aa19a676ef93af986" }, { "type": "ipv4", "value": "192.162.244.171", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.261508+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.259802+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:41.257796+00:00", "observable_id": "observable-3b6808bbf4b5b6620b4326d0" }, { "type": "ipv4", "value": "172.217.3.67", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.044739+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:41.040800+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:41.036139+00:00", "observable_id": "observable-c0981e2d028bc3f9c59dd1c6" }, { "type": "ipv4", "value": "172.217.3.66", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:40.828983+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:40.826895+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:40.824688+00:00", "observable_id": "observable-86921d45dce416f492ffe77d" }, { "type": "ipv4", "value": "172.217.2.68", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:40.642371+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:40.638077+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:40.633365+00:00", "observable_id": "observable-088fb0e25ac0ffac788570e0" }, { "type": "ipv4", "value": "172.217.193.155", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:40.442285+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:40.437884+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:40.430388+00:00", "observable_id": "observable-aa6c9123c582d80d90d3beee" }, { "type": "ipv4", "value": "172.217.15.194", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:40.025877+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:40.021621+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:40.017077+00:00", "observable_id": "observable-0ff728c34b9268feadcac6bf" }, { "type": "ipv4", "value": "132.194.39.10", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.839555+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.835130+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:39.830115+00:00", "observable_id": "observable-5d0ed2184af875d1459e0664" }, { "type": "ipv4", "value": "107.178.246.49", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.664824+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.663044+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:39.661303+00:00", "observable_id": "observable-d5a590291f810175c03f0ede" }, { "type": "domain", "value": "www.msftncsi.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.659633+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:39.658128+00:00", "observable_id": "observable-99aef14f278eca3ac854985c" }, { "type": "domain", "value": "www.gstatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:45.870621+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.656487+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:39.654921+00:00", "observable_id": "observable-0c371a019d4be3c62e4ba2a7" }, { "type": "domain", "value": "www.google.com", "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:45.279334+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "www.google.com", "target": "meet.google.com-join.us", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.usercontent.google.com/download?id=1RsoI3BAuH3uMNc6wdwwamUtsJhL6hHiB&export=download&confirm=t&uuid=32ec83bf-6d8e-4069-ac04-2cc059ae19e5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/claudemacos", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/brewpage", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/version-0105", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/hiddenhub", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xnewbrenow", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/mellerbrew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clodemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbreshamewmew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/onemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clavdenbewvews", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-deskt-ver-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/deutchbremac", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-ver-un-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-ver-un-v25", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbrewmacboe", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/claumacxvsz", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/payforwin", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbiernlk", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/newpayservices.com/cdx-biz-ver-un-v27", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/newappclaude.com/clau-ver-un-30", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7T", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/mehrmarkenwerkstattheiligensta/home", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/facturacion2026mx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.652487+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:39.650701+00:00", "observable_id": "observable-d70db8e6142b8baa844ac221" }, { "type": "domain", "value": "www.google-analytics.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:55.888530+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.648573+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:39.646337+00:00", "observable_id": "observable-1e31c933b7cc675cb0ce5d21" }, { "type": "domain", "value": "www.ferranorga.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.470054+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.465372+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:39.459807+00:00", "observable_id": "observable-94c40bdfee6ade1aab13c77d" }, { "type": "domain", "value": "www.download.windowsupdate.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:30.124643+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.454137+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:39.447797+00:00", "observable_id": "observable-0a3bb044e7438ac406e39af2" }, { "type": "domain", "value": "translate.googleapis.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.290280+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:39.288231+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:39.285415+00:00", "observable_id": "observable-ec542fdb8af56d18e58b5d45" }, { "type": "domain", "value": "tmencedfur.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.977425+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.973257+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:38.967792+00:00", "observable_id": "observable-5ae3daa0e9eb17c965f20dd2" }, { "type": "domain", "value": "sync.teads.tv", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.794851+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.791684+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:38.787215+00:00", "observable_id": "observable-f5b6ee48e7d40263a95b34b5" }, { "type": "domain", "value": "stats.g.doubleclick.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.596218+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.594573+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:38.592919+00:00", "observable_id": "observable-6dd04867ae87187c3f27ca5d" }, { "type": "domain", "value": "ssl.gstatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:44.559966+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.590976+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:38.588914+00:00", "observable_id": "observable-5e9c2ec899b3ebb34dbaccf0" }, { "type": "domain", "value": "smtp.aol.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.419950+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.415176+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:38.410199+00:00", "observable_id": "observable-7c0dbfd21c4682b2054a9f52" }, { "type": "domain", "value": "pixel.tapad.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.238141+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.233314+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:38.228384+00:00", "observable_id": "observable-6b213329f8d22d5bad109f74" }, { "type": "domain", "value": "pixel.sitescout.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.050346+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:38.045163+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:38.040614+00:00", "observable_id": "observable-09ba2869e24c38b49f7f0ad1" }, { "type": "domain", "value": "pixel-a.basis.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.821359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.816812+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:37.812393+00:00", "observable_id": "observable-18efee90dbc224c812f4d720" }, { "type": "domain", "value": "match.adsrvr.org", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.626520+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.622199+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:37.616206+00:00", "observable_id": "observable-fd17edd3a7909b774bd4d51c" }, { "type": "domain", "value": "loadm.exelator.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.438315+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.433701+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:37.428771+00:00", "observable_id": "observable-4663fbcd1880377d6c888fe2" }, { "type": "domain", "value": "link.sandwseafood.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.058363+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.056410+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:37.054114+00:00", "observable_id": "observable-e972fea16b78401a5908f612" }, { "type": "domain", "value": "insight.adsrvr.org", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:23.280099+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:37.050886+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:37.048032+00:00", "observable_id": "observable-2571d9fa8179fcc9138c955e" }, { "type": "domain", "value": "imap.aol.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.880362+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.876270+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:36.871963+00:00", "observable_id": "observable-b69e3469f6f679e84580c258" }, { "type": "domain", "value": "id.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.697516+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.694745+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:36.692069+00:00", "observable_id": "observable-134ab603116d577cb84b3abf" }, { "type": "domain", "value": "fonts.gstatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:19.985832+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.688622+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:36.683720+00:00", "observable_id": "observable-f0c2c98739377c14851c6e78" }, { "type": "domain", "value": "ferranorga.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.516907+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.512288+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:36.507919+00:00", "observable_id": "observable-caa6f83142fc298c4f8d6504" }, { "type": "domain", "value": "fast.fonts.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.297808+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.293042+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:36.285390+00:00", "observable_id": "observable-20db76c9fa45a8a6c1564856" }, { "type": "domain", "value": "encrypted-tbn0.gstatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.122796+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.119516+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:36.116352+00:00", "observable_id": "observable-d7f19f8f3ad18e111995475f" }, { "type": "domain", "value": "dsum-sec.casalemedia.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:17.077543+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.113351+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:36.109151+00:00", "observable_id": "observable-401b761c8d6def0363683e3e" }, { "type": "domain", "value": "dpm.demdex.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:16.880908+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:36.104314+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:36.099221+00:00", "observable_id": "observable-c3ff049d6f0f870213a3176c" }, { "type": "domain", "value": "dhsiwyqdlskwsqo.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.715270+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.713493+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:35.711304+00:00", "observable_id": "observable-7ae438e8626189b74c9c6565" }, { "type": "domain", "value": "d.turn.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.544496+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.540168+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:35.535877+00:00", "observable_id": "observable-301587461d33f4e8c1f39244" }, { "type": "domain", "value": "cm.g.doubleclick.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:13.189219+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.531470+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:35.526597+00:00", "observable_id": "observable-f9f11af8f854548312ef7397" }, { "type": "domain", "value": "clientservices.googleapis.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.307559+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.302944+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:35.297205+00:00", "observable_id": "observable-a3d213d50ded7c2e91e96df3" }, { "type": "domain", "value": "clients4.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.134248+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.130498+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:35.126158+00:00", "observable_id": "observable-12cd3660baa52069462972d2" }, { "type": "domain", "value": "clients1.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:17.998377+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:35.121442+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:35.116053+00:00", "observable_id": "observable-35630b515d9ad5769a73256f" }, { "type": "domain", "value": "clas.ucdenver.edu", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.922724+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.917508+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:34.912692+00:00", "observable_id": "observable-1e673700f33c2c3abd27fd3c" }, { "type": "domain", "value": "bcp.crwdcntrl.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.683484+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.679656+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:34.675293+00:00", "observable_id": "observable-122cb53407c2e674a4f471ea" }, { "type": "domain", "value": "apis.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:52.412014+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.670580+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:34.666747+00:00", "observable_id": "observable-62b026f73495a5b2eefe016b" }, { "type": "domain", "value": "adservice.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:49.436607+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.662419+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:34.657818+00:00", "observable_id": "observable-b578dfec4888ddf453845f49" }, { "type": "domain", "value": "accounts.google.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.506581+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:14.429042+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.497218+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:34.490820+00:00", "observable_id": "observable-67465105eb2809011101c666" }, { "type": "domain", "value": "8895986.fls.doubleclick.net", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.490719+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.315125+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.310495+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:34.305288+00:00", "observable_id": "observable-8c7714c9663fb13e969b823e" }, { "type": "domain", "value": "geeographic.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.305225+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.132589+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.128121+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:34.121196+00:00", "observable_id": "observable-fb2fb7f3e57387b2a384320b" }, { "type": "ipv4", "value": "46.29.160.132", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:34.121111+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.900519+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.896621+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:33.892645+00:00", "observable_id": "observable-c3c30bb4425a57c616eceff2" }, { "type": "ipv4", "value": "132.194.7.45", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.892575+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.671792+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.667511+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:33.663420+00:00", "observable_id": "observable-a5e011eaf34a9f65fb65b8dc" }, { "type": "domain", "value": "www.ucdenver.edu", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.663359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.492496+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.488133+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:33.483230+00:00", "observable_id": "observable-8d3ef54ed0a77d7397cf3097" }, { "type": "domain", "value": "shumbildac.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.483164+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.219839+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:33.216908+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:33.213911+00:00", "observable_id": "observable-6968f4fb2f3c066fbd38903e" }, { "type": "sha256", "value": "d9f5dfcc2555a6e6c530c190b3c6f1cac2a0af97b3689547713dc28bece0e7cd", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:32.867619+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:32.662505+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:32.660609+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:32.657459+00:00", "observable_id": "observable-3e6dee4603a4515a01a1b84a" }, { "type": "sha256", "value": "cbf768030ad75e8aec0263d9d2286c2b0106cf7ac4daa17396129b172a93d1a9", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:32.295490+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:32.089801+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:32.087290+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:32.085219+00:00", "observable_id": "observable-9e438367c403e3736556685e" }, { "type": "sha256", "value": "b74056eea98bad621835b90b80499dad886c07ef70b5213bcde0408e63908c6f", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:31.740334+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:31.442505+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:31.439136+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:31.434475+00:00", "observable_id": "observable-31ed6f1cfb021b5f88bc0e2e" }, { "type": "sha256", "value": "b43e75f48fa68b71ee6e66751c0c3822314ca6dc592fce9309495baada78de54", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:30.924712+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:30.618260+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:30.614570+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:30.611049+00:00", "observable_id": "observable-9fa2e5d5eba6174221797cce" }, { "type": "sha256", "value": "97f149f146b0ec63c32abff204ae27638f0310536172b0f718f1a91a5672fe71", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:30.296308+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:30.086433+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:30.084166+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:30.081933+00:00", "observable_id": "observable-d84934048cf597232891d317" }, { "type": "sha256", "value": "8768d73b262d33c7dceaedcbf83576d31129c8bef0d03be58e92a57a65bd81c2", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:29.716033+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:29.497365+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:29.492068+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:29.486371+00:00", "observable_id": "observable-bb0f4fd6b599a1df4bb1e63e" }, { "type": "sha256", "value": "79ff1591234ea9434d7f96516781130625b1880ba4fa8eb965b278337e11f8ae", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:29.088239+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:28.888821+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:28.887041+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:28.884741+00:00", "observable_id": "observable-5196dcb8050c21df8409a99a" }, { "type": "sha256", "value": "65f5df3cd45f3b8bf27731651a76b32bdef821fdb79451fa160ee55ff30467e2", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:28.548013+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:28.362091+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:28.360073+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:28.357531+00:00", "observable_id": "observable-da6ae9cc1d75e4c6b7f8226b" }, { "type": "sha256", "value": "5b107e17113a4c5a547d98a30bcd47aa3ad52317856828c762a67fda9f34baa0", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:27.951731+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:27.754678+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:27.750839+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:27.746278+00:00", "observable_id": "observable-8c0da513bcfd5ccc427db6ca" }, { "type": "sha256", "value": "3c19c9d085f085252c974a1ae0637fa809cf09d3c461c64cbae6a011f7d0b78a", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:27.334332+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:27.060266+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:27.056013+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:27.051166+00:00", "observable_id": "observable-3734e0a84465c84950b1813f" }, { "type": "sha256", "value": "20f3807f724bf5bb6c8a2cf7f62bc8003717104ef480c7dfd1b8dab767144bbc", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:26.827609+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:26.524681+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:26.520652+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:26.515625+00:00", "observable_id": "observable-e6568fb4359a07c59863e2c4" }, { "type": "sha256", "value": "185f2b901d68c7451a492d90ed38aa2c1de840061735a06836c2587f958ed31c", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:26.108862+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:25.903998+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:25.902023+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:25.899274+00:00", "observable_id": "observable-707f5b38e3e2f4bdc68ebbb3" }, { "type": "sha256", "value": "0c6da6b5d4f5db2accb9c1847cd2686c683d0875750b069f14339c5f75c93029", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:25.494748+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:48:25.184598+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:48:25.179826+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:48:25.174798+00:00", "observable_id": "observable-2629b953cbafd24b26cc21c5" } ], "coverage": { "cache_hits": 0, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-00d0b56c8c27cc813e704fd6" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-00d0b56c8c27cc813e704fd6" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-00e6b1eab9f0fd7d4245946d" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-00e6b1eab9f0fd7d4245946d" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-a9daf1b54f3867ddcc7a6e82" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-a9daf1b54f3867ddcc7a6e82" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-36aae558a6cbd96b4ac20c18" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-36aae558a6cbd96b4ac20c18" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-55276904c0cca8e9ef7c902b" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-55276904c0cca8e9ef7c902b" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-c8e93d4cfcd896ee9b62e06d" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-c8e93d4cfcd896ee9b62e06d" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-0334862e1b5d13ee6652b009" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-0334862e1b5d13ee6652b009" } ], "batch_targets": 7, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 77, "full_urls_disclosed": 0, "provider_lookups_started": 7 }, "updated_at": "2026-09-22T17:48:44.130550+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "0565714e317ce67e68fdf0cfb19b84e068ff1650ffa6d0955c4aba3bda3d7d50", "source_semantic_sha256": "57ac59ede6c21b271cff5569fb1729d405a4dfed64df8fb1626b4bf8d9d493e2", "previous_snapshot_sha256": "14133bc70750332ea35666d5d560936964a050fb526904d6e6d8c923c953ae61" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "tactic": "command-and-control", "confidence": 0.8, "evidence": "T1105 Ingress Tool Transfer", "review_status": "suggested", "evidence_start": 20680, "evidence_end": 20707, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null } ], "apt_matches": [ { "group_attack_id": "G0123", "group_name": "Volatile Cedar", "similarity": 0.2, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0044", "group_name": "Winnti Group", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0130", "group_name": "Ajax Security Team", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0136", "group_name": "IndigoZebra", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0133", "group_name": "Nomadic Octopus", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G1013", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0107", "group_name": "Whitefly", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0066", "group_name": "Elderwood", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0075", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0120", "group_name": "Evilnum", "similarity": 0.0909, "shared_count": 1, "shared_techniques": [ "T1105" ] } ], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }