{ "analysis_id": "5bff54cd-16de-44cb-a009-c88818ce138f", "session_id": "900128f8-0b80-4266-8ed1-7a1b5d6a8a0a", "status": "completed", "filename": "2019-02-23-traffic-analysis-exercise.pcap", "source_sha256": "f6d740aeaac9e7d23843b481b7cbc179117cd21fab2f0d82c0e94fe8ba092775", "source_size_bytes": 19746995, "schema_version": "pcap-analysis-v1", "semantic_sha256": "6a25f7bd75a7b1f270d5c53f627231d7b0295bb014e382846fcd0e77a59bd0c8", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 28884 packets across 36 IP endpoints and 376 transport flows. Observed 202 DNS events, 60 HTTP requests, 51 TLS ClientHello events, and 52 recovered file/message object(s). Deterministic rules produced 16 finding(s): 1 high, 7 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2019-02-23-traffic-analysis-exercise.pcap\nCapture SHA-256: `f6d740aeaac9e7d23843b481b7cbc179117cd21fab2f0d82c0e94fe8ba092775`\nSemantic result SHA-256: `6a25f7bd75a7b1f270d5c53f627231d7b0295bb014e382846fcd0e77a59bd0c8`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 28884 packets across 36 IP endpoints and 376 transport flows. Observed 202 DNS events, 60 HTTP requests, 51 TLS ClientHello events, and 52 recovered file/message object(s). Deterministic rules produced 16 finding(s): 1 high, 7 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 28884\n- Duration: 2708.694353 seconds\n- Captured bytes: 19284827\n- Endpoints: 36\n- Flows: 376\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 1433 / TCP stream 82, frame 2049 / TCP stream 82.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":357021,\"destination\":\"10.2.23.109\",\"response_count\":1,\"source\":\"151.101.64.238\",\"uri\":\"/universal/scripts-compressed/common-c2a92195cbc0a2d6aed1-min.en-US.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 1526 / TCP stream 83, frame 1594 / TCP stream 83.\n\nMetrics: `{\"content_type\":\"text/javascript;charset=utf-8\",\"declared_body_bytes\":7843,\"destination\":\"10.2.23.109\",\"response_count\":1,\"source\":\"23.63.25.226\",\"uri\":\"/ik/qtSfIe0hWL1wtEbIsJFPUsITCi0N4DUQd5Tzt0wJ8s6feGw2fFHN4UJLFRbh52jhWD9DwQShjAw3ZQsKweFR5eIuF2MkFRbXwgTuiaiaO14zdasDjhBcZWFCjkoRdhXCScNziYFRjAZ8ShUROcFzdPUCiAoTdkuqZWZ8deN3dAm0ifuE-QJUO1FUiABkZWF3jAF8OcFzdP37OcUudc8zOAs8icmCdaglZAoXOWTTwRI0SaBujW48Sagyjh90jhNlJ6U3ScNt-AuyOAozicIKgcBqZAUCZPG4fHCgIMMjMPMfH6qJtKGbMg62JMJ7fbKzMsMMeMb6MKG4fHXgIMMjgKMfH6qJK3IbMg6YJMJ7fbKTMsMMeM66MKG4f5w7IMMj2PMfH6qJKbIbMg64JMJ7fbK3MsMMeMt6MKG4fHtgIMMjIfMfH6qJRMIbMg6sJMJ7fbK7MsMMegJ6MKG4fJGgIMMjIkMfH6qJXR9bMs62JMJ7fbR5FsMgeMb6MKG4fFIVIMIjgkMfH6qJXD9bMs6FJMJ7fbRVFsMgeMt6MKG4fFJVIMIjIPMf.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6249 / TCP stream 110, frame 11971 / TCP stream 110.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":2818560,\"destination\":\"10.2.23.231\",\"response_count\":1,\"source\":\"46.249.62.199\",\"uri\":\"/Tinx86_14.exe\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6262 / TCP stream 109, frame 6800 / TCP stream 109.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":168448,\"destination\":\"10.2.23.231\",\"response_count\":1,\"source\":\"46.249.62.199\",\"uri\":\"/Sw9JKmXqaSj.exe\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 25149 / TCP stream 230, frame 27968 / TCP stream 230.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":126945,\"destination\":\"10.2.23.109\",\"response_count\":1,\"source\":\"161.119.42.22\",\"uri\":\"/apps/LeenaCanvas/Package-HTML/HTML/js/functions.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 25868 / TCP stream 226, frame 26841 / TCP stream 226.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":95954,\"destination\":\"10.2.23.109\",\"response_count\":1,\"source\":\"161.119.42.22\",\"uri\":\"/apps/LeenaCanvas/Package-HTML/HTML/js/jquery.js\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 568 / TCP stream 32, frame 570 / TCP stream 32, frame 572 / TCP stream 32, frame 574 / TCP stream 32, frame 1060 / TCP stream 32.\n\nMetrics: `{\"destination\":\"10.2.23.2\",\"event_count\":8,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.2.23.109\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 418 / TCP stream 23, frame 453 / TCP stream 23, frame 456 / TCP stream 23, frame 626 / TCP stream 37, frame 643 / TCP stream 37.\n\nMetrics: `{\"destination\":\"10.2.23.2\",\"event_count\":30,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.2.23.109\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 569 / TCP stream 32, frame 571 / TCP stream 32, frame 573 / TCP stream 32, frame 575 / TCP stream 32, frame 1061 / TCP stream 32.\n\nMetrics: `{\"destination\":\"10.2.23.109\",\"event_count\":8,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.2.23.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 420 / TCP stream 23, frame 455 / TCP stream 23, frame 628 / TCP stream 37, frame 645 / TCP stream 37, frame 647 / TCP stream 37.\n\nMetrics: `{\"destination\":\"10.2.23.109\",\"event_count\":24,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\"],\"protocol\":\"ldap\",\"source\":\"10.2.23.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 130 / TCP stream 6, frame 132 / TCP stream 6, frame 134 / TCP stream 6, frame 136 / TCP stream 6, frame 858 / TCP stream 44.\n\nMetrics: `{\"destination\":\"10.2.23.231\",\"event_count\":14,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.2.23.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 19 / TCP stream 0, frame 54 / TCP stream 0, frame 146 / TCP stream 10, frame 163 / TCP stream 10, frame 165 / TCP stream 10.\n\nMetrics: `{\"destination\":\"10.2.23.231\",\"event_count\":377,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,4,4,4,4,4,4,4,4,4,4,19,19,19,5\",\"4,4,4,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.2.23.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 129 / TCP stream 6, frame 131 / TCP stream 6, frame 133 / TCP stream 6, frame 135 / TCP stream 6, frame 857 / TCP stream 44.\n\nMetrics: `{\"destination\":\"10.2.23.2\",\"event_count\":14,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.2.23.231\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 17 / TCP stream 0, frame 52 / TCP stream 0, frame 55 / TCP stream 0, frame 144 / TCP stream 10, frame 161 / TCP stream 10.\n\nMetrics: `{\"destination\":\"10.2.23.2\",\"event_count\":386,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.2.23.231\"}`\n\n### HIGH — Credential-shaped records in a cleartext HTTP request\n\nThe decoded request body contains a credential-record structure or private-key marker. Values are redacted from derived evidence. This proves transmission of the observed structure, not that a credential is valid or how it was obtained.\n\nRule: `sensitive-data-in-cleartext@pcap-rules-v5`; confidence: 0.95; evidence: frame 23816 / TCP stream 208.\n\nMetrics: `{\"body_sha256\":\"d95a35fac8425ed6c010066a81b4330ade8dd325713e077d67fcfd33e7cafcac\",\"body_size_bytes\":262,\"destination\":\"190.146.112.216\",\"secrets_redacted\":true,\"source\":\"10.2.23.231\"}`\n\n### MEDIUM — System-inventory structure transmitted in HTTP body\n\nA request body contains process/system inventory markers and may include host/account assertions. This is network-observed transmission, not proof of the commands having executed on that host.\n\nRule: `system-inventory-upload@pcap-rules-v5`; confidence: 0.9; evidence: frame 26591 / TCP stream 237.\n\nMetrics: `{\"body_sha256\":\"77ab5e18a4c52fe1b402ca8907ad3315c19e1fb7ed19aaa03f1fb3070cd286b1\",\"claimed_identities\":[{\"source\":\"explicit-body-label\",\"type\":\"hostname\",\"value\":\"Ferguson-Win-PC\"},{\"source\":\"explicit-body-label\",\"type\":\"account\",\"value\":\"ruby.ferguson\"}],\"destination\":\"190.146.112.216\",\"source\":\"10.2.23.231\"}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `byron.sutton`; client IPs: 10.2.23.109; frames: 511, 519, 521, 533, 557\n- account: `ferguson-win-pc$`; client IPs: 10.2.23.231; frames: 24, 32, 34, 46, 337\n- account: `ruby.ferguson`; client IPs: 10.2.23.231; frames: 96, 104, 106, 118, 155\n- account: `sutton-win-pc$`; client IPs: 10.2.23.109; frames: 425, 433, 435, 447, 766\n- domain: `STORMTHEORY`; client IPs: 10.2.23.109, 10.2.23.231; frames: 239, 683, 13662, 14129, 14746\n- hostname: `Ferguson-Win-PC`; client IPs: 10.2.23.231; frames: 292, 3113, 19103, 24655, 1\n- hostname: `Sutton-Win-PC`; client IPs: 10.2.23.109; frames: 493, 1179, 14586, 24715, 400\n- netbios-group: `STORMTHEORY`; client IPs: unbound subject; frames: 84, 267, 285, 287, 401\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `112.146.166.173.b.barracudacentral.org`; roles: dns-query\n- domain: `112.146.166.173.cbl.abuseat.org`; roles: dns-query\n- domain: `112.146.166.173.dnsbl-1.uceprotect.net`; roles: dns-query\n- domain: `112.146.166.173.spam.dnsbl.sorbs.net`; roles: dns-query\n- domain: `112.146.166.173.zen.spamhaus.org`; roles: dns-query\n- domain: `api.bing.com`; roles: dns-query\n- domain: `cranetisti.com`; roles: dns-query, tls-sni\n- domain: `crl.microsoft.com`; roles: dns-query, http-host\n- domain: `dicarkadar.com`; roles: dns-query\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `ferguson-win-pc.stormtheory.info`; roles: dns-query\n- domain: `fonts.googleapis.com`; roles: dns-query, http-host\n- domain: `fonts.gstatic.com`; roles: dns-query, http-host\n- domain: `googleadapis.l.google.com`; roles: dns-cname\n- domain: `gstaticadssl.l.google.com`; roles: dns-cname\n- domain: `iecvlist.microsoft.com`; roles: dns-query, tls-sni\n- domain: `ipecho.net`; roles: dns-query, http-host, tls-sni\n- domain: `isatap.localdomain`; roles: dns-query\n- domain: `p.typekit.net`; roles: dns-query, tls-sni\n- domain: `prod.squarespace.map.fastly.net`; roles: dns-cname\n- domain: `rootscafeslc.com`; roles: dns-query, http-host\n- domain: `static.squarespace.com`; roles: dns-query, http-host, tls-sni\n- domain: `static1.squarespace.com`; roles: dns-query, http-host, tls-sni\n- domain: `stormtheory-dc.stormtheory.info`; roles: dns-query\n- domain: `stormtheory.info`; roles: dns-query\n- domain: `superhaps.pw`; roles: dns-query, http-host, tls-sni\n- domain: `sutton-win-pc.stormtheory.info`; roles: dns-query\n- domain: `use.typekit.net`; roles: dns-query, http-host, tls-sni\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `wpad.stormtheory.info`; roles: dns-query\n- domain: `www-googletagmanager.l.google.com`; roles: dns-cname\n- domain: `www.bing.com`; roles: dns-query, http-host\n- domain: `www.co.utah.ut.us`; roles: dns-query, http-host\n- domain: `www.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `www.googletagmanager.com`; roles: dns-query, tls-sni\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- domain: `www.rootscafeslc.com`; roles: dns-query, http-host\n- ipv4: `10.2.23.1`; roles: network-endpoint\n- ipv4: `10.2.23.109`; roles: dns-answer, network-endpoint\n- ipv4: `10.2.23.2`; roles: dns-answer, network-endpoint\n- ipv4: `10.2.23.231`; roles: dns-answer, network-endpoint\n- ipv4: `10.2.23.254`; roles: network-endpoint\n- ipv4: `10.2.23.255`; roles: network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer\n- ipv4: `13.107.5.80`; roles: dns-answer\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `151.101.0.238`; roles: dns-answer, network-endpoint\n- ipv4: `151.101.128.238`; roles: dns-answer\n- ipv4: `151.101.192.238`; roles: dns-answer\n- ipv4: `151.101.64.238`; roles: dns-answer, network-endpoint\n- ipv4: `161.119.42.22`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.1.200`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.2.10`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.2.3`; roles: dns-answer, network-endpoint\n- ipv4: `181.215.47.171`; roles: dns-answer, network-endpoint\n- ipv4: `185.246.116.239`; roles: dns-answer, network-endpoint\n- ipv4: `190.146.112.216`; roles: http-host, network-endpoint\n- ipv4: `195.123.246.99`; roles: network-endpoint\n- ipv4: `198.185.159.135`; roles: dns-answer, network-endpoint\n- ipv4: `198.185.159.136`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `209.141.55.226`; roles: http-host, network-endpoint\n- ipv4: `213.226.68.112`; roles: network-endpoint\n- ipv4: `216.239.32.21`; roles: dns-answer, network-endpoint\n- ipv4: `216.239.34.21`; roles: dns-answer\n- ipv4: `216.239.36.21`; roles: dns-answer\n- ipv4: `216.239.38.21`; roles: dns-answer\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.218.156.10`; roles: dns-answer\n- ipv4: `23.218.156.17`; roles: dns-answer, network-endpoint\n- ipv4: `23.223.195.33`; roles: dns-answer\n- ipv4: `23.223.195.42`; roles: dns-answer, network-endpoint\n- ipv4: `23.63.25.226`; roles: dns-answer, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `46.249.62.199`; roles: http-host, network-endpoint\n- ipv4: `67.26.187.254`; roles: dns-answer\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `72.21.81.240`; roles: dns-answer, network-endpoint\n- ipv4: `8.252.15.254`; roles: dns-answer\n- ipv4: `8.252.250.126`; roles: dns-answer\n- ipv4: `8.253.129.66`; roles: dns-answer, network-endpoint\n- ipv4: `8.253.203.254`; roles: dns-answer\n- ipv4: `85.143.218.7`; roles: http-host, network-endpoint\n- ipv4: `87.236.22.142`; roles: dns-answer, network-endpoint\n- ipv4: `92.223.105.176`; roles: network-endpoint\n- ipv4: `94.103.95.185`; roles: network-endpoint\n- ipv6: `fd3e:4f5a:5b81::1`; roles: dns-answer\n- ja3: `1d095e68489d3c535297cd8dffb06cb9`; roles: tls-client-fingerprint\n- ja3: `4d7a28d6f2263ed61de88ca66eb011e3`; roles: tls-client-fingerprint\n- ja3: `6734f37431670b3ab4292b8f60f29984`; roles: tls-client-fingerprint\n- sha256: `152f05b79c5f8ae61dce111c5415be105396ad820f3fc3cd537b0aaa2acd8d58`; roles: exported-object\n- sha256: `17ef1c0ff8515ab325b5976632264553118a2618e5e8dcf3ff058dee515ab738`; roles: exported-object\n- sha256: `1fee1ef37060734fe38728af41fad66a827abb34151a3658ceee6000d4df40b2`; roles: exported-object\n- sha256: `3362bbc3aeca0b9a3e74c27568033c566350d30214cfa383b470327ec2ac8c07`; roles: exported-object\n- sha256: `33c2fde7c0162c50e4450e874c99a13a086a56db266d8962bd7d31bdb08956f3`; roles: exported-object\n- sha256: `351e3c9dadd0128ea718633173e073a6f7a3d9bf6a1ce173bff2221cb3b0afae`; roles: exported-object\n- sha256: `360daaf74aa6a7e36952e66764a76de6b6a1a48bcbbad611288396ead6f733bb`; roles: exported-object\n- sha256: `38c6c5b8d6fa71d9856758a5c0c2ac9d0a0a1450f75bb1004dd988e23d73a312`; roles: exported-object\n- sha256: `3abae6dd2ddae23b2de2ccbcc160a4a5773bef8934d0e6896d50197c3d3c417f`; roles: exported-object\n- sha256: `3c4ec495f17d21cc236bc7238bc02728bd945c07157fbf875cac340269afc207`; roles: exported-object\n- sha256: `3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440`; roles: exported-object\n- sha256: `44373d4e4bea5c974656b41b630eae6519b62aeb4889277034ba7925c01bb60f`; roles: exported-object\n- sha256: `4c957072ab097d3474039f432466cd251d1dc7d91559b76d4e5ead4a8bd499d5`; roles: exported-object\n- sha256: `51cd2200fde479b2d57db744c846f9c83dbefe967e10efa510a0eecf644ac2ac`; roles: exported-object\n- sha256: `592e7fa07596b36f577e4a703c8614d98c6602b3fbafd6cf94026aadc109ee42`; roles: exported-object\n- sha256: `5aeb07f9980663c2501c9620371e11ae7aa6e320d94dd753d0ef56d8308c74b3`; roles: exported-object\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- sha256: `6281f4b88789d78a3520cea62298a5d76562a5ac5a265c915f58ab46e90773bf`; roles: exported-object\n- sha256: `63e2dc2b85defb87378e12ecd7d0f4631d37fcf42152acf2a28ae7453b40633c`; roles: exported-object\n- sha256: `640994b0bf9615de96e00f0344d84c56ff04eff2f47e99ebf0c9ea7fa6ba3502`; roles: exported-object\n- sha256: `6736e7a0746fbcfef21feae864dda1ae4e888d3ea1d5cea115c71849e47e787a`; roles: exported-object\n- sha256: `6b6bf68b59a71f79863bf3b342b6dba38c2dbb76814deea82250c513517ddb19`; roles: exported-object\n- sha256: `6bb03471d2a729fd037bb0f8b42854c3b9d14e87e7bc9b337ed2274a74a0a3c4`; roles: exported-object\n- sha256: `6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914`; roles: exported-object\n- sha256: `6ee67e7ec3881929e6d6f2bf4e761fb44d04b84b5e77f1df7ef3c05a698484ee`; roles: exported-object\n- sha256: `71a22598eedbbdedd0ba95f9fbf4a19726abf69681462f56cf535f4fd505a079`; roles: exported-object\n- sha256: `77ab5e18a4c52fe1b402ca8907ad3315c19e1fb7ed19aaa03f1fb3070cd286b1`; roles: exported-object\n- sha256: `7898a2dbfd52591cf085b2743c0f2eaa750143b77a8cfebfbbf23d692bc4d846`; roles: exported-object\n- sha256: `810151e2aa23d212c5105db84e9eb16a76bb589eacfd4bc5a287a092c2ef71fa`; roles: exported-object\n- sha256: `8cf2cddda8522975a22da3da429339be471234eacc0e11c099d6dcb732cf3cbb`; roles: exported-object\n- sha256: `9801c1c9ecc18a5361fbb2188614518c84837fd23cdcc5dafde214c7efc5ba61`; roles: exported-object\n- sha256: `9a9eef92488fae7c9199a57abe8fe52dfbabfd4884a150cde674f86304748c84`; roles: exported-object\n- sha256: `a7325536819e47e298d38720b60ecb4c6ca63ebf07df04e768ee95d92c854e17`; roles: exported-object\n- sha256: `aaa1afd7ae3a37dd93a8b19408e2770eaee666932366bf4e1703533148914076`; roles: exported-object\n- sha256: `adc225a50d7a314341a7c857f092b962e3967d4addb7d2b48ff335c7bedad350`; roles: exported-object\n- sha256: `b577d12d1f8eaacf060db96a7b2bcc0009d0c3fd8d4842bd85175a50b2a1f972`; roles: exported-object\n- sha256: `c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1`; roles: exported-object\n- sha256: `ce3a22f1ccba5bbeebb0a9fd49c3e72fbde9e1816959b67e5b1fb248c1e1041a`; roles: exported-object\n- sha256: `d43159c8bf2e1bd866abdbb1687911e2282b1f98a7c063f85ffd53a7f51efed4`; roles: exported-object\n- sha256: `d7b2de7a314f64ab62777494d3f9587dd679d637fd8e68783b68977bbb3df29e`; roles: exported-object\n- sha256: `d7c9595737524bc5febd4507cbe47457dbd59ce733315f1ada59a91c6754c193`; roles: exported-object\n- sha256: `d95a35fac8425ed6c010066a81b4330ade8dd325713e077d67fcfd33e7cafcac`; roles: exported-object\n- sha256: `de799971c904cfabc587484202b8d4bd4b40414ac6b23d1e51b16196bf100013`; roles: exported-object\n- sha256: `df5f5ce34c9cf3edd665586295e356d6b56d9ef3e54614001f4b178217ec92fe`; roles: exported-object\n- sha256: `e32d0b53c63fe1a6b0759ebc8824b97661d369004213853438faaa34134967e6`; roles: exported-object\n- sha256: `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`; roles: exported-object\n- sha256: `ec0a5627751851db7afed684f83dde6178c3e6b2114adc24a1294fb2bb1d40e8`; roles: exported-object\n- sha256: `ed001f8b45a9191508e79be37b5a0003faaf3bc356eb241fe11f2b56ab9f60ae`; roles: exported-object\n- sha256: `f0c4a8877fe0d8ed1f7350d20d476d37601fb6c6119eb986fce4d8ae2852061c`; roles: exported-object\n- sha256: `f1b789be1126b557240dd0dfe98fc5f3ad6341bb1a5d8be0a954f65b486ad32a`; roles: exported-object\n- sha256: `f7b0061ce2ceec8a73a0957dc975d2dde0f4de8c0b63c041cd78a29414d2645c`; roles: exported-object\n- sha256: `fbf3439d0eb209ab2bdf6794da01485836e5bb0910c4624ac2d43dead3ff10d9`; roles: exported-object\n- url: `http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/81/`; roles: http-request\n- url: `http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/83/`; roles: http-request\n- url: `http://190.146.112.216:8082/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/90`; roles: http-request\n- url: `http://209.141.55.226/troll1.jpg`; roles: http-request\n- url: `http://46.249.62.199/Sw9JKmXqaSj.exe`; roles: http-request\n- url: `http://46.249.62.199/Tinx86_14.exe`; roles: http-request\n- url: `http://85.143.218.7/sin.png`; roles: http-request\n- url: `http://85.143.218.7/tin.png`; roles: http-request\n- url: `http://85.143.218.7/win.png`; roles: http-request\n- url: `http://crl.microsoft.com/pki/crl/products/CSPCA.crl`; roles: http-request\n- url: `http://fonts.googleapis.com/css?family=Lato:100,400`; roles: http-request\n- url: `http://fonts.googleapis.com/css?family=Lato:300,400,400italic,600,700|Raleway:300,400,500,600,700|Crete+Round:400italic`; roles: http-request\n- url: `http://fonts.gstatic.com/s/lato/v14/S6u8w4BMUTPHh30AXC-s.woff`; roles: http-request\n- url: `http://fonts.gstatic.com/s/lato/v14/S6uyw4BMUTPHjx4wWA.woff`; roles: http-request\n- url: `http://ipecho.net/plain`; roles: http-request\n- url: `http://rootscafeslc.com/`; roles: http-request\n- url: `http://static.squarespace.com/universal/scripts-compressed/common-c2a92195cbc0a2d6aed1-min.en-US.js`; roles: http-request\n- url: `http://static1.squarespace.com/static/53176ac0e4b0cc8a54026440/t/53597593e4b0bb8f10e2db9a/1503949442424/?format=1500w`; roles: http-request\n- url: `http://static1.squarespace.com/static/sitecss/53176ac0e4b0cc8a54026440/47/507c1fdf84ae362b5e7be44e/53176ac0e4b0cc8a54026444/2141-05142015/1418412276795/site.css?&filterFeatures=false`; roles: http-request\n- url: `http://superhaps.pw/data2.php?C68FF38437D96CED`; roles: http-request\n- url: `http://use.typekit.net/ik/qtSfIe0hWL1wtEbIsJFPUsITCi0N4DUQd5Tzt0wJ8s6feGw2fFHN4UJLFRbh52jhWD9DwQShjAw3ZQsKweFR5eIuF2MkFRbXwgTuiaiaO14zdasDjhBcZWFCjkoRdhXCScNziYFRjAZ8ShUROcFzdPUCiAoTdkuqZWZ8deN3dAm0ifuE-QJUO1FUiABkZWF3jAF8OcFzdP37OcUudc8zOAs8icmCdaglZAoXOWTTwRI0SaBujW48Sagyjh90jhNlJ6U3ScNt-AuyOAozicIKgcBqZAUCZPG4fHCgIMMjMPMfH6qJtKGbMg62JMJ7fbKzMsMMeMb6MKG4fHXgIMMjgKMfH6qJK3IbMg6YJMJ7fbKTMsMMeM66MKG4f5w7IMMj2PMfH6qJKbIbMg64JMJ7fbK3MsMMeMt6MKG4fHtgIMMjIfMfH6qJRMIbMg6sJMJ7fbK7MsMMegJ6MKG4fJGgIMMjIkMfH6qJXR9bMs62JMJ7fbR5FsMgeMb6MKG4fFIVIMIjgkMfH6qJXD9bMs6FJMJ7fbRVFsMgeMt6MKG4fFJVIMIjIPMf.js`; roles: http-request\n- url: `http://www.bing.com/favicon.ico`; roles: http-request\n- url: `http://www.co.utah.ut.us/`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/animate.css`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/bootstrap.css`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/dark.css`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/font-icons.css`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/responsive.css`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/swiper.css`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/1A1.png`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/2A1.png`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/3A1.png`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/6A1.png`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/7ABurn1.png`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/StormWater1.png`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/map.png`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/performance.png`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tick.png`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tools.png`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/logo1.png`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/functions.js`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/jquery.js`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/plugins.js`; roles: http-request\n- url: `http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/style.css`; roles: http-request\n- url: `http://www.co.utah.ut.us/Dept/COMMISH/Data/WNData/default.jpg`; roles: http-request\n- url: `http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/IMG_1047.JPG`; roles: http-request\n- url: `http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/JerikaTimpCaveTrail1.JPG`; roles: http-request\n- url: `http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/Martin_Richard.jpg`; roles: http-request\n- url: `http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/OUR_Adobe_Jon_Lines_Award.jpg`; roles: http-request\n- url: `http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/TanyaandJenna.jpg`; roles: http-request\n- url: `http://www.co.utah.ut.us/Images1/custom/Opiate_ProvoTownHall.jpg`; roles: http-request\n- url: `http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- url: `http://www.rootscafeslc.com/`; roles: http-request\n- url: `http://www.rootscafeslc.com/api/census/RecordHit?crumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/6.1`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2228.0 Safari/537.36`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko`; roles: http-client\n- user_agent: `test`; roles: http-client\n- user_agent: `WinHTTP loader/1.0`; roles: http-client\n- exported object `Tinx86_14.exe`; SHA-256 `f1b789be1126b557240dd0dfe98fc5f3ad6341bb1a5d8be0a954f65b486ad32a`; size 2818560 bytes\n SHA-1: `a0bcf06358319c190dfe6a8d979e185020e5af04`; MD5: `2a5ae5050a02bf3477c21a609a0f7b80`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6249,\"response_frame\":11971,\"server_ip\":\"46.249.62.199\",\"status_code\":\"200\",\"tcp_stream\":110,\"url\":\"http://46.249.62.199/Tinx86_14.exe\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `common-c2a92195cbc0a2d6aed1-min.en-US.js`; SHA-256 `63e2dc2b85defb87378e12ecd7d0f4631d37fcf42152acf2a28ae7453b40633c`; size 1841388 bytes\n SHA-1: `4cf5574d9dec1d3684784f181782a7885656eeb2`; MD5: `47b497cae96da976cc40c4b428bdedfb`; completeness: unknown; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1433,\"response_frame\":2049,\"server_ip\":\"151.101.64.238\",\"status_code\":\"200\",\"tcp_stream\":82,\"url\":\"http://static.squarespace.com/universal/scripts-compressed/common-c2a92195cbc0a2d6aed1-min.en-US.js\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":85551}],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `win.png`; SHA-256 `38c6c5b8d6fa71d9856758a5c0c2ac9d0a0a1450f75bb1004dd988e23d73a312`; size 270336 bytes\n SHA-1: `5240075708299993915fe76197d33b0976755435`; MD5: `26a97b078e5c6bfaf5170a6520c786bf`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":10966,\"response_frame\":12777,\"server_ip\":\"85.143.218.7\",\"status_code\":\"200\",\"tcp_stream\":150,\"url\":\"http://85.143.218.7/win.png\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `sin.png`; SHA-256 `3abae6dd2ddae23b2de2ccbcc160a4a5773bef8934d0e6896d50197c3d3c417f`; size 270336 bytes\n SHA-1: `fb513aa01475b6a4847dad0fa0011502b43335ce`; MD5: `2684f88431df44a9e096890a8a552a67`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":20146,\"response_frame\":20903,\"server_ip\":\"85.143.218.7\",\"status_code\":\"200\",\"tcp_stream\":200,\"url\":\"http://85.143.218.7/sin.png\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `tin.png`; SHA-256 `4c957072ab097d3474039f432466cd251d1dc7d91559b76d4e5ead4a8bd499d5`; size 270336 bytes\n SHA-1: `e3591fc815429040edfc1627101aa6f65dbf97e3`; MD5: `0f7e98a8980410bfd81158598dff11b6`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11986,\"response_frame\":13356,\"server_ip\":\"85.143.218.7\",\"status_code\":\"200\",\"tcp_stream\":161,\"url\":\"http://85.143.218.7/tin.png\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `Sw9JKmXqaSj.exe`; SHA-256 `d43159c8bf2e1bd866abdbb1687911e2282b1f98a7c063f85ffd53a7f51efed4`; size 168448 bytes\n SHA-1: `cce0b8b2580ba4c49e5744ce96c324dcfbca9de6`; MD5: `901a99ca72a48f3a067886b158db217e`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6262,\"response_frame\":6800,\"server_ip\":\"46.249.62.199\",\"status_code\":\"200\",\"tcp_stream\":109,\"url\":\"http://46.249.62.199/Sw9JKmXqaSj.exe\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":168448,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":168448,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `troll1.jpg`; SHA-256 `8cf2cddda8522975a22da3da429339be471234eacc0e11c099d6dcb732cf3cbb`; size 122880 bytes\n SHA-1: `559a05242fd61714da79c5d95c67b8e9edfec616`; MD5: `c9d7cca380a983bae2170e159b0eef5d`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":3119,\"response_frame\":3542,\"server_ip\":\"209.141.55.226\",\"status_code\":\"200\",\"tcp_stream\":105,\"url\":\"http://209.141.55.226/troll1.jpg\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":122880,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":122880,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `site.css%3f&filterFeatures=false`; SHA-256 `810151e2aa23d212c5105db84e9eb16a76bb589eacfd4bc5a287a092c2ef71fa`; size 548880 bytes\n SHA-1: `feac0bc666be07a731407aa838df66b75922bc15`; MD5: `24711366cca603e1d0773741e08fbb1f`; completeness: unknown; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1309,\"response_frame\":1415,\"server_ip\":\"151.101.0.238\",\"status_code\":\"200\",\"tcp_stream\":76,\"url\":\"http://static1.squarespace.com/static/sitecss/53176ac0e4b0cc8a54026440/47/507c1fdf84ae362b5e7be44e/53176ac0e4b0cc8a54026444/2141-05142015/1418412276795/site.css?&filterFeatures=false\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `TanyaandJenna.jpg`; SHA-256 `351e3c9dadd0128ea718633173e073a6f7a3d9bf6a1ce173bff2221cb3b0afae`; size 227673 bytes\n SHA-1: `7c7bde6c0c1c9a536129f2130f516327cdf1689c`; MD5: `559ce2401715b9a3bcb160a42cd1200f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":25573,\"response_frame\":28116,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":223,\"url\":\"http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/TanyaandJenna.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":227673,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `bootstrap.css`; SHA-256 `d7c9595737524bc5febd4507cbe47457dbd59ce733315f1ada59a91c6754c193`; size 128190 bytes\n SHA-1: `c7cc509376d1172259b0771ef896fc0013ec16fb`; MD5: `2277ca2bdab250888d67856d2cc868fa`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":24734,\"response_frame\":26006,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":216,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/bootstrap.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":128190,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `functions.js`; SHA-256 `b577d12d1f8eaacf060db96a7b2bcc0009d0c3fd8d4842bd85175a50b2a1f972`; size 126945 bytes\n SHA-1: `a55b2e8c831f823dec22f94cf40f82deec6d04d9`; MD5: `5d2c226a9132d1108e759fe53d9e529f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":25149,\"response_frame\":27968,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":230,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/functions.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":126945,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `jquery.js`; SHA-256 `9801c1c9ecc18a5361fbb2188614518c84837fd23cdcc5dafde214c7efc5ba61`; size 95954 bytes\n SHA-1: `a75e1d1015f3ec7ea87e94926bb2f01a3421dcc4`; MD5: `cdce6651c76bcdd9ed88e4c28b076730`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":25868,\"response_frame\":26841,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":226,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/jquery.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":95954,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `3A1.png`; SHA-256 `3362bbc3aeca0b9a3e74c27568033c566350d30214cfa383b470327ec2ac8c07`; size 83761 bytes\n SHA-1: `6823e0d0fee938bb93c17f12fa43a1d444d72048`; MD5: `a5be1f0cbaca944ca0dae0cf82f51f54`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":26843,\"response_frame\":27683,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":226,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/3A1.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":83761,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `animate.css`; SHA-256 `ce3a22f1ccba5bbeebb0a9fd49c3e72fbde9e1816959b67e5b1fb248c1e1041a`; size 70788 bytes\n SHA-1: `259b933f29614010306121f3c56c7148bd5bdca7`; MD5: `5920b7fd7898a7845e4aeaf0238eccff`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":24828,\"response_frame\":25448,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":223,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/animate.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":70788,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%2f(2)`; SHA-256 `6736e7a0746fbcfef21feae864dda1ae4e888d3ea1d5cea115c71849e47e787a`; size 61931 bytes\n SHA-1: `da9282f47d6a4bf9651270587666ed14870cefb4`; MD5: `d0262c4a7b9aa062ad00f56782059358`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":24724,\"response_frame\":25048,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":215,\"url\":\"http://www.co.utah.ut.us/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":61931,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `1A1.png`; SHA-256 `adc225a50d7a314341a7c857f092b962e3967d4addb7d2b48ff335c7bedad350`; size 61552 bytes\n SHA-1: `2989a8fa647daaaf9e775bc9e0731818d24f563f`; MD5: `a26c5f9af9b83c4a718440d6d6163102`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":26237,\"response_frame\":27118,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":215,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/1A1.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":61552,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `authrootstl(1).cab`; SHA-256 `3c4ec495f17d21cc236bc7238bc02728bd945c07157fbf875cac340269afc207`; size 56560 bytes\n SHA-1: `295d5a7cb802a8058059f6c29dc2491a15a7d55c`; MD5: `bb377df27a55c05bb3793cd1e125c869`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6171,\"response_frame\":6230,\"server_ip\":\"8.253.129.66\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"},{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19578,\"response_frame\":20132,\"server_ip\":\"72.21.81.240\",\"status_code\":\"200\",\"tcp_stream\":195,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":56560,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `dark.css`; SHA-256 `51cd2200fde479b2d57db744c846f9c83dbefe967e10efa510a0eecf644ac2ac`; size 55948 bytes\n SHA-1: `87e6e5840e9f05c94dac0367a4f1e694c49c236f`; MD5: `b0e3a7d3bdb70656832bc7c22e67af41`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":25099,\"response_frame\":25411,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":219,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/dark.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":55948,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%3fformat=1500w`; SHA-256 `152f05b79c5f8ae61dce111c5415be105396ad820f3fc3cd537b0aaa2acd8d58`; size 47031 bytes\n SHA-1: `787c5fc4f3d2dc30abb50cb90fa08cd5ac8fdbbd`; MD5: `e5bf7b8920538bed0bdbe2812679908f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1219,\"response_frame\":1307,\"server_ip\":\"151.101.0.238\",\"status_code\":\"200\",\"tcp_stream\":76,\"url\":\"http://static1.squarespace.com/static/53176ac0e4b0cc8a54026440/t/53597593e4b0bb8f10e2db9a/1503949442424/?format=1500w\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":47031,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `responsive.css`; SHA-256 `f0c4a8877fe0d8ed1f7350d20d476d37601fb6c6119eb986fce4d8ae2852061c`; size 43468 bytes\n SHA-1: `d6b8c4c5e3ba1e53d81ba4bbb1df5cb6047cfb41`; MD5: `653a8449bd2e6e672d38e6eb87b81d74`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":24829,\"response_frame\":25568,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":224,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/responsive.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":43468,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `StormWater1.png`; SHA-256 `17ef1c0ff8515ab325b5976632264553118a2618e5e8dcf3ff058dee515ab738`; size 34595 bytes\n SHA-1: `34ad516ef6f5602be5d399fb4d5bb91ed82ae0a0`; MD5: `0fdaa78419da86faa734408deee4d12b`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":27072,\"response_frame\":27246,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":238,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/StormWater1.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":34595,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `7ABurn1.png`; SHA-256 `fbf3439d0eb209ab2bdf6794da01485836e5bb0910c4624ac2d43dead3ff10d9`; size 32241 bytes\n SHA-1: `dc572a54d4ce7cfb45fd9d0846257cec8d2be42d`; MD5: `96ab8de32fb8dd16d6feb09f7e09bcc2`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":26945,\"response_frame\":27070,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":238,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/7ABurn1.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":32241,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `S6uyw4BMUTPHjx4wWA.woff`; SHA-256 `5aeb07f9980663c2501c9620371e11ae7aa6e320d94dd753d0ef56d8308c74b3`; size 28412 bytes\n SHA-1: `82b144e3c8b4ff40aeca34ddf7bc35985311b90e`; MD5: `62fb51e9e645f63599238881b9de15dd`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2107,\"response_frame\":2779,\"server_ip\":\"172.217.2.3\",\"status_code\":\"200\",\"tcp_stream\":94,\"url\":\"http://fonts.gstatic.com/s/lato/v14/S6uyw4BMUTPHjx4wWA.woff\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":28412,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%2f(1)`; SHA-256 `6ee67e7ec3881929e6d6f2bf4e761fb44d04b84b5e77f1df7ef3c05a698484ee`; size 27975 bytes\n SHA-1: `0278dcd021f6cb4c1fc7e24e833ae258b0e0cd6c`; MD5: `d1de5e9e4bc27c76ad57191addf1ff42`; completeness: unknown; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1197,\"response_frame\":1210,\"server_ip\":\"198.185.159.135\",\"status_code\":\"200\",\"tcp_stream\":74,\"url\":\"http://www.rootscafeslc.com/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":27975,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `S6u8w4BMUTPHh30AXC-s.woff`; SHA-256 `6281f4b88789d78a3520cea62298a5d76562a5ac5a265c915f58ab46e90773bf`; size 26860 bytes\n SHA-1: `975f17fad3d9d4e0ead06edbaade619ecb1b7dc3`; MD5: `752c20224144760a496fb9e19a62f616`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2105,\"response_frame\":2511,\"server_ip\":\"172.217.2.3\",\"status_code\":\"200\",\"tcp_stream\":95,\"url\":\"http://fonts.gstatic.com/s/lato/v14/S6u8w4BMUTPHh30AXC-s.woff\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":26860,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `default.jpg`; SHA-256 `df5f5ce34c9cf3edd665586295e356d6b56d9ef3e54614001f4b178217ec92fe`; size 25595 bytes\n SHA-1: `478694a7e3f5defea644011eb9121a4acb3df742`; MD5: `0ae651d6e3052e89daa7bb4f92d687aa`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":25234,\"response_frame\":25503,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":229,\"url\":\"http://www.co.utah.ut.us/Dept/COMMISH/Data/WNData/default.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":25595,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `Opiate_ProvoTownHall.jpg`; SHA-256 `ed001f8b45a9191508e79be37b5a0003faaf3bc356eb241fe11f2b56ab9f60ae`; size 24715 bytes\n SHA-1: `c9fa542f5352d73599dee2f2ca2b72d205fa198f`; MD5: `758f83d51db495e1298817635f638ff7`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":25168,\"response_frame\":26101,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":215,\"url\":\"http://www.co.utah.ut.us/Images1/custom/Opiate_ProvoTownHall.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":24715,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `qtSfIe0hWL1wtEbIsJFPUsITCi0N4DUQd5Tzt0wJ8s6feGw2fFHN4UJLFRbh52jhWD9DwQShjAw3ZQsKweFR5eIuF2MkFRbXwgTuiaiaO14zdasDjhBcZWFCjkoRdhXCScNziYFRjAZ8ShUROcFzdPUCiAoTdkuqZWZ8deN3dAm0ifuE-QJUO1FUiABkZWF3jAF8OcFzdP37OcUudc8zOAs8icmCdaglZAoXOWTTwRI0SaBujW48Sagyjh90.js`; SHA-256 `640994b0bf9615de96e00f0344d84c56ff04eff2f47e99ebf0c9ea7fa6ba3502`; size 23159 bytes\n SHA-1: `e1094279be16e3c2f17bdd1fa950e346af985046`; MD5: `ceb79595334295200b49af81e3f36d5c`; completeness: unknown; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1526,\"response_frame\":1594,\"server_ip\":\"23.63.25.226\",\"status_code\":\"200\",\"tcp_stream\":83,\"url\":\"http://use.typekit.net/ik/qtSfIe0hWL1wtEbIsJFPUsITCi0N4DUQd5Tzt0wJ8s6feGw2fFHN4UJLFRbh52jhWD9DwQShjAw3ZQsKweFR5eIuF2MkFRbXwgTuiaiaO14zdasDjhBcZWFCjkoRdhXCScNziYFRjAZ8ShUROcFzdPUCiAoTdkuqZWZ8deN3dAm0ifuE-QJUO1FUiABkZWF3jAF8OcFzdP37OcUudc8zOAs8icmCdaglZAoXOWTTwRI0SaBujW48Sagyjh90jhNlJ6U3ScNt-AuyOAozicIKgcBqZAUCZPG4fHCgIMMjMPMfH6qJtKGbMg62JMJ7fbKzMsMMeMb6MKG4fHXgIMMjgKMfH6qJK3IbMg6YJMJ7fbKTMsMMeM66MKG4f5w7IMMj2PMfH6qJKbIbMg64JMJ7fbK3MsMMeMt6MKG4fHtgIMMjIfMfH6qJRMIbMg6sJMJ7fbK7MsMMegJ6MKG4fJGgIMMjIkMfH6qJXR9bMs62JMJ7fbR5FsMgeMb6MKG4fFIVIMIjgkMfH6qJXD9bMs6FJMJ7fbRVFsMgeMt6MKG4fFJVIMIjIPMf.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":23159,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `swiper.css`; SHA-256 `6b6bf68b59a71f79863bf3b342b6dba38c2dbb76814deea82250c513517ddb19`; size 17216 bytes\n SHA-1: `1d802f842351c7c2b53585641e4b288050845352`; MD5: `e24628d798d1b0043f10a0e423ec7ce7`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":25050,\"response_frame\":25166,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":215,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/swiper.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":17216,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `6A1.png`; SHA-256 `a7325536819e47e298d38720b60ecb4c6ca63ebf07df04e768ee95d92c854e17`; size 10536 bytes\n SHA-1: `f9ac0a7ef2220e94b994a26c54c5f9e38b02cdf7`; MD5: `c67b9d552989f8cc0bf6e87048d4e77b`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":26868,\"response_frame\":27155,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":216,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/6A1.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":10536,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `Martin_Richard.jpg`; SHA-256 `aaa1afd7ae3a37dd93a8b19408e2770eaee666932366bf4e1703533148914076`; size 10185 bytes\n SHA-1: `17c7f034b3802e13d5ef70dc165d415d74476282`; MD5: `6235bdeae96aebe0a24cd023e219bd94`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":25450,\"response_frame\":25567,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":223,\"url\":\"http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/Martin_Richard.jpg\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":10185,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `logo1.png`; SHA-256 `9a9eef92488fae7c9199a57abe8fe52dfbabfd4884a150cde674f86304748c84`; size 9666 bytes\n SHA-1: `0e5b6f9280d1d085d5818d908034d3224b90fe04`; MD5: `5cdb7dc28468443358a9f4bd4984d802`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":25144,\"response_frame\":25232,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":229,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/logo1.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":9666,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `2A1.png`; SHA-256 `7898a2dbfd52591cf085b2743c0f2eaa750143b77a8cfebfbbf23d692bc4d846`; size 9151 bytes\n SHA-1: `3a71f6e8b4f87f37a8c6fdd72559334114b163d6`; MD5: `0b26655a49b4a1b48b59b958b9f6ad86`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":26243,\"response_frame\":26865,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":216,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/2A1.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":9151,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `tick.png`; SHA-256 `6bb03471d2a729fd037bb0f8b42854c3b9d14e87e7bc9b337ed2274a74a0a3c4`; size 6046 bytes\n SHA-1: `c1bf669190f2489d92b7f73e856293cf30bc1a38`; MD5: `f7c253f9171b49b915a3fd26b36e1932`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":26008,\"response_frame\":26022,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":216,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tick.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":6046,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `tools.png`; SHA-256 `f7b0061ce2ceec8a73a0957dc975d2dde0f4de8c0b63c041cd78a29414d2645c`; size 5968 bytes\n SHA-1: `5403887efa37e08ffe552f57751aa06860529d67`; MD5: `fc4e9bde302a81d31ca4bcf63bd61bb0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":26024,\"response_frame\":26241,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":216,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tools.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5968,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `map.png`; SHA-256 `d7b2de7a314f64ab62777494d3f9587dd679d637fd8e68783b68977bbb3df29e`; size 5595 bytes\n SHA-1: `0ede7213844d4e442f3195c2704d75fe0a7ceb0d`; MD5: `cc01be156d2abc2c131202c8d2261875`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":26103,\"response_frame\":26145,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":215,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/map.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5595,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `performance.png`; SHA-256 `592e7fa07596b36f577e4a703c8614d98c6602b3fbafd6cf94026aadc109ee42`; size 4680 bytes\n SHA-1: `9819afebda4678f3436b99352aa2a467932f6dc1`; MD5: `af816a8b4ed546689ecda897feddf83c`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":26147,\"response_frame\":26235,\"server_ip\":\"161.119.42.22\",\"status_code\":\"200\",\"tcp_stream\":215,\"url\":\"http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/performance.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":4680,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `90(2)`; SHA-256 `77ab5e18a4c52fe1b402ca8907ad3315c19e1fb7ed19aaa03f1fb3070cd286b1`; size 4678 bytes\n SHA-1: `b2ad81cb89cfd9d08f46810bfd74093a53275bc1`; MD5: `52c98b79c29a261c44f7de8a51bf06e2`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `css%3ffamily=Lato%3a300,400,400italic,600,700%7cRaleway%3a300,400,500,600,700%7cCrete+Round%3a400italic`; SHA-256 `33c2fde7c0162c50e4450e874c99a13a086a56db266d8962bd7d31bdb08956f3`; size 2251 bytes\n SHA-1: `598ae9c508cbe813cd8c8c3c6082af755259b3ff`; MD5: `e7081205434e0e55a3a6d5d4ca0c80ec`; completeness: unknown; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":25114,\"response_frame\":25159,\"server_ip\":\"172.217.2.10\",\"status_code\":\"200\",\"tcp_stream\":227,\"url\":\"http://fonts.googleapis.com/css?family=Lato:300,400,400italic,600,700|Raleway:300,400,500,600,700|Crete+Round:400italic\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2251,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `90`; SHA-256 `de799971c904cfabc587484202b8d4bd4b40414ac6b23d1e51b16196bf100013`; size 2105 bytes\n SHA-1: `874092de659f67b921ac8305804c56311348d345`; MD5: `adafbd81515975893dc9272306051f5b`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `RecordHit%3fcrumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi`; SHA-256 `44373d4e4bea5c974656b41b630eae6519b62aeb4889277034ba7925c01bb60f`; size 882 bytes\n SHA-1: `b78a4a82d53f03792e15ccf95217a53adeffe5d4`; MD5: `9abd2b10f679c8b6a78b5e9762cdc59e`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `CSPCA.crl`; SHA-256 `3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440`; size 506 bytes\n SHA-1: `cfa529c048ec394a1203853c0c9a5e28ea23f035`; MD5: `a26dcbb948da05ec8af97885dbd149b0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":16113,\"response_frame\":16115,\"server_ip\":\"23.218.156.17\",\"status_code\":\"200\",\"tcp_stream\":184,\"url\":\"http://crl.microsoft.com/pki/crl/products/CSPCA.crl\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":506,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `css%3ffamily=Lato%3a100,400`; SHA-256 `ec0a5627751851db7afed684f83dde6178c3e6b2114adc24a1294fb2bb1d40e8`; size 432 bytes\n SHA-1: `cde0300123f31937ded5094a5bc29b76d8020dab`; MD5: `56e61e2686f39b64c6f64c1ff49bb05e`; completeness: unknown; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1438,\"response_frame\":1522,\"server_ip\":\"172.217.2.10\",\"status_code\":\"200\",\"tcp_stream\":81,\"url\":\"http://fonts.googleapis.com/css?family=Lato:100,400\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":432,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `83`; SHA-256 `360daaf74aa6a7e36952e66764a76de6b6a1a48bcbbad611288396ead6f733bb`; size 286 bytes\n SHA-1: `fa51cc50a4c9c9049c3d7c81bd5f3038458ba6df`; MD5: `c847dd9f5b5965908b03dcda969f5a2d`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `81`; SHA-256 `d95a35fac8425ed6c010066a81b4330ade8dd325713e077d67fcfd33e7cafcac`; size 262 bytes\n SHA-1: `3e4b1fff85e901579e71eec87ac68c7eb65a1511`; MD5: `1fd76ac7b29dac99ead87a24172b2c77`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `favicon(1).ico`; SHA-256 `6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914`; size 237 bytes\n SHA-1: `ea13848d33c2c7f4f4baa39348aeb1dbfad3df31`; MD5: `9fb559a691078558e77d6848202f6541`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1357,\"response_frame\":1368,\"server_ip\":\"204.79.197.200\",\"status_code\":\"200\",\"tcp_stream\":79,\"url\":\"http://www.bing.com/favicon.ico\"},{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":25256,\"response_frame\":25264,\"server_ip\":\"204.79.197.200\",\"status_code\":\"200\",\"tcp_stream\":232,\"url\":\"http://www.bing.com/favicon.ico\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":237,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `RecordHit%3fcrumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi(1)`; SHA-256 `71a22598eedbbdedd0ba95f9fbf4a19726abf69681462f56cf535f4fd505a079`; size 151 bytes\n SHA-1: `d81b9f92b3549dbea212a34c53493ca7f29619ec`; MD5: `b4c01e5f9c3ad32308d402dbe06d1c01`; completeness: unknown; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2099,\"response_frame\":3452,\"server_ip\":\"198.185.159.135\",\"status_code\":\"200\",\"tcp_stream\":75,\"url\":\"http://www.rootscafeslc.com/api/census/RecordHit?crumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":151,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `RecordHit%3fcrumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi(3)`; SHA-256 `e32d0b53c63fe1a6b0759ebc8824b97661d369004213853438faaa34134967e6`; size 151 bytes\n SHA-1: `cb13b5f378ee7d6ae23876632a32a0c1bb89fa42`; MD5: `c564ac1adf0ae564136c8ac8484db675`; completeness: unknown; transfers: `[{\"client_ip\":\"10.2.23.109\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":3456,\"response_frame\":3468,\"server_ip\":\"198.185.159.135\",\"status_code\":\"200\",\"tcp_stream\":75,\"url\":\"http://www.rootscafeslc.com/api/census/RecordHit?crumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":151,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `plain`; SHA-256 `1fee1ef37060734fe38728af41fad66a827abb34151a3658ceee6000d4df40b2`; size 46 bytes\n SHA-1: `bf77169078a14962e9044b549ab1d5c2308152c6`; MD5: `e3e992b7ef6a4b7c1090ff73ec80a12a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19795,\"response_frame\":19797,\"server_ip\":\"216.239.32.21\",\"status_code\":\"302\",\"tcp_stream\":196,\"url\":\"http://ipecho.net/plain\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":46,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ncsi(1).txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n SHA-1: `33bf88d5b82df3723d5863c7d23445e345828904`; MD5: `cd5a4d3fdd5bffc16bf959ef75cf37bc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":312,\"response_frame\":314,\"server_ip\":\"23.223.195.42\",\"status_code\":\"200\",\"tcp_stream\":19,\"url\":\"http://www.msftncsi.com/ncsi.txt\"},{\"client_ip\":\"10.2.23.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":752,\"response_frame\":796,\"server_ip\":\"23.223.195.42\",\"status_code\":\"200\",\"tcp_stream\":45,\"url\":\"http://www.msftncsi.com/ncsi.txt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `81(1)`; SHA-256 `c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1`; size 3 bytes\n SHA-1: `ff0288c119791fc13a51965eb3a0e61be2c06338`; MD5: `fa06d89c65fb808240e37f4c9e128955`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":23794,\"response_frame\":23796,\"server_ip\":\"190.146.112.216\",\"status_code\":\"200\",\"tcp_stream\":207,\"url\":\"http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/83/\"},{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":23816,\"response_frame\":23819,\"server_ip\":\"190.146.112.216\",\"status_code\":\"200\",\"tcp_stream\":208,\"url\":\"http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/81/\"},{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":24666,\"response_frame\":24670,\"server_ip\":\"190.146.112.216\",\"status_code\":\"200\",\"tcp_stream\":212,\"url\":\"http://190.146.112.216:8082/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/90\"},{\"client_ip\":\"10.2.23.231\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":26591,\"response_frame\":26802,\"server_ip\":\"190.146.112.216\",\"status_code\":\"200\",\"tcp_stream\":237,\"url\":\"http://190.146.112.216:8082/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/90\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%2f`; SHA-256 `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`; size 0 bytes\n SHA-1: `da39a3ee5e6b4b0d3255bfef95601890afd80709`; MD5: `d41d8cd98f00b204e9800998ecf8427e`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `71b77b215ad5adbe60aff4160d3fdb0cb8fbddbd0f64bb14739dc464fb1ebe35`; recorded 2026-09-22T16:08:44.803184+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":207,\"observable_limit\":5000,\"observables_checked\":207,\"observables_total\":207,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `bd9602ed-341a-4123-aae3-9fafa5731518` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `0bb7a995-231c-4046-95ec-acea419eb7b4` shares 16 observations. This does not establish a common campaign.\n- Prior analysis `d4027bcf-0ef6-4e3c-a68a-68dfe35adb33` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `8879e360-655c-4073-beb9-68018699a4d4` shares 22 observations. This does not establish a common campaign.\n- Prior analysis `961bdc9a-7460-440f-a246-f55748149bcc` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `1c2e6d58-c62a-4009-939b-3aa82de281a2` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `76f521c2-4e4a-41d5-95ad-a44fd9887dd8` shares 19 observations. This does not establish a common campaign.\n- Prior analysis `fa0da8be-03fb-404d-a526-6c99c6b4f000` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `05851801-c224-489b-b9da-9e5d035c60b4` shares 17 observations. This does not establish a common campaign.\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 21 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 17 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `31f265dc-3055-4628-8df4-136d4058e842` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `8174eaa7-e189-467f-b05e-fb7397bfcf16` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `e37603cf-d241-45ee-95ec-bcf92a063147` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `7c54479c-cce3-4570-80c9-69d03571a645` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `21da2cda-3a07-4c03-b352-af8740c84bc0` shares 4 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":52,\"export_status\":\"completed\",\"exported_objects\":59,\"hashed_bytes\":7743266,\"hashed_objects\":59,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":52,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":52}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 16/16, identities 8/8, observables 207/207, artifacts 52/52. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n195 typed observations; 6 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `0919fcacb5737cd492749816126b2a15db764aa09bb07d11915882c72bf90ae1`.\n\n- ipv4 `190.146.112.216` — suspicious; evidence: `[{\"finding_id\":\"finding-1ba21054ed92beb68817dd71\",\"frame_number\":23816,\"kind\":\"behavior\",\"rule_id\":\"sensitive-data-in-cleartext\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not-applicable\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:15.002056+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not-applicable\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:14.827573+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:14.825386+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- sha256 `38c6c5b8d6fa71d9856758a5c0c2ac9d0a0a1450f75bb1004dd988e23d73a312` — suspicious; evidence: `[{\"artifact_id\":\"artifact-a44db5d69b9bc8f3fdaaff4e\",\"features\":[\"pe-bytes-under-non-executable-url-extension\"],\"frames\":[12777],\"interpretation\":\"A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict.\",\"kind\":\"static-review\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:15.215066+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:15.007191+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:15.004527+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- sha256 `3abae6dd2ddae23b2de2ccbcc160a4a5773bef8934d0e6896d50197c3d3c417f` — suspicious; evidence: `[{\"artifact_id\":\"artifact-64c04b868e21280de7169f44\",\"features\":[\"pe-bytes-under-non-executable-url-extension\"],\"frames\":[20903],\"interpretation\":\"A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict.\",\"kind\":\"static-review\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:15.787778+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:15.585895+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:15.582091+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- sha256 `4c957072ab097d3474039f432466cd251d1dc7d91559b76d4e5ead4a8bd499d5` — suspicious; evidence: `[{\"artifact_id\":\"artifact-c300c6cc1195496e5d11e6e0\",\"features\":[\"pe-bytes-under-non-executable-url-extension\"],\"frames\":[13356],\"interpretation\":\"A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict.\",\"kind\":\"static-review\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:16.230788+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:16.006256+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:16.001945+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- sha256 `8cf2cddda8522975a22da3da429339be471234eacc0e11c099d6dcb732cf3cbb` — suspicious; evidence: `[{\"artifact_id\":\"artifact-162a2189c16314dce4cad0b7\",\"features\":[\"pe-bytes-under-non-executable-url-extension\"],\"frames\":[3542],\"interpretation\":\"A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict.\",\"kind\":\"static-review\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:17.242801+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:17.031444+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:17.029641+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- url `http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/81/` — suspicious; evidence: `[{\"finding_id\":\"finding-1ba21054ed92beb68817dd71\",\"frame_number\":23816,\"kind\":\"behavior\",\"rule_id\":\"sensitive-data-in-cleartext\"}]`; provider signals: `[]`\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `0483ac6b73b8be5445b0c28bde259a6a0d09449f37e5eb36b0f4bdc7db7c5d94`; updated 2026-09-22T17:47:25.257060+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-6f6acdb0395da1c4f28c9d34\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-6f6acdb0395da1c4f28c9d34\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-b5b72c3e2dc64df2121cb66d\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-b5b72c3e2dc64df2121cb66d\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-f9b8591529ee2e2b16c6d3f0\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-f9b8591529ee2e2b16c6d3f0\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":3,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":3,\"retained_targets\":53,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 4264, "stream": 0, "flow_id": "flow-ea03f3d4e603d8f247cac056", "packets": 44, "transport": "udp", "last_frame": 27101, "first_frame": 1, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 4264, "last_seen_epoch": "1550951450.201112", "responder_bytes": 0, "first_seen_epoch": "1550949876.172365" }, { "bytes": 75, "stream": 1, "flow_id": "flow-450921a7f2f74a7fa91127f9", "packets": 1, "transport": "udp", "last_frame": 2, "first_frame": 2, "initiator_ip": "10.2.23.231", "responder_ip": "224.0.0.252", "initiator_port": 61510, "responder_port": 5355, "initiator_bytes": 75, "last_seen_epoch": "1550949876.21756", "responder_bytes": 0, "first_seen_epoch": "1550949876.21756" }, { "bytes": 261, "stream": 2, "flow_id": "flow-76346ff33b8486fde2cdf1b9", "packets": 2, "transport": "udp", "last_frame": 5, "first_frame": 4, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 54067, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1550949876.446376", "responder_bytes": 164, "first_seen_epoch": "1550949876.446053" }, { "bytes": 198, "stream": 3, "flow_id": "flow-df0e532f7131555c158e564f", "packets": 2, "transport": "udp", "last_frame": 7, "first_frame": 6, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 59311, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1550949876.448229", "responder_bytes": 107, "first_seen_epoch": "1550949876.448007" }, { "bytes": 453, "stream": 4, "flow_id": "flow-0368ac91a8519212a75352ee", "packets": 2, "transport": "udp", "last_frame": 9, "first_frame": 8, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 59313, "responder_port": 389, "initiator_bytes": 216, "last_seen_epoch": "1550949876.450946", "responder_bytes": 237, "first_seen_epoch": "1550949876.450602" }, { "bytes": 303, "stream": 5, "flow_id": "flow-cc3b23795128ee39dcdc52cb", "packets": 2, "transport": "udp", "last_frame": 11, "first_frame": 10, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 52802, "responder_port": 53, "initiator_bytes": 118, "last_seen_epoch": "1550949876.550993", "responder_bytes": 185, "first_seen_epoch": "1550949876.550153" }, { "bytes": 453, "stream": 6, "flow_id": "flow-185eee245ed8994f3da27214", "packets": 2, "transport": "udp", "last_frame": 13, "first_frame": 12, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 52803, "responder_port": 389, "initiator_bytes": 216, "last_seen_epoch": "1550949876.552638", "responder_bytes": 237, "first_seen_epoch": "1550949876.55235" }, { "bytes": 5592, "stream": 0, "flow_id": "flow-4dce43f72ca550307ec3a136", "packets": 15, "transport": "tcp", "last_frame": 58, "first_frame": 14, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49157, "responder_port": 389, "initiator_bytes": 2624, "last_seen_epoch": "1550949876.704867", "responder_bytes": 2968, "first_seen_epoch": "1550949876.657383" }, { "bytes": 1008, "stream": 1, "flow_id": "flow-0bff1132064d041a8624e78f", "packets": 8, "transport": "tcp", "last_frame": 28, "first_frame": 21, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49158, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1550949876.665459", "responder_bytes": 532, "first_seen_epoch": "1550949876.662377" }, { "bytes": 2535, "stream": 2, "flow_id": "flow-0d82edd7fb04a9dc3b3d819d", "packets": 10, "transport": "tcp", "last_frame": 38, "first_frame": 29, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49159, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1550949876.685653", "responder_bytes": 1925, "first_seen_epoch": "1550949876.683203" }, { "bytes": 4006, "stream": 3, "flow_id": "flow-f9a6f262c837ebb2546d57cb", "packets": 12, "transport": "tcp", "last_frame": 50, "first_frame": 39, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49160, "responder_port": 88, "initiator_bytes": 2014, "last_seen_epoch": "1550949876.701646", "responder_bytes": 1992, "first_seen_epoch": "1550949876.697342" }, { "bytes": 1878, "stream": 4, "flow_id": "flow-19a3a92ffd0627c023640da8", "packets": 15, "transport": "tcp", "last_frame": 393, "first_frame": 59, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49161, "responder_port": 135, "initiator_bytes": 994, "last_seen_epoch": "1550949913.005725", "responder_bytes": 884, "first_seen_epoch": "1550949876.833806" }, { "bytes": 6287, "stream": 5, "flow_id": "flow-7890a1aeac75890cd510e1a6", "packets": 22, "transport": "tcp", "last_frame": 390, "first_frame": 66, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49162, "responder_port": 49158, "initiator_bytes": 3287, "last_seen_epoch": "1550949913.005382", "responder_bytes": 3000, "first_seen_epoch": "1550949876.837507" }, { "bytes": 5735, "stream": 6, "flow_id": "flow-88fb381ea0e73e7b937f1e0c", "packets": 22, "transport": "tcp", "last_frame": 391, "first_frame": 90, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49163, "responder_port": 49155, "initiator_bytes": 3706, "last_seen_epoch": "1550949913.005467", "responder_bytes": 2029, "first_seen_epoch": "1550949877.405571" }, { "bytes": 953, "stream": 7, "flow_id": "flow-88a9674ce96f0039532db39e", "packets": 8, "transport": "tcp", "last_frame": 100, "first_frame": 93, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49164, "responder_port": 88, "initiator_bytes": 473, "last_seen_epoch": "1550949877.407839", "responder_bytes": 480, "first_seen_epoch": "1550949877.406441" }, { "bytes": 2511, "stream": 8, "flow_id": "flow-da83020e2786964a55f76bd9", "packets": 10, "transport": "tcp", "last_frame": 110, "first_frame": 101, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49165, "responder_port": 88, "initiator_bytes": 607, "last_seen_epoch": "1550949877.420172", "responder_bytes": 1904, "first_seen_epoch": "1550949877.417723" }, { "bytes": 4010, "stream": 9, "flow_id": "flow-c4469db05cb418d0c692cdef", "packets": 12, "transport": "tcp", "last_frame": 122, "first_frame": 111, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49166, "responder_port": 88, "initiator_bytes": 2016, "last_seen_epoch": "1550949877.426722", "responder_bytes": 1994, "first_seen_epoch": "1550949877.420397" }, { "bytes": 344, "stream": 7, "flow_id": "flow-fde399164c555fa180bc02a1", "packets": 2, "transport": "udp", "last_frame": 138, "first_frame": 137, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 50926, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1550949877.467782", "responder_bytes": 211, "first_seen_epoch": "1550949877.46748" }, { "bytes": 282, "stream": 8, "flow_id": "flow-1ba4b844d38a754837a6e63c", "packets": 2, "transport": "udp", "last_frame": 140, "first_frame": 139, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49964, "responder_port": 53, "initiator_bytes": 102, "last_seen_epoch": "1550949877.468436", "responder_bytes": 180, "first_seen_epoch": "1550949877.468259" }, { "bytes": 8135, "stream": 10, "flow_id": "flow-83cee4cebe325845c706bd0b", "packets": 18, "transport": "tcp", "last_frame": 283, "first_frame": 141, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49167, "responder_port": 389, "initiator_bytes": 3379, "last_seen_epoch": "1550949878.111965", "responder_bytes": 4756, "first_seen_epoch": "1550949877.469276" }, { "bytes": 3976, "stream": 11, "flow_id": "flow-2fb098aed9f2dc7f8d8db455", "packets": 12, "transport": "tcp", "last_frame": 159, "first_frame": 148, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49168, "responder_port": 88, "initiator_bytes": 1998, "last_seen_epoch": "1550949877.473781", "responder_bytes": 1978, "first_seen_epoch": "1550949877.472174" }, { "bytes": 3540, "stream": 12, "flow_id": "flow-b38370dbe51037cad53ee1c3", "packets": 15, "transport": "tcp", "last_frame": 266, "first_frame": 166, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49169, "responder_port": 389, "initiator_bytes": 2630, "last_seen_epoch": "1550949877.580736", "responder_bytes": 910, "first_seen_epoch": "1550949877.480816" }, { "bytes": 168, "stream": 9, "flow_id": "flow-7f7eb1a7f513d1fb95471d35", "packets": 2, "transport": "udp", "last_frame": 180, "first_frame": 179, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 65360, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550949877.534662", "responder_bytes": 92, "first_seen_epoch": "1550949877.534398" }, { "bytes": 4338, "stream": 13, "flow_id": "flow-19dc5bc35010ac512ce6914b", "packets": 21, "transport": "tcp", "last_frame": 369, "first_frame": 181, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49170, "responder_port": 445, "initiator_bytes": 2264, "last_seen_epoch": "1550949889.523499", "responder_bytes": 2074, "first_seen_epoch": "1550949877.539174" }, { "bytes": 8830, "stream": 14, "flow_id": "flow-3af66f5450ad2158309a5e44", "packets": 49, "transport": "tcp", "last_frame": 19599, "first_frame": 186, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49171, "responder_port": 445, "initiator_bytes": 6232, "last_seen_epoch": "1550950927.694227", "responder_bytes": 2598, "first_seen_epoch": "1550949877.540161" }, { "bytes": 2317, "stream": 15, "flow_id": "flow-c4cde2f89abfb68801e9547f", "packets": 10, "transport": "tcp", "last_frame": 206, "first_frame": 195, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49172, "responder_port": 88, "initiator_bytes": 1929, "last_seen_epoch": "1550949877.542934", "responder_bytes": 388, "first_seen_epoch": "1550949877.541819" }, { "bytes": 3976, "stream": 16, "flow_id": "flow-e9b6095c8db30b7a117a6d40", "packets": 12, "transport": "tcp", "last_frame": 216, "first_frame": 202, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49173, "responder_port": 88, "initiator_bytes": 1998, "last_seen_epoch": "1550949877.545272", "responder_bytes": 1978, "first_seen_epoch": "1550949877.542637" }, { "bytes": 3675, "stream": 17, "flow_id": "flow-5e32edf4ac312ce2224d5252", "packets": 12, "transport": "tcp", "last_frame": 228, "first_frame": 217, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49174, "responder_port": 88, "initiator_bytes": 1831, "last_seen_epoch": "1550949877.547188", "responder_bytes": 1844, "first_seen_epoch": "1550949877.545411" }, { "bytes": 7447, "stream": 18, "flow_id": "flow-5d69fa5270794c1f0fdf0c79", "packets": 26, "transport": "tcp", "last_frame": 374, "first_frame": 245, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49175, "responder_port": 445, "initiator_bytes": 5283, "last_seen_epoch": "1550949889.524403", "responder_bytes": 2164, "first_seen_epoch": "1550949877.568428" }, { "bytes": 150, "stream": 10, "flow_id": "flow-cadab181b10afe5ec2cc0f5e", "packets": 2, "transport": "udp", "last_frame": 299, "first_frame": 291, "initiator_ip": "10.2.23.231", "responder_ip": "224.0.0.252", "initiator_port": 54725, "responder_port": 5355, "initiator_bytes": 150, "last_seen_epoch": "1550949879.572632", "responder_bytes": 0, "first_seen_epoch": "1550949879.476358" }, { "bytes": 1368, "stream": 11, "flow_id": "flow-51f98e59d63795e99d189546", "packets": 4, "transport": "udp", "last_frame": 24655, "first_frame": 292, "initiator_ip": "10.2.23.231", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 1368, "last_seen_epoch": "1550951414.909026", "responder_bytes": 0, "first_seen_epoch": "1550949879.493176" }, { "bytes": 1368, "stream": 12, "flow_id": "flow-e84e14de4c20f5d06ece4311", "packets": 4, "transport": "udp", "last_frame": 24656, "first_frame": 293, "initiator_ip": "10.2.23.254", "responder_ip": "10.2.23.231", "initiator_port": 67, "responder_port": 68, "initiator_bytes": 1368, "last_seen_epoch": "1550951414.909275", "responder_bytes": 0, "first_seen_epoch": "1550949879.493272" }, { "bytes": 240, "stream": 13, "flow_id": "flow-0914c0436287e3f0af5ae4ef", "packets": 2, "transport": "udp", "last_frame": 295, "first_frame": 294, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 64510, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1550949879.499844", "responder_bytes": 159, "first_seen_epoch": "1550949879.499617" }, { "bytes": 152, "stream": 14, "flow_id": "flow-6d24c9b358d86141aec236c2", "packets": 2, "transport": "udp", "last_frame": 297, "first_frame": 296, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 60408, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550949879.553934", "responder_bytes": 76, "first_seen_epoch": "1550949879.500798" }, { "bytes": 128, "stream": 15, "flow_id": "flow-6da9636f1ff04c2f037c4eab", "packets": 2, "transport": "udp", "last_frame": 302, "first_frame": 298, "initiator_ip": "10.2.23.231", "responder_ip": "224.0.0.252", "initiator_port": 64806, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1550949879.650857", "responder_bytes": 0, "first_seen_epoch": "1550949879.554859" }, { "bytes": 231, "stream": 16, "flow_id": "flow-b85eda42b1866861c9a4776b", "packets": 2, "transport": "udp", "last_frame": 301, "first_frame": 300, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 59128, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1550949879.597678", "responder_bytes": 153, "first_seen_epoch": "1550949879.597368" }, { "bytes": 258, "stream": 17, "flow_id": "flow-4dc52f334b0bc8771dee6b5b", "packets": 2, "transport": "udp", "last_frame": 308, "first_frame": 307, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 64019, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550949882.246164", "responder_bytes": 182, "first_seen_epoch": "1550949882.14071" }, { "bytes": 832, "stream": 19, "flow_id": "flow-ae6eebe01d4ac4488a49a16e", "packets": 10, "transport": "tcp", "last_frame": 318, "first_frame": 309, "initiator_ip": "10.2.23.231", "responder_ip": "23.223.195.42", "initiator_port": 49176, "responder_port": 80, "initiator_bytes": 379, "last_seen_epoch": "1550949883.135446", "responder_bytes": 453, "first_seen_epoch": "1550949882.410439" }, { "bytes": 262, "stream": 18, "flow_id": "flow-19fd7855d49225765cd49029", "packets": 2, "transport": "udp", "last_frame": 320, "first_frame": 319, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 61003, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1550949884.482553", "responder_bytes": 170, "first_seen_epoch": "1550949884.482276" }, { "bytes": 320, "stream": 19, "flow_id": "flow-5438195da225b725fd1317a2", "packets": 2, "transport": "udp", "last_frame": 322, "first_frame": 321, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 63154, "responder_port": 53, "initiator_bytes": 160, "last_seen_epoch": "1550949884.485879", "responder_bytes": 160, "first_seen_epoch": "1550949884.483779" }, { "bytes": 198, "stream": 20, "flow_id": "flow-7530120d2d89924f61a59c5d", "packets": 2, "transport": "udp", "last_frame": 324, "first_frame": 323, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 53808, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1550949889.106593", "responder_bytes": 107, "first_seen_epoch": "1550949889.106247" }, { "bytes": 5867, "stream": 20, "flow_id": "flow-0ec501f2964653511cf6a945", "packets": 20, "transport": "tcp", "last_frame": 381, "first_frame": 325, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49177, "responder_port": 445, "initiator_bytes": 4461, "last_seen_epoch": "1550949901.522819", "responder_bytes": 1406, "first_seen_epoch": "1550949889.110197" }, { "bytes": 3972, "stream": 21, "flow_id": "flow-765d03ba9746943d3bc2b787", "packets": 12, "transport": "tcp", "last_frame": 341, "first_frame": 330, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49178, "responder_port": 88, "initiator_bytes": 1996, "last_seen_epoch": "1550949889.114787", "responder_bytes": 1976, "first_seen_epoch": "1550949889.11178" }, { "bytes": 3671, "stream": 22, "flow_id": "flow-d7c970ad238cad2a097454f3", "packets": 12, "transport": "tcp", "last_frame": 353, "first_frame": 342, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49179, "responder_port": 88, "initiator_bytes": 1829, "last_seen_epoch": "1550949889.115666", "responder_bytes": 1842, "first_seen_epoch": "1550949889.114849" }, { "bytes": 146, "stream": 21, "flow_id": "flow-97220eb946be0f16438a6a74", "packets": 2, "transport": "udp", "last_frame": 403, "first_frame": 397, "initiator_ip": "10.2.23.109", "responder_ip": "224.0.0.252", "initiator_port": 57753, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1550949914.425379", "responder_bytes": 0, "first_seen_epoch": "1550949914.331138" }, { "bytes": 231, "stream": 22, "flow_id": "flow-642cd4a92ea4e9b0072fd3f1", "packets": 2, "transport": "udp", "last_frame": 399, "first_frame": 398, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 62653, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1550949914.332445", "responder_bytes": 153, "first_seen_epoch": "1550949914.332048" }, { "bytes": 9630, "stream": 23, "flow_id": "flow-5bc6f5a3ff0d70089d8c735f", "packets": 90, "transport": "udp", "last_frame": 28870, "first_frame": 400, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.1", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 9630, "last_seen_epoch": "1550952557.594209", "responder_bytes": 0, "first_seen_epoch": "1550949914.394571" }, { "bytes": 261, "stream": 24, "flow_id": "flow-f4c88e943b2122de0bcf9892", "packets": 2, "transport": "udp", "last_frame": 406, "first_frame": 405, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 59698, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1550949914.606513", "responder_bytes": 164, "first_seen_epoch": "1550949914.606011" }, { "bytes": 198, "stream": 25, "flow_id": "flow-f317c15f579eeba5c44a1035", "packets": 2, "transport": "udp", "last_frame": 408, "first_frame": 407, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 57856, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1550949914.609075", "responder_bytes": 107, "first_seen_epoch": "1550949914.608879" }, { "bytes": 451, "stream": 26, "flow_id": "flow-c0bd3880d93909b40e67d483", "packets": 2, "transport": "udp", "last_frame": 410, "first_frame": 409, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 57858, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1550949914.612442", "responder_bytes": 237, "first_seen_epoch": "1550949914.612139" }, { "bytes": 303, "stream": 27, "flow_id": "flow-d3008b6f24d4660c12a19e5b", "packets": 2, "transport": "udp", "last_frame": 412, "first_frame": 411, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 63409, "responder_port": 53, "initiator_bytes": 118, "last_seen_epoch": "1550949914.710748", "responder_bytes": 185, "first_seen_epoch": "1550949914.710463" }, { "bytes": 451, "stream": 28, "flow_id": "flow-dbfc288e3c3517f93b4174c9", "packets": 2, "transport": "udp", "last_frame": 414, "first_frame": 413, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 63410, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1550949914.71151", "responder_bytes": 237, "first_seen_epoch": "1550949914.711277" }, { "bytes": 5464, "stream": 23, "flow_id": "flow-862a6402a8094937a3241673", "packets": 13, "transport": "tcp", "last_frame": 457, "first_frame": 415, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49157, "responder_port": 389, "initiator_bytes": 2550, "last_seen_epoch": "1550949914.850569", "responder_bytes": 2914, "first_seen_epoch": "1550949914.818047" }, { "bytes": 1002, "stream": 24, "flow_id": "flow-cbcc5432ca5e6b8352dfc06c", "packets": 8, "transport": "tcp", "last_frame": 429, "first_frame": 422, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49158, "responder_port": 88, "initiator_bytes": 474, "last_seen_epoch": "1550949914.827212", "responder_bytes": 528, "first_seen_epoch": "1550949914.824234" }, { "bytes": 2511, "stream": 25, "flow_id": "flow-47175c5b3b0f8a19cddfe8eb", "packets": 10, "transport": "tcp", "last_frame": 439, "first_frame": 430, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49159, "responder_port": 88, "initiator_bytes": 608, "last_seen_epoch": "1550949914.84466", "responder_bytes": 1903, "first_seen_epoch": "1550949914.843201" }, { "bytes": 3966, "stream": 26, "flow_id": "flow-117f07f9968e8062561b0b50", "packets": 12, "transport": "tcp", "last_frame": 451, "first_frame": 440, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49160, "responder_port": 88, "initiator_bytes": 1994, "last_seen_epoch": "1550949914.847972", "responder_bytes": 1972, "first_seen_epoch": "1550949914.845704" }, { "bytes": 1878, "stream": 27, "flow_id": "flow-7032aa3f9a246d696d64b395", "packets": 15, "transport": "tcp", "last_frame": 984, "first_frame": 458, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49161, "responder_port": 135, "initiator_bytes": 994, "last_seen_epoch": "1550949948.598438", "responder_bytes": 884, "first_seen_epoch": "1550949915.832929" }, { "bytes": 4519, "stream": 28, "flow_id": "flow-0c2252c19f389a2014f3b2b9", "packets": 20, "transport": "tcp", "last_frame": 982, "first_frame": 465, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49162, "responder_port": 49158, "initiator_bytes": 2621, "last_seen_epoch": "1550949948.598279", "responder_bytes": 1898, "first_seen_epoch": "1550949915.835839" }, { "bytes": 660, "stream": 29, "flow_id": "flow-cfb665ce71c0e295cd870f90", "packets": 6, "transport": "udp", "last_frame": 28464, "first_frame": 480, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 330, "last_seen_epoch": "1550951963.93929", "responder_bytes": 330, "first_seen_epoch": "1550949915.842179" }, { "bytes": 146, "stream": 30, "flow_id": "flow-718b8dc20b68f481b1549af6", "packets": 2, "transport": "udp", "last_frame": 500, "first_frame": 492, "initiator_ip": "10.2.23.109", "responder_ip": "224.0.0.252", "initiator_port": 58764, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1550949917.640448", "responder_bytes": 0, "first_seen_epoch": "1550949917.538218" }, { "bytes": 1368, "stream": 31, "flow_id": "flow-8ecc1c204286f1e179b26deb", "packets": 4, "transport": "udp", "last_frame": 24715, "first_frame": 493, "initiator_ip": "10.2.23.109", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 1368, "last_seen_epoch": "1550951426.475706", "responder_bytes": 0, "first_seen_epoch": "1550949917.544521" }, { "bytes": 1368, "stream": 32, "flow_id": "flow-8ee14c83532a55ec57ed84b8", "packets": 4, "transport": "udp", "last_frame": 24716, "first_frame": 494, "initiator_ip": "10.2.23.254", "responder_ip": "10.2.23.109", "initiator_port": 67, "responder_port": 68, "initiator_bytes": 1368, "last_seen_epoch": "1550951426.475796", "responder_bytes": 0, "first_seen_epoch": "1550949917.544618" }, { "bytes": 240, "stream": 33, "flow_id": "flow-b84b8f4af768b6994885eaf6", "packets": 2, "transport": "udp", "last_frame": 496, "first_frame": 495, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 57257, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1550949917.549677", "responder_bytes": 159, "first_seen_epoch": "1550949917.549427" }, { "bytes": 152, "stream": 34, "flow_id": "flow-ed93bf159f37fa42e5e9eb7e", "packets": 2, "transport": "udp", "last_frame": 498, "first_frame": 497, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 51832, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550949917.550893", "responder_bytes": 76, "first_seen_epoch": "1550949917.550716" }, { "bytes": 128, "stream": 35, "flow_id": "flow-a6203fae5b120047570d3244", "packets": 2, "transport": "udp", "last_frame": 501, "first_frame": 499, "initiator_ip": "10.2.23.109", "responder_ip": "224.0.0.252", "initiator_port": 64768, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1550949917.654985", "responder_bytes": 0, "first_seen_epoch": "1550949917.551698" }, { "bytes": 3528, "stream": 36, "flow_id": "flow-05e6cd9f448cd7a864bab0d9", "packets": 36, "transport": "udp", "last_frame": 25313, "first_frame": 504, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 3528, "last_seen_epoch": "1550951432.551577", "responder_bytes": 0, "first_seen_epoch": "1550949918.965191" }, { "bytes": 930, "stream": 29, "flow_id": "flow-98d91ce4c402aa3c79528bef", "packets": 8, "transport": "tcp", "last_frame": 515, "first_frame": 507, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49163, "responder_port": 88, "initiator_bytes": 462, "last_seen_epoch": "1550949919.372671", "responder_bytes": 468, "first_seen_epoch": "1550949919.370397" }, { "bytes": 2489, "stream": 30, "flow_id": "flow-291b3e730c38080c122d5ec6", "packets": 10, "transport": "tcp", "last_frame": 525, "first_frame": 516, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49164, "responder_port": 88, "initiator_bytes": 596, "last_seen_epoch": "1550949919.384105", "responder_bytes": 1893, "first_seen_epoch": "1550949919.382681" }, { "bytes": 3691, "stream": 31, "flow_id": "flow-db4839770e0dfef26f44b14a", "packets": 12, "transport": "tcp", "last_frame": 537, "first_frame": 526, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49165, "responder_port": 88, "initiator_bytes": 1831, "last_seen_epoch": "1550949919.385836", "responder_bytes": 1860, "first_seen_epoch": "1550949919.384155" }, { "bytes": 231, "stream": 37, "flow_id": "flow-1a1f5b760479c3b120bc374f", "packets": 2, "transport": "udp", "last_frame": 542, "first_frame": 541, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 56962, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1550949919.833781", "responder_bytes": 153, "first_seen_epoch": "1550949919.833437" }, { "bytes": 198, "stream": 38, "flow_id": "flow-dbc711fbbf4317a940c4b9ad", "packets": 2, "transport": "udp", "last_frame": 546, "first_frame": 545, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 64814, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1550949919.925158", "responder_bytes": 107, "first_seen_epoch": "1550949919.924923" }, { "bytes": 11841, "stream": 32, "flow_id": "flow-ad487ead249b13ec57378ced", "packets": 42, "transport": "tcp", "last_frame": 1706, "first_frame": 547, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49166, "responder_port": 49155, "initiator_bytes": 7617, "last_seen_epoch": "1550950008.602622", "responder_bytes": 4224, "first_seen_epoch": "1550949919.925847" }, { "bytes": 3990, "stream": 33, "flow_id": "flow-ffe93e4d5a959722ec30b952", "packets": 12, "transport": "tcp", "last_frame": 561, "first_frame": 550, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49167, "responder_port": 88, "initiator_bytes": 2006, "last_seen_epoch": "1550949919.928072", "responder_bytes": 1984, "first_seen_epoch": "1550949919.92667" }, { "bytes": 7198, "stream": 34, "flow_id": "flow-fd7e5b2613bdc6748060e95a", "packets": 37, "transport": "tcp", "last_frame": 15648, "first_frame": 576, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49168, "responder_port": 445, "initiator_bytes": 5180, "last_seen_epoch": "1550950837.68276", "responder_bytes": 2018, "first_seen_epoch": "1550949919.991088" }, { "bytes": 3956, "stream": 35, "flow_id": "flow-a558e0e5d59fc0efd6256ecc", "packets": 12, "transport": "tcp", "last_frame": 594, "first_frame": 583, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49169, "responder_port": 88, "initiator_bytes": 1988, "last_seen_epoch": "1550949919.994683", "responder_bytes": 1968, "first_seen_epoch": "1550949919.993298" }, { "bytes": 3655, "stream": 36, "flow_id": "flow-5b19aae4a9694cd3daec240a", "packets": 12, "transport": "tcp", "last_frame": 606, "first_frame": 595, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49170, "responder_port": 88, "initiator_bytes": 1821, "last_seen_epoch": "1550949919.995494", "responder_bytes": 1834, "first_seen_epoch": "1550949919.994794" }, { "bytes": 344, "stream": 39, "flow_id": "flow-b5e4206486fb5ea2f752a689", "packets": 2, "transport": "udp", "last_frame": 619, "first_frame": 618, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 55197, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1550949920.115975", "responder_bytes": 211, "first_seen_epoch": "1550949920.115754" }, { "bytes": 282, "stream": 40, "flow_id": "flow-2f1d6f78cd454c089fe9289b", "packets": 2, "transport": "udp", "last_frame": 621, "first_frame": 620, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 63630, "responder_port": 53, "initiator_bytes": 102, "last_seen_epoch": "1550949920.116852", "responder_bytes": 180, "first_seen_epoch": "1550949920.116688" }, { "bytes": 8233, "stream": 37, "flow_id": "flow-4ac8110c37aee509c9109f65", "packets": 20, "transport": "tcp", "last_frame": 719, "first_frame": 623, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49171, "responder_port": 389, "initiator_bytes": 3423, "last_seen_epoch": "1550949920.626676", "responder_bytes": 4810, "first_seen_epoch": "1550949920.121183" }, { "bytes": 3956, "stream": 38, "flow_id": "flow-03e60bc184b6b71d7ec359f3", "packets": 12, "transport": "tcp", "last_frame": 641, "first_frame": 630, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49172, "responder_port": 88, "initiator_bytes": 1988, "last_seen_epoch": "1550949920.126967", "responder_bytes": 1968, "first_seen_epoch": "1550949920.124639" }, { "bytes": 3422, "stream": 39, "flow_id": "flow-7fb8b36a2ddcaaa7e4058807", "packets": 13, "transport": "tcp", "last_frame": 708, "first_frame": 649, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49173, "responder_port": 389, "initiator_bytes": 2566, "last_seen_epoch": "1550949920.167446", "responder_bytes": 856, "first_seen_epoch": "1550949920.135961" }, { "bytes": 168, "stream": 41, "flow_id": "flow-1d9534bf16337d13010d7c7a", "packets": 2, "transport": "udp", "last_frame": 663, "first_frame": 662, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 63248, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550949920.141407", "responder_bytes": 92, "first_seen_epoch": "1550949920.141213" }, { "bytes": 4332, "stream": 40, "flow_id": "flow-f4dcf06dfe9429ad9454383d", "packets": 21, "transport": "tcp", "last_frame": 807, "first_frame": 664, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49174, "responder_port": 445, "initiator_bytes": 2258, "last_seen_epoch": "1550949930.816391", "responder_bytes": 2074, "first_seen_epoch": "1550949920.143259" }, { "bytes": 2307, "stream": 41, "flow_id": "flow-7af14abd9f67ecf7628b06d4", "packets": 10, "transport": "tcp", "last_frame": 680, "first_frame": 671, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49175, "responder_port": 88, "initiator_bytes": 1919, "last_seen_epoch": "1550949920.146435", "responder_bytes": 388, "first_seen_epoch": "1550949920.145324" }, { "bytes": 7481, "stream": 42, "flow_id": "flow-52b16a5068eb29c351e79d1a", "packets": 27, "transport": "tcp", "last_frame": 814, "first_frame": 689, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49176, "responder_port": 445, "initiator_bytes": 5317, "last_seen_epoch": "1550949936.82185", "responder_bytes": 2164, "first_seen_epoch": "1550949920.160135" }, { "bytes": 258, "stream": 42, "flow_id": "flow-7c7688c49514fbb68d654f95", "packets": 2, "transport": "udp", "last_frame": 726, "first_frame": 725, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 53083, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1550949922.53861", "responder_bytes": 168, "first_seen_epoch": "1550949922.538276" }, { "bytes": 316, "stream": 43, "flow_id": "flow-0c468b799556f5b573c96418", "packets": 2, "transport": "udp", "last_frame": 728, "first_frame": 727, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 63997, "responder_port": 53, "initiator_bytes": 158, "last_seen_epoch": "1550949922.541944", "responder_bytes": 158, "first_seen_epoch": "1550949922.53996" }, { "bytes": 1782, "stream": 43, "flow_id": "flow-18ab06fd70198b397c600025", "packets": 15, "transport": "tcp", "last_frame": 1013, "first_frame": 731, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49180, "responder_port": 135, "initiator_bytes": 994, "last_seen_epoch": "1550949973.001726", "responder_bytes": 788, "first_seen_epoch": "1550949924.600736" }, { "bytes": 6778, "stream": 44, "flow_id": "flow-de96a79fa97531ffc3ec96d3", "packets": 27, "transport": "tcp", "last_frame": 1011, "first_frame": 738, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49181, "responder_port": 49155, "initiator_bytes": 4341, "last_seen_epoch": "1550949973.001536", "responder_bytes": 2437, "first_seen_epoch": "1550949924.602711" }, { "bytes": 258, "stream": 44, "flow_id": "flow-9c69c0169e27cffbf1098245", "packets": 2, "transport": "udp", "last_frame": 746, "first_frame": 745, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 60722, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550949924.782455", "responder_bytes": 182, "first_seen_epoch": "1550949924.687316" }, { "bytes": 832, "stream": 45, "flow_id": "flow-9b79a7ad2598d1786ab25893", "packets": 10, "transport": "tcp", "last_frame": 800, "first_frame": 747, "initiator_ip": "10.2.23.109", "responder_ip": "23.223.195.42", "initiator_port": 49177, "responder_port": 80, "initiator_bytes": 379, "last_seen_epoch": "1550949926.151363", "responder_bytes": 453, "first_seen_epoch": "1550949924.786508" }, { "bytes": 5827, "stream": 46, "flow_id": "flow-ee0e5cb95a919bb21a728971", "packets": 20, "transport": "tcp", "last_frame": 818, "first_frame": 754, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49178, "responder_port": 445, "initiator_bytes": 4421, "last_seen_epoch": "1550949936.822704", "responder_bytes": 1406, "first_seen_epoch": "1550949925.330382" }, { "bytes": 3932, "stream": 47, "flow_id": "flow-d76de11be2df9d38842c1deb", "packets": 12, "transport": "tcp", "last_frame": 770, "first_frame": 759, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49179, "responder_port": 88, "initiator_bytes": 1976, "last_seen_epoch": "1550949925.333238", "responder_bytes": 1956, "first_seen_epoch": "1550949925.331783" }, { "bytes": 3631, "stream": 48, "flow_id": "flow-21ad2300520b320e825b73cb", "packets": 12, "transport": "tcp", "last_frame": 782, "first_frame": 771, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49180, "responder_port": 88, "initiator_bytes": 1809, "last_seen_epoch": "1550949925.334234", "responder_bytes": 1822, "first_seen_epoch": "1550949925.333307" }, { "bytes": 1008, "stream": 49, "flow_id": "flow-5b7f0ce5c42b00c460f59000", "packets": 8, "transport": "tcp", "last_frame": 828, "first_frame": 821, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49182, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1550949937.29944", "responder_bytes": 532, "first_seen_epoch": "1550949937.298264" }, { "bytes": 2535, "stream": 50, "flow_id": "flow-508d7720669b0770cab1f70f", "packets": 10, "transport": "tcp", "last_frame": 838, "first_frame": 829, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49183, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1550949937.317285", "responder_bytes": 1925, "first_seen_epoch": "1550949937.315834" }, { "bytes": 4006, "stream": 51, "flow_id": "flow-1c8a0372884cfb74bd67ee1d", "packets": 12, "transport": "tcp", "last_frame": 850, "first_frame": 839, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49184, "responder_port": 88, "initiator_bytes": 2014, "last_seen_epoch": "1550949937.319039", "responder_bytes": 1992, "first_seen_epoch": "1550949937.317642" }, { "bytes": 344, "stream": 45, "flow_id": "flow-8f89767ff44118970f15ee08", "packets": 2, "transport": "udp", "last_frame": 868, "first_frame": 867, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 62222, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1550949937.842847", "responder_bytes": 211, "first_seen_epoch": "1550949937.842588" }, { "bytes": 282, "stream": 46, "flow_id": "flow-c77d4a6d119a3e4097b4a96a", "packets": 2, "transport": "udp", "last_frame": 870, "first_frame": 869, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 56776, "responder_port": 53, "initiator_bytes": 102, "last_seen_epoch": "1550949937.843432", "responder_bytes": 180, "first_seen_epoch": "1550949937.843265" }, { "bytes": 5301, "stream": 52, "flow_id": "flow-8029ac1ef0cb86d480f0b3ec", "packets": 16, "transport": "tcp", "last_frame": 976, "first_frame": 871, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49185, "responder_port": 389, "initiator_bytes": 2967, "last_seen_epoch": "1550949938.419064", "responder_bytes": 2334, "first_seen_epoch": "1550949937.844736" }, { "bytes": 3907, "stream": 53, "flow_id": "flow-f8316a7e60ff02e0340cff0b", "packets": 12, "transport": "tcp", "last_frame": 889, "first_frame": 878, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49186, "responder_port": 88, "initiator_bytes": 1975, "last_seen_epoch": "1550949937.854099", "responder_bytes": 1932, "first_seen_epoch": "1550949937.85212" }, { "bytes": 3406, "stream": 54, "flow_id": "flow-5318dbab1f20cf280abb0387", "packets": 13, "transport": "tcp", "last_frame": 970, "first_frame": 892, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49187, "responder_port": 389, "initiator_bytes": 2550, "last_seen_epoch": "1550949937.902038", "responder_bytes": 856, "first_seen_epoch": "1550949937.867624" }, { "bytes": 3697, "stream": 55, "flow_id": "flow-7b5e9fc85ae3b61d47d8bb9d", "packets": 12, "transport": "tcp", "last_frame": 915, "first_frame": 895, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49188, "responder_port": 88, "initiator_bytes": 1835, "last_seen_epoch": "1550949937.873756", "responder_bytes": 1862, "first_seen_epoch": "1550949937.869601" }, { "bytes": 3357, "stream": 56, "flow_id": "flow-6d5a7eb22c773c1286a63bf0", "packets": 10, "transport": "tcp", "last_frame": 925, "first_frame": 916, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49189, "responder_port": 88, "initiator_bytes": 2929, "last_seen_epoch": "1550949937.874978", "responder_bytes": 428, "first_seen_epoch": "1550949937.873851" }, { "bytes": 7497, "stream": 57, "flow_id": "flow-cd51f5d293f53076cf756e07", "packets": 27, "transport": "tcp", "last_frame": 1020, "first_frame": 927, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49190, "responder_port": 445, "initiator_bytes": 5333, "last_seen_epoch": "1550949973.519438", "responder_bytes": 2164, "first_seen_epoch": "1550949937.894363" }, { "bytes": 3972, "stream": 58, "flow_id": "flow-8312178cb08d3bf76a260e81", "packets": 12, "transport": "tcp", "last_frame": 945, "first_frame": 934, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49191, "responder_port": 88, "initiator_bytes": 1996, "last_seen_epoch": "1550949937.897737", "responder_bytes": 1976, "first_seen_epoch": "1550949937.896159" }, { "bytes": 3671, "stream": 59, "flow_id": "flow-9013e5f2c16ce7f2ce3fc0fc", "packets": 12, "transport": "tcp", "last_frame": 957, "first_frame": 946, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49192, "responder_port": 88, "initiator_bytes": 1829, "last_seen_epoch": "1550949937.898788", "responder_bytes": 1842, "first_seen_epoch": "1550949937.897774" }, { "bytes": 1782, "stream": 60, "flow_id": "flow-4586f2a569def8f1664e4574", "packets": 15, "transport": "tcp", "last_frame": 1708, "first_frame": 985, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49181, "responder_port": 135, "initiator_bytes": 994, "last_seen_epoch": "1550950008.602959", "responder_bytes": 788, "first_seen_epoch": "1550949959.869851" }, { "bytes": 1002, "stream": 61, "flow_id": "flow-5f2ac65639e3da4b6cdef693", "packets": 8, "transport": "tcp", "last_frame": 1031, "first_frame": 1024, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49182, "responder_port": 88, "initiator_bytes": 474, "last_seen_epoch": "1550949975.133201", "responder_bytes": 528, "first_seen_epoch": "1550949975.131498" }, { "bytes": 2511, "stream": 62, "flow_id": "flow-09e7611f974bc9283ecbb252", "packets": 10, "transport": "tcp", "last_frame": 1041, "first_frame": 1032, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49183, "responder_port": 88, "initiator_bytes": 608, "last_seen_epoch": "1550949975.1511", "responder_bytes": 1903, "first_seen_epoch": "1550949975.149518" }, { "bytes": 3966, "stream": 63, "flow_id": "flow-2080a27954e2168010a063a5", "packets": 12, "transport": "tcp", "last_frame": 1053, "first_frame": 1042, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49184, "responder_port": 88, "initiator_bytes": 1994, "last_seen_epoch": "1550949975.152745", "responder_bytes": 1972, "first_seen_epoch": "1550949975.151419" }, { "bytes": 5173, "stream": 64, "flow_id": "flow-8add55daa4d1a9fab49e384e", "packets": 14, "transport": "tcp", "last_frame": 1173, "first_frame": 1070, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49185, "responder_port": 389, "initiator_bytes": 2893, "last_seen_epoch": "1550949976.220304", "responder_bytes": 2280, "first_seen_epoch": "1550949975.675778" }, { "bytes": 3861, "stream": 65, "flow_id": "flow-5b204b6d4bfd774799172740", "packets": 12, "transport": "tcp", "last_frame": 1088, "first_frame": 1077, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49186, "responder_port": 88, "initiator_bytes": 1953, "last_seen_epoch": "1550949975.68411", "responder_bytes": 1908, "first_seen_epoch": "1550949975.682649" }, { "bytes": 3650, "stream": 66, "flow_id": "flow-6c9b7c466863c916711c6595", "packets": 12, "transport": "tcp", "last_frame": 1102, "first_frame": 1090, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49187, "responder_port": 88, "initiator_bytes": 1813, "last_seen_epoch": "1550949975.687398", "responder_bytes": 1837, "first_seen_epoch": "1550949975.685614" }, { "bytes": 3313, "stream": 67, "flow_id": "flow-1f6c48eaddf18825e0aa2787", "packets": 10, "transport": "tcp", "last_frame": 1115, "first_frame": 1103, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49188, "responder_port": 88, "initiator_bytes": 2887, "last_seen_epoch": "1550949975.688832", "responder_bytes": 426, "first_seen_epoch": "1550949975.68754" }, { "bytes": 3386, "stream": 68, "flow_id": "flow-1be5893b19cf36c034cd1282", "packets": 13, "transport": "tcp", "last_frame": 1169, "first_frame": 1110, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49189, "responder_port": 389, "initiator_bytes": 2530, "last_seen_epoch": "1550949975.701561", "responder_bytes": 856, "first_seen_epoch": "1550949975.688447" }, { "bytes": 7457, "stream": 69, "flow_id": "flow-f4619d6f21eb541aa4a138dc", "packets": 27, "transport": "tcp", "last_frame": 1887, "first_frame": 1126, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49190, "responder_port": 445, "initiator_bytes": 5293, "last_seen_epoch": "1550950014.813027", "responder_bytes": 2164, "first_seen_epoch": "1550949975.694798" }, { "bytes": 3932, "stream": 70, "flow_id": "flow-944842df59656b4d198a38a2", "packets": 12, "transport": "tcp", "last_frame": 1144, "first_frame": 1133, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49191, "responder_port": 88, "initiator_bytes": 1976, "last_seen_epoch": "1550949975.697791", "responder_bytes": 1956, "first_seen_epoch": "1550949975.696404" }, { "bytes": 3631, "stream": 71, "flow_id": "flow-2dbd1c09bb19a8bc75b110bf", "packets": 12, "transport": "tcp", "last_frame": 1156, "first_frame": 1145, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49192, "responder_port": 88, "initiator_bytes": 1809, "last_seen_epoch": "1550949975.698717", "responder_bytes": 1822, "first_seen_epoch": "1550949975.697905" }, { "bytes": 168, "stream": 47, "flow_id": "flow-5093f88c9a627355f38660fe", "packets": 2, "transport": "udp", "last_frame": 1177, "first_frame": 1176, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 59718, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550949983.592832", "responder_bytes": 92, "first_seen_epoch": "1550949983.441602" }, { "bytes": 1199, "stream": 72, "flow_id": "flow-0cd9bc39dee3f841d174a5cb", "packets": 11, "transport": "tcp", "last_frame": 4748, "first_frame": 1181, "initiator_ip": "10.2.23.109", "responder_ip": "198.185.159.136", "initiator_port": 49194, "responder_port": 80, "initiator_bytes": 595, "last_seen_epoch": "1550950094.063425", "responder_bytes": 604, "first_seen_epoch": "1550949984.16926" }, { "bytes": 394, "stream": 73, "flow_id": "flow-364adf0c574ab5ba71091e7d", "packets": 7, "transport": "tcp", "last_frame": 4750, "first_frame": 1182, "initiator_ip": "10.2.23.109", "responder_ip": "198.185.159.136", "initiator_port": 49193, "responder_port": 80, "initiator_bytes": 228, "last_seen_epoch": "1550950094.063565", "responder_bytes": 166, "first_seen_epoch": "1550949984.169339" }, { "bytes": 176, "stream": 48, "flow_id": "flow-3c2b3cbbfab2d190007395d4", "packets": 2, "transport": "udp", "last_frame": 1192, "first_frame": 1191, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 53704, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1550949985.000129", "responder_bytes": 96, "first_seen_epoch": "1550949984.840704" }, { "bytes": 9253, "stream": 74, "flow_id": "flow-314500e7eba54bbf11b91366", "packets": 18, "transport": "tcp", "last_frame": 2085, "first_frame": 1193, "initiator_ip": "10.2.23.109", "responder_ip": "198.185.159.135", "initiator_port": 49195, "responder_port": 80, "initiator_bytes": 775, "last_seen_epoch": "1550950019.959311", "responder_bytes": 8478, "first_seen_epoch": "1550949985.00085" }, { "bytes": 5254, "stream": 75, "flow_id": "flow-14fd07155b15b92a069a0a52", "packets": 19, "transport": "tcp", "last_frame": 4746, "first_frame": 1194, "initiator_ip": "10.2.23.109", "responder_ip": "198.185.159.135", "initiator_port": 49196, "responder_port": 80, "initiator_bytes": 3718, "last_seen_epoch": "1550950094.06328", "responder_bytes": 1536, "first_seen_epoch": "1550949985.001013" }, { "bytes": 450, "stream": 49, "flow_id": "flow-562d366d9546c1b75883c7d8", "packets": 6, "transport": "udp", "last_frame": 1422, "first_frame": 1205, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 52247, "responder_port": 53, "initiator_bytes": 375, "last_seen_epoch": "1550949997.308765", "responder_bytes": 75, "first_seen_epoch": "1550949985.985154" }, { "bytes": 480, "stream": 50, "flow_id": "flow-9c9f1c973fa674b4418b023e", "packets": 6, "transport": "udp", "last_frame": 1423, "first_frame": 1206, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 63472, "responder_port": 53, "initiator_bytes": 400, "last_seen_epoch": "1550949997.308863", "responder_bytes": 80, "first_seen_epoch": "1550949985.987562" }, { "bytes": 492, "stream": 51, "flow_id": "flow-8dcb235c3fa6ae61ff7f1aa5", "packets": 6, "transport": "udp", "last_frame": 1421, "first_frame": 1207, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 60118, "responder_port": 53, "initiator_bytes": 410, "last_seen_epoch": "1550949997.308649", "responder_bytes": 82, "first_seen_epoch": "1550949985.989617" }, { "bytes": 275, "stream": 52, "flow_id": "flow-f0a28d8b0aaaaa2f827f9df8", "packets": 2, "transport": "udp", "last_frame": 1213, "first_frame": 1212, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 53674, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1550949986.21134", "responder_bytes": 192, "first_seen_epoch": "1550949986.109212" }, { "bytes": 114789, "stream": 76, "flow_id": "flow-628825de9dd02d1632c80d5d", "packets": 147, "transport": "tcp", "last_frame": 4780, "first_frame": 1214, "initiator_ip": "10.2.23.109", "responder_ip": "151.101.0.238", "initiator_port": 49197, "responder_port": 80, "initiator_bytes": 3980, "last_seen_epoch": "1550950094.707138", "responder_bytes": 110809, "first_seen_epoch": "1550949986.21251" }, { "bytes": 394, "stream": 77, "flow_id": "flow-f17a42c3c0ac81e7d713c1ca", "packets": 7, "transport": "tcp", "last_frame": 4790, "first_frame": 1215, "initiator_ip": "10.2.23.109", "responder_ip": "151.101.0.238", "initiator_port": 49198, "responder_port": 80, "initiator_bytes": 228, "last_seen_epoch": "1550950095.270446", "responder_bytes": 166, "first_seen_epoch": "1550949986.212703" }, { "bytes": 8090, "stream": 78, "flow_id": "flow-505fbc7fac9e8d4474d0232b", "packets": 24, "transport": "tcp", "last_frame": 4771, "first_frame": 1216, "initiator_ip": "10.2.23.109", "responder_ip": "151.101.0.238", "initiator_port": 49199, "responder_port": 443, "initiator_bytes": 1412, "last_seen_epoch": "1550950094.366011", "responder_bytes": 6678, "first_seen_epoch": "1550949986.212859" }, { "bytes": 220, "stream": 53, "flow_id": "flow-430ac424b33151953ae40435", "packets": 2, "transport": "udp", "last_frame": 1299, "first_frame": 1290, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 55591, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550949987.996754", "responder_bytes": 148, "first_seen_epoch": "1550949987.933921" }, { "bytes": 231, "stream": 54, "flow_id": "flow-dab1cad54159edd3b977a0bb", "packets": 2, "transport": "udp", "last_frame": 1298, "first_frame": 1291, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 63426, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550949987.996656", "responder_bytes": 159, "first_seen_epoch": "1550949987.935237" }, { "bytes": 260, "stream": 55, "flow_id": "flow-7d1c49c8a24e44dad84b7069", "packets": 2, "transport": "udp", "last_frame": 1306, "first_frame": 1292, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 53256, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550949988.035122", "responder_bytes": 188, "first_seen_epoch": "1550949987.935983" }, { "bytes": 271, "stream": 56, "flow_id": "flow-9e8778510cb823a51ea56b92", "packets": 2, "transport": "udp", "last_frame": 1303, "first_frame": 1293, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 54028, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550949988.034813", "responder_bytes": 199, "first_seen_epoch": "1550949987.937966" }, { "bytes": 271, "stream": 57, "flow_id": "flow-a725caadca5fe55330480049", "packets": 2, "transport": "udp", "last_frame": 1304, "first_frame": 1294, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 62186, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550949988.034951", "responder_bytes": 199, "first_seen_epoch": "1550949987.938668" }, { "bytes": 271, "stream": 58, "flow_id": "flow-cc952eaf0ec3a126efed798f", "packets": 2, "transport": "udp", "last_frame": 1305, "first_frame": 1295, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 54606, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550949988.035045", "responder_bytes": 199, "first_seen_epoch": "1550949987.939588" }, { "bytes": 1260, "stream": 79, "flow_id": "flow-3ee5c2bb1a9268ec5b27c5e8", "packets": 8, "transport": "tcp", "last_frame": 3949, "first_frame": 1342, "initiator_ip": "10.2.23.109", "responder_ip": "204.79.197.200", "initiator_port": 49200, "responder_port": 80, "initiator_bytes": 456, "last_seen_epoch": "1550950055.372368", "responder_bytes": 804, "first_seen_epoch": "1550949989.015127" }, { "bytes": 340, "stream": 80, "flow_id": "flow-ed1fd9820d186ebef0ab5bcc", "packets": 6, "transport": "tcp", "last_frame": 4954, "first_frame": 1343, "initiator_ip": "10.2.23.109", "responder_ip": "204.79.197.200", "initiator_port": 49201, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1550950109.059553", "responder_bytes": 166, "first_seen_epoch": "1550949989.015295" }, { "bytes": 8916, "stream": 59, "flow_id": "flow-c0ac25bec62f3644da2f334e", "packets": 84, "transport": "udp", "last_frame": 28846, "first_frame": 1420, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.1", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 8916, "last_seen_epoch": "1550952519.347657", "responder_bytes": 0, "first_seen_epoch": "1550949996.104675" }, { "bytes": 273, "stream": 60, "flow_id": "flow-cbc8ca3686d02142ce9e591c", "packets": 2, "transport": "udp", "last_frame": 1429, "first_frame": 1425, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49963, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1550949997.407985", "responder_bytes": 191, "first_seen_epoch": "1550949997.309683" }, { "bytes": 212, "stream": 61, "flow_id": "flow-c98d9aa8c21045c4a7c35b93", "packets": 2, "transport": "udp", "last_frame": 1427, "first_frame": 1426, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 54061, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1550949997.401197", "responder_bytes": 132, "first_seen_epoch": "1550949997.310632" }, { "bytes": 1617, "stream": 81, "flow_id": "flow-c28909bcc4d832188464065e", "packets": 13, "transport": "tcp", "last_frame": 4753, "first_frame": 1428, "initiator_ip": "10.2.23.109", "responder_ip": "172.217.2.10", "initiator_port": 49202, "responder_port": 80, "initiator_bytes": 691, "last_seen_epoch": "1550950094.114077", "responder_bytes": 926, "first_seen_epoch": "1550949997.40216" }, { "bytes": 383392, "stream": 82, "flow_id": "flow-1265cd53326791cee58bca71", "packets": 469, "transport": "tcp", "last_frame": 6124, "first_frame": 1430, "initiator_ip": "10.2.23.109", "responder_ip": "151.101.64.238", "initiator_port": 49203, "responder_port": 80, "initiator_bytes": 10425, "last_seen_epoch": "1550950169.101709", "responder_bytes": 372967, "first_seen_epoch": "1550949997.409236" }, { "bytes": 168, "stream": 62, "flow_id": "flow-72169043ceb314357e542a28", "packets": 2, "transport": "udp", "last_frame": 1441, "first_frame": 1440, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 54557, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550949997.877899", "responder_bytes": 92, "first_seen_epoch": "1550949997.825696" }, { "bytes": 180, "stream": 63, "flow_id": "flow-57affbee2cbcc31fe7f10a78", "packets": 2, "transport": "udp", "last_frame": 1443, "first_frame": 1442, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 62878, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550949997.93232", "responder_bytes": 104, "first_seen_epoch": "1550949997.878519" }, { "bytes": 240, "stream": 64, "flow_id": "flow-c9485b1fc74a22a7ce7c8449", "packets": 2, "transport": "udp", "last_frame": 1515, "first_frame": 1512, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 63705, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1550949999.72057", "responder_bytes": 165, "first_seen_epoch": "1550949999.603647" }, { "bytes": 10279, "stream": 83, "flow_id": "flow-055394d1735a19147cbc179e", "packets": 22, "transport": "tcp", "last_frame": 2090, "first_frame": 1516, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49204, "responder_port": 80, "initiator_bytes": 1469, "last_seen_epoch": "1550950019.966787", "responder_bytes": 8810, "first_seen_epoch": "1550949999.721963" }, { "bytes": 246, "stream": 65, "flow_id": "flow-35e1fe95eb4f0606254bedd9", "packets": 2, "transport": "udp", "last_frame": 1840, "first_frame": 1839, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49481, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1550950014.051797", "responder_bytes": 164, "first_seen_epoch": "1550950013.988524" }, { "bytes": 45694, "stream": 84, "flow_id": "flow-ec816f4e6c2a378faff487ed", "packets": 72, "transport": "tcp", "last_frame": 4953, "first_frame": 1841, "initiator_ip": "10.2.23.109", "responder_ip": "72.21.81.200", "initiator_port": 49205, "responder_port": 443, "initiator_bytes": 2341, "last_seen_epoch": "1550950109.059529", "responder_bytes": 43353, "first_seen_epoch": "1550950014.052477" }, { "bytes": 8929, "stream": 85, "flow_id": "flow-e1e0e8fd36c80573fe41d0e3", "packets": 26, "transport": "tcp", "last_frame": 4947, "first_frame": 1842, "initiator_ip": "10.2.23.109", "responder_ip": "72.21.81.200", "initiator_port": 49206, "responder_port": 443, "initiator_bytes": 1076, "last_seen_epoch": "1550950109.006913", "responder_bytes": 7853, "first_seen_epoch": "1550950014.05254" }, { "bytes": 55178, "stream": 86, "flow_id": "flow-74ba9a00b8d30de3cc67f164", "packets": 82, "transport": "tcp", "last_frame": 2805, "first_frame": 2051, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49207, "responder_port": 443, "initiator_bytes": 2959, "last_seen_epoch": "1550950024.845335", "responder_bytes": 52219, "first_seen_epoch": "1550950019.886698" }, { "bytes": 75087, "stream": 87, "flow_id": "flow-fc4aca6fbf0464c914e95ea0", "packets": 107, "transport": "tcp", "last_frame": 2840, "first_frame": 2052, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49208, "responder_port": 443, "initiator_bytes": 3974, "last_seen_epoch": "1550950025.054961", "responder_bytes": 71113, "first_seen_epoch": "1550950019.888789" }, { "bytes": 31935, "stream": 88, "flow_id": "flow-ebad7ac0e86d45700b0662a6", "packets": 48, "transport": "tcp", "last_frame": 2861, "first_frame": 2053, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49209, "responder_port": 443, "initiator_bytes": 1782, "last_seen_epoch": "1550950025.369544", "responder_bytes": 30153, "first_seen_epoch": "1550950019.889071" }, { "bytes": 74769, "stream": 89, "flow_id": "flow-8ef3c030a02e795a06d32ca0", "packets": 94, "transport": "tcp", "last_frame": 4765, "first_frame": 2054, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49210, "responder_port": 443, "initiator_bytes": 3380, "last_seen_epoch": "1550950094.124762", "responder_bytes": 71389, "first_seen_epoch": "1550950019.889235" }, { "bytes": 55212, "stream": 90, "flow_id": "flow-54ebbf547c168665c83090c4", "packets": 85, "transport": "tcp", "last_frame": 4762, "first_frame": 2055, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49211, "responder_port": 443, "initiator_bytes": 3175, "last_seen_epoch": "1550950094.124521", "responder_bytes": 52037, "first_seen_epoch": "1550950019.889856" }, { "bytes": 54172, "stream": 91, "flow_id": "flow-4f1abc9fd2aa119a7841a9c8", "packets": 77, "transport": "tcp", "last_frame": 4763, "first_frame": 2058, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49212, "responder_port": 443, "initiator_bytes": 2797, "last_seen_epoch": "1550950094.124527", "responder_bytes": 51375, "first_seen_epoch": "1550950019.890729" }, { "bytes": 206, "stream": 66, "flow_id": "flow-ad8afc885980a3f1621c51ee", "packets": 2, "transport": "udp", "last_frame": 2092, "first_frame": 2059, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 64987, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1550950020.020502", "responder_bytes": 129, "first_seen_epoch": "1550950019.92921" }, { "bytes": 9129, "stream": 92, "flow_id": "flow-c5f3e5a8eea381457b1ceb01", "packets": 24, "transport": "tcp", "last_frame": 6123, "first_frame": 2088, "initiator_ip": "10.2.23.109", "responder_ip": "151.101.64.238", "initiator_port": 49213, "responder_port": 443, "initiator_bytes": 1497, "last_seen_epoch": "1550950169.101454", "responder_bytes": 7632, "first_seen_epoch": "1550950019.965946" }, { "bytes": 2375673, "stream": 93, "flow_id": "flow-3997ec25a0c5c08463c4c820", "packets": 2887, "transport": "tcp", "last_frame": 6122, "first_frame": 2091, "initiator_ip": "10.2.23.109", "responder_ip": "151.101.64.238", "initiator_port": 49214, "responder_port": 443, "initiator_bytes": 62533, "last_seen_epoch": "1550950168.997742", "responder_bytes": 2313140, "first_seen_epoch": "1550950019.976359" }, { "bytes": 31434, "stream": 94, "flow_id": "flow-d7c3c2fd445d0235a406b34b", "packets": 42, "transport": "tcp", "last_frame": 4769, "first_frame": 2093, "initiator_ip": "10.2.23.109", "responder_ip": "172.217.2.3", "initiator_port": 49215, "responder_port": 80, "initiator_bytes": 1212, "last_seen_epoch": "1550950094.365049", "responder_bytes": 30222, "first_seen_epoch": "1550950020.021122" }, { "bytes": 29939, "stream": 95, "flow_id": "flow-56c2566abf991d85ddcb0e70", "packets": 43, "transport": "tcp", "last_frame": 4775, "first_frame": 2094, "initiator_ip": "10.2.23.109", "responder_ip": "172.217.2.3", "initiator_port": 49216, "responder_port": 80, "initiator_bytes": 1322, "last_seen_epoch": "1550950094.607095", "responder_bytes": 28617, "first_seen_epoch": "1550950020.022453" }, { "bytes": 46988, "stream": 96, "flow_id": "flow-dbb39476195c899c36503972", "packets": 68, "transport": "tcp", "last_frame": 2876, "first_frame": 2204, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49218, "responder_port": 443, "initiator_bytes": 2538, "last_seen_epoch": "1550950025.419679", "responder_bytes": 44450, "first_seen_epoch": "1550950020.588211" }, { "bytes": 26791, "stream": 97, "flow_id": "flow-566c83ad289d2fa3899cfe66", "packets": 44, "transport": "tcp", "last_frame": 4764, "first_frame": 2205, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49217, "responder_port": 443, "initiator_bytes": 1814, "last_seen_epoch": "1550950094.124679", "responder_bytes": 24977, "first_seen_epoch": "1550950020.588367" }, { "bytes": 237, "stream": 67, "flow_id": "flow-96175c1de227aaa1eaaf3a88", "packets": 2, "transport": "udp", "last_frame": 2408, "first_frame": 2383, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 65316, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1550950021.846199", "responder_bytes": 164, "first_seen_epoch": "1550950021.748523" }, { "bytes": 1304, "stream": 98, "flow_id": "flow-d0ec42b159dfdc2c5469a2e6", "packets": 14, "transport": "tcp", "last_frame": 4720, "first_frame": 2409, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49219, "responder_port": 443, "initiator_bytes": 722, "last_seen_epoch": "1550950094.059785", "responder_bytes": 582, "first_seen_epoch": "1550950021.846769" }, { "bytes": 6380, "stream": 99, "flow_id": "flow-1f62dd00c9561aea3128106b", "packets": 22, "transport": "tcp", "last_frame": 4754, "first_frame": 2410, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49220, "responder_port": 443, "initiator_bytes": 1508, "last_seen_epoch": "1550950094.114171", "responder_bytes": 4872, "first_seen_epoch": "1550950021.84683" }, { "bytes": 24677, "stream": 100, "flow_id": "flow-3686a9965df1e46fe4bbfc88", "packets": 48, "transport": "tcp", "last_frame": 4767, "first_frame": 2539, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49222, "responder_port": 443, "initiator_bytes": 1955, "last_seen_epoch": "1550950094.124999", "responder_bytes": 22722, "first_seen_epoch": "1550950022.912158" }, { "bytes": 24287, "stream": 101, "flow_id": "flow-8e1e8cbac8f2a5685a7768cd", "packets": 39, "transport": "tcp", "last_frame": 2842, "first_frame": 2540, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49221, "responder_port": 443, "initiator_bytes": 1577, "last_seen_epoch": "1550950025.060461", "responder_bytes": 22710, "first_seen_epoch": "1550950022.912231" }, { "bytes": 24697, "stream": 102, "flow_id": "flow-0912c1b73f857ba7d128ee55", "packets": 46, "transport": "tcp", "last_frame": 4766, "first_frame": 2693, "initiator_ip": "10.2.23.109", "responder_ip": "23.63.25.226", "initiator_port": 49223, "responder_port": 443, "initiator_bytes": 1901, "last_seen_epoch": "1550950094.12487", "responder_bytes": 22796, "first_seen_epoch": "1550950024.239329" }, { "bytes": 18686, "stream": 103, "flow_id": "flow-824976480a470278097e9d2d", "packets": 56, "transport": "tcp", "last_frame": 3517, "first_frame": 3041, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49193, "responder_port": 445, "initiator_bytes": 11996, "last_seen_epoch": "1550950039.523913", "responder_bytes": 6690, "first_seen_epoch": "1550950027.67607" }, { "bytes": 4012, "stream": 104, "flow_id": "flow-fdaa4e527f333bc31933944f", "packets": 12, "transport": "tcp", "last_frame": 3070, "first_frame": 3059, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49194, "responder_port": 88, "initiator_bytes": 2010, "last_seen_epoch": "1550950027.686439", "responder_bytes": 2002, "first_seen_epoch": "1550950027.684065" }, { "bytes": 131675, "stream": 105, "flow_id": "flow-af766aa30751587c16e2af6e", "packets": 152, "transport": "tcp", "last_frame": 3546, "first_frame": 3116, "initiator_ip": "10.2.23.231", "responder_ip": "209.141.55.226", "initiator_port": 49195, "responder_port": 80, "initiator_bytes": 3239, "last_seen_epoch": "1550950040.343377", "responder_bytes": 128436, "first_seen_epoch": "1550950028.090678" }, { "bytes": 263, "stream": 68, "flow_id": "flow-01888ca76bcf04e6eaed38a0", "packets": 2, "transport": "udp", "last_frame": 4396, "first_frame": 4395, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 62566, "responder_port": 53, "initiator_bytes": 98, "last_seen_epoch": "1550950076.073886", "responder_bytes": 165, "first_seen_epoch": "1550950076.073666" }, { "bytes": 453, "stream": 69, "flow_id": "flow-15bce7605b7c3031e3b1ff57", "packets": 2, "transport": "udp", "last_frame": 4398, "first_frame": 4397, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 62567, "responder_port": 389, "initiator_bytes": 216, "last_seen_epoch": "1550950076.074781", "responder_bytes": 237, "first_seen_epoch": "1550950076.074575" }, { "bytes": 164, "stream": 70, "flow_id": "flow-bf406ba16ccfe8bb259f96ce", "packets": 2, "transport": "udp", "last_frame": 6143, "first_frame": 6142, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 59048, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1550950376.813125", "responder_bytes": 90, "first_seen_epoch": "1550950376.282884" }, { "bytes": 248, "stream": 106, "flow_id": "flow-319cc6b5e677866d0e6cafef", "packets": 4, "transport": "tcp", "last_frame": 7256, "first_frame": 6144, "initiator_ip": "10.2.23.231", "responder_ip": "181.215.47.171", "initiator_port": 49196, "responder_port": 443, "initiator_bytes": 194, "last_seen_epoch": "1550950452.264845", "responder_bytes": 54, "first_seen_epoch": "1550950376.817336" }, { "bytes": 168, "stream": 71, "flow_id": "flow-96fa97e5b0ba1eb36fc3d0f6", "packets": 2, "transport": "udp", "last_frame": 6151, "first_frame": 6150, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 53432, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550950399.176094", "responder_bytes": 92, "first_seen_epoch": "1550950399.114908" }, { "bytes": 180, "stream": 72, "flow_id": "flow-4c70a51fcc3a5cb935076bd2", "packets": 2, "transport": "udp", "last_frame": 6153, "first_frame": 6152, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 55003, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550950399.176718", "responder_bytes": 104, "first_seen_epoch": "1550950399.176507" }, { "bytes": 164, "stream": 73, "flow_id": "flow-4329b21d0c610b155ff1bd1d", "packets": 2, "transport": "udp", "last_frame": 6155, "first_frame": 6154, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 51800, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1550950403.232285", "responder_bytes": 90, "first_seen_epoch": "1550950402.861168" }, { "bytes": 6027, "stream": 107, "flow_id": "flow-7feea72c0ad6f2bea8461fa2", "packets": 26, "transport": "tcp", "last_frame": 7732, "first_frame": 6156, "initiator_ip": "10.2.23.231", "responder_ip": "185.246.116.239", "initiator_port": 49197, "responder_port": 443, "initiator_bytes": 1700, "last_seen_epoch": "1550950485.277171", "responder_bytes": 4327, "first_seen_epoch": "1550950403.233866" }, { "bytes": 360, "stream": 74, "flow_id": "flow-1a44aa0e1364ea707eb3156a", "packets": 2, "transport": "udp", "last_frame": 6167, "first_frame": 6165, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 59866, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1550950404.667581", "responder_bytes": 270, "first_seen_epoch": "1550950404.337831" }, { "bytes": 60727, "stream": 108, "flow_id": "flow-211ceb88c835986807cc82a2", "packets": 65, "transport": "tcp", "last_frame": 7854, "first_frame": 6168, "initiator_ip": "10.2.23.231", "responder_ip": "8.253.129.66", "initiator_port": 49198, "responder_port": 80, "initiator_bytes": 1201, "last_seen_epoch": "1550950496.286818", "responder_bytes": 59526, "first_seen_epoch": "1550950404.669492" }, { "bytes": 180139, "stream": 109, "flow_id": "flow-b6df8b7b9766859fdcf2288a", "packets": 210, "transport": "tcp", "last_frame": 7851, "first_frame": 6239, "initiator_ip": "10.2.23.231", "responder_ip": "46.249.62.199", "initiator_port": 49199, "responder_port": 80, "initiator_bytes": 4032, "last_seen_epoch": "1550950495.910965", "responder_bytes": 176107, "first_seen_epoch": "1550950409.944187" }, { "bytes": 2995815, "stream": 110, "flow_id": "flow-452d4970b88455525c982a81", "packets": 3276, "transport": "tcp", "last_frame": 14016, "first_frame": 6240, "initiator_ip": "10.2.23.231", "responder_ip": "46.249.62.199", "initiator_port": 49200, "responder_port": 80, "initiator_bytes": 57814, "last_seen_epoch": "1550950804.106598", "responder_bytes": 2938001, "first_seen_epoch": "1550950409.944361" }, { "bytes": 2682, "stream": 111, "flow_id": "flow-fb8192555736aa04df70804e", "packets": 14, "transport": "tcp", "last_frame": 7855, "first_frame": 6241, "initiator_ip": "10.2.23.231", "responder_ip": "185.246.116.239", "initiator_port": 49201, "responder_port": 443, "initiator_bytes": 855, "last_seen_epoch": "1550950496.287011", "responder_bytes": 1827, "first_seen_epoch": "1550950409.946378" }, { "bytes": 48166, "stream": 112, "flow_id": "flow-b0d15d729c472286856c6056", "packets": 74, "transport": "tcp", "last_frame": 7783, "first_frame": 6242, "initiator_ip": "10.2.23.231", "responder_ip": "185.246.116.239", "initiator_port": 49202, "responder_port": 443, "initiator_bytes": 2134, "last_seen_epoch": "1550950489.664536", "responder_bytes": 46032, "first_seen_epoch": "1550950409.946686" }, { "bytes": 257648, "stream": 113, "flow_id": "flow-5df57a2d23dbc1b9fc7c8115", "packets": 311, "transport": "tcp", "last_frame": 8375, "first_frame": 6243, "initiator_ip": "10.2.23.231", "responder_ip": "185.246.116.239", "initiator_port": 49203, "responder_port": 443, "initiator_bytes": 6400, "last_seen_epoch": "1550950543.83624", "responder_bytes": 251248, "first_seen_epoch": "1550950409.946877" }, { "bytes": 90901, "stream": 114, "flow_id": "flow-a92b40d3596354b94337fa2d", "packets": 110, "transport": "tcp", "last_frame": 8211, "first_frame": 6244, "initiator_ip": "10.2.23.231", "responder_ip": "185.246.116.239", "initiator_port": 49204, "responder_port": 443, "initiator_bytes": 2475, "last_seen_epoch": "1550950527.585923", "responder_bytes": 88426, "first_seen_epoch": "1550950409.947089" }, { "bytes": 147746, "stream": 115, "flow_id": "flow-12be19e8fab65f7389fb02e2", "packets": 183, "transport": "tcp", "last_frame": 8189, "first_frame": 6245, "initiator_ip": "10.2.23.231", "responder_ip": "185.246.116.239", "initiator_port": 49206, "responder_port": 443, "initiator_bytes": 4024, "last_seen_epoch": "1550950525.854691", "responder_bytes": 143722, "first_seen_epoch": "1550950409.947319" }, { "bytes": 99941, "stream": 116, "flow_id": "flow-345e3550cdd2789ac8a8865d", "packets": 130, "transport": "tcp", "last_frame": 7990, "first_frame": 6246, "initiator_ip": "10.2.23.231", "responder_ip": "185.246.116.239", "initiator_port": 49205, "responder_port": 443, "initiator_bytes": 3106, "last_seen_epoch": "1550950513.695298", "responder_bytes": 96835, "first_seen_epoch": "1550950409.947385" }, { "bytes": 248, "stream": 117, "flow_id": "flow-823d3691272c1b444cf769ed", "packets": 4, "transport": "tcp", "last_frame": 7979, "first_frame": 6803, "initiator_ip": "10.2.23.231", "responder_ip": "94.103.95.185", "initiator_port": 49207, "responder_port": 80, "initiator_bytes": 194, "last_seen_epoch": "1550950508.156999", "responder_bytes": 54, "first_seen_epoch": "1550950432.68218" }, { "bytes": 248, "stream": 118, "flow_id": "flow-bb9becacdbda36a55bfbb434", "packets": 4, "transport": "tcp", "last_frame": 8293, "first_frame": 7376, "initiator_ip": "10.2.23.231", "responder_ip": "94.103.95.185", "initiator_port": 49208, "responder_port": 80, "initiator_bytes": 194, "last_seen_epoch": "1550950534.108351", "responder_bytes": 54, "first_seen_epoch": "1550950458.706794" }, { "bytes": 160, "stream": 75, "flow_id": "flow-43debed8bfc832932d5b3996", "packets": 2, "transport": "udp", "last_frame": 7515, "first_frame": 7506, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 62933, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550950467.267304", "responder_bytes": 88, "first_seen_epoch": "1550950467.015679" }, { "bytes": 12464, "stream": 119, "flow_id": "flow-b8d84cd7acd38aeebb38cc55", "packets": 216, "transport": "tcp", "last_frame": 28867, "first_frame": 7516, "initiator_ip": "10.2.23.231", "responder_ip": "87.236.22.142", "initiator_port": 49209, "responder_port": 80, "initiator_bytes": 6338, "last_seen_epoch": "1550952547.403303", "responder_bytes": 6126, "first_seen_epoch": "1550950467.271204" }, { "bytes": 248, "stream": 120, "flow_id": "flow-5446531e667c8d8d4728246e", "packets": 4, "transport": "tcp", "last_frame": 8531, "first_frame": 7719, "initiator_ip": "10.2.23.231", "responder_ip": "94.103.95.185", "initiator_port": 49210, "responder_port": 80, "initiator_bytes": 194, "last_seen_epoch": "1550950560.093929", "responder_bytes": 54, "first_seen_epoch": "1550950484.728085" }, { "bytes": 248, "stream": 121, "flow_id": "flow-965555d40ba1706bf6f67700", "packets": 4, "transport": "tcp", "last_frame": 8818, "first_frame": 7984, "initiator_ip": "10.2.23.231", "responder_ip": "94.103.95.185", "initiator_port": 49211, "responder_port": 80, "initiator_bytes": 194, "last_seen_epoch": "1550950586.158415", "responder_bytes": 54, "first_seen_epoch": "1550950510.764112" }, { "bytes": 248, "stream": 122, "flow_id": "flow-fbde12831ef222ef7089e631", "packets": 4, "transport": "tcp", "last_frame": 9164, "first_frame": 8322, "initiator_ip": "10.2.23.231", "responder_ip": "94.103.95.185", "initiator_port": 49212, "responder_port": 80, "initiator_bytes": 194, "last_seen_epoch": "1550950612.158605", "responder_bytes": 54, "first_seen_epoch": "1550950536.769087" }, { "bytes": 248, "stream": 123, "flow_id": "flow-0bc100af39509530fe094de6", "packets": 4, "transport": "tcp", "last_frame": 9524, "first_frame": 8557, "initiator_ip": "10.2.23.231", "responder_ip": "94.103.95.185", "initiator_port": 49213, "responder_port": 80, "initiator_bytes": 194, "last_seen_epoch": "1550950638.219156", "responder_bytes": 54, "first_seen_epoch": "1550950562.806299" }, { "bytes": 248, "stream": 124, "flow_id": "flow-a7785d67d5c243d22d3e3e1f", "packets": 4, "transport": "tcp", "last_frame": 9858, "first_frame": 8845, "initiator_ip": "10.2.23.231", "responder_ip": "94.103.95.185", "initiator_port": 49214, "responder_port": 80, "initiator_bytes": 194, "last_seen_epoch": "1550950664.242728", "responder_bytes": 54, "first_seen_epoch": "1550950588.843777" }, { "bytes": 248, "stream": 125, "flow_id": "flow-626b47cbba939c1902ff12bd", "packets": 4, "transport": "tcp", "last_frame": 10175, "first_frame": 9215, "initiator_ip": "10.2.23.231", "responder_ip": "94.103.95.185", "initiator_port": 49215, "responder_port": 80, "initiator_bytes": 194, "last_seen_epoch": "1550950690.238912", "responder_bytes": 54, "first_seen_epoch": "1550950614.863579" }, { "bytes": 2592, "stream": 76, "flow_id": "flow-e1b5823f8306a8489aef24c2", "packets": 12, "transport": "udp", "last_frame": 24679, "first_frame": 10278, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.255", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 2592, "last_seen_epoch": "1550951416.036797", "responder_bytes": 0, "first_seen_epoch": "1550950700.919313" }, { "bytes": 208, "stream": 77, "flow_id": "flow-41ac8aade92a6c8bf80753e1", "packets": 2, "transport": "udp", "last_frame": 23972, "first_frame": 10323, "initiator_ip": "10.2.23.2", "responder_ip": "10.2.23.231", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 208, "last_seen_epoch": "1550951408.549229", "responder_bytes": 0, "first_seen_epoch": "1550950705.483289" }, { "bytes": 2592, "stream": 78, "flow_id": "flow-7118775e0f65e62772bcb6ab", "packets": 12, "transport": "udp", "last_frame": 24680, "first_frame": 10324, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 2592, "last_seen_epoch": "1550951416.036967", "responder_bytes": 0, "first_seen_epoch": "1550950705.484266" }, { "bytes": 160, "stream": 79, "flow_id": "flow-45d35d725bcd6b2bae8d6ae2", "packets": 2, "transport": "udp", "last_frame": 10363, "first_frame": 10362, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 58525, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550950709.946337", "responder_bytes": 88, "first_seen_epoch": "1550950709.945992" }, { "bytes": 2716, "stream": 126, "flow_id": "flow-c24174988e3d9626252570dc", "packets": 19, "transport": "tcp", "last_frame": 13246, "first_frame": 10364, "initiator_ip": "10.2.23.231", "responder_ip": "87.236.22.142", "initiator_port": 49216, "responder_port": 443, "initiator_bytes": 1078, "last_seen_epoch": "1550950786.21845", "responder_bytes": 1638, "first_seen_epoch": "1550950709.947414" }, { "bytes": 323, "stream": 80, "flow_id": "flow-a5af5d1a0b1c5c0c7549beba", "packets": 2, "transport": "udp", "last_frame": 10389, "first_frame": 10388, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 52279, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1550950710.839666", "responder_bytes": 195, "first_seen_epoch": "1550950710.838951" }, { "bytes": 417, "stream": 81, "flow_id": "flow-0582587f62430ef74c7a6e6b", "packets": 2, "transport": "udp", "last_frame": 10391, "first_frame": 10390, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 52280, "responder_port": 389, "initiator_bytes": 180, "last_seen_epoch": "1550950710.840773", "responder_bytes": 237, "first_seen_epoch": "1550950710.840541" }, { "bytes": 274008, "stream": 127, "flow_id": "flow-0491a2f9db32ec6f43876a4e", "packets": 224, "transport": "tcp", "last_frame": 11102, "first_frame": 10397, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49217, "responder_port": 3268, "initiator_bytes": 5147, "last_seen_epoch": "1550950716.106747", "responder_bytes": 268861, "first_seen_epoch": "1550950710.952591" }, { "bytes": 198, "stream": 82, "flow_id": "flow-d422143fbc75aa7c693d6ee5", "packets": 2, "transport": "udp", "last_frame": 10622, "first_frame": 10621, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 60662, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1550950711.062834", "responder_bytes": 107, "first_seen_epoch": "1550950711.062623" }, { "bytes": 72312, "stream": 128, "flow_id": "flow-0b296ca075bc8462841af0e0", "packets": 86, "transport": "tcp", "last_frame": 10954, "first_frame": 10623, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49218, "responder_port": 445, "initiator_bytes": 70132, "last_seen_epoch": "1550950711.096682", "responder_bytes": 2180, "first_seen_epoch": "1550950711.063292" }, { "bytes": 642, "stream": 129, "flow_id": "flow-3579ffd7df52aabc76bb9469", "packets": 9, "transport": "tcp", "last_frame": 10953, "first_frame": 10635, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49219, "responder_port": 135, "initiator_bytes": 354, "last_seen_epoch": "1550950711.096614", "responder_bytes": 288, "first_seen_epoch": "1550950711.065706" }, { "bytes": 1154, "stream": 130, "flow_id": "flow-16e9f91e50f9cb04566b1ce8", "packets": 10, "transport": "tcp", "last_frame": 10772, "first_frame": 10704, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49220, "responder_port": 445, "initiator_bytes": 418, "last_seen_epoch": "1550950711.085407", "responder_bytes": 736, "first_seen_epoch": "1550950711.069376" }, { "bytes": 4158, "stream": 131, "flow_id": "flow-278b35773e7f5ad1bbbb3661", "packets": 12, "transport": "tcp", "last_frame": 10932, "first_frame": 10711, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49221, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.095017", "responder_bytes": 282, "first_seen_epoch": "1550950711.07126" }, { "bytes": 4158, "stream": 132, "flow_id": "flow-b53d668a236e9adbc8fd257f", "packets": 12, "transport": "tcp", "last_frame": 10936, "first_frame": 10715, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49222, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.095223", "responder_bytes": 282, "first_seen_epoch": "1550950711.072099" }, { "bytes": 4158, "stream": 133, "flow_id": "flow-94b78badafc9ca0317ab5433", "packets": 12, "transport": "tcp", "last_frame": 10937, "first_frame": 10719, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49223, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.095297", "responder_bytes": 282, "first_seen_epoch": "1550950711.072938" }, { "bytes": 4158, "stream": 134, "flow_id": "flow-438d441fe96c3588c9b9b164", "packets": 12, "transport": "tcp", "last_frame": 10938, "first_frame": 10723, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49224, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.095363", "responder_bytes": 282, "first_seen_epoch": "1550950711.073651" }, { "bytes": 4158, "stream": 135, "flow_id": "flow-beaadf1f7d820785a7193194", "packets": 12, "transport": "tcp", "last_frame": 10939, "first_frame": 10727, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49225, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.095432", "responder_bytes": 282, "first_seen_epoch": "1550950711.074421" }, { "bytes": 4158, "stream": 136, "flow_id": "flow-057f930e836dfb2dc7da1fb0", "packets": 12, "transport": "tcp", "last_frame": 10940, "first_frame": 10731, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49226, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.095494", "responder_bytes": 282, "first_seen_epoch": "1550950711.075108" }, { "bytes": 4158, "stream": 137, "flow_id": "flow-3996d5490c87bfaf7cee1a74", "packets": 12, "transport": "tcp", "last_frame": 10941, "first_frame": 10735, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49227, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.095561", "responder_bytes": 282, "first_seen_epoch": "1550950711.076322" }, { "bytes": 4158, "stream": 138, "flow_id": "flow-60a75a21798fe742d85298cd", "packets": 12, "transport": "tcp", "last_frame": 10942, "first_frame": 10739, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49228, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.095623", "responder_bytes": 282, "first_seen_epoch": "1550950711.077293" }, { "bytes": 4158, "stream": 139, "flow_id": "flow-08476e90017e221ebb17608c", "packets": 12, "transport": "tcp", "last_frame": 10943, "first_frame": 10743, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49229, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.09574", "responder_bytes": 282, "first_seen_epoch": "1550950711.078032" }, { "bytes": 4158, "stream": 140, "flow_id": "flow-70d8eea6428753484ac4a822", "packets": 12, "transport": "tcp", "last_frame": 10944, "first_frame": 10747, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49230, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.095841", "responder_bytes": 282, "first_seen_epoch": "1550950711.078876" }, { "bytes": 4158, "stream": 141, "flow_id": "flow-8180c21f2f48a795375bdde4", "packets": 12, "transport": "tcp", "last_frame": 10945, "first_frame": 10751, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49231, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.095985", "responder_bytes": 282, "first_seen_epoch": "1550950711.079569" }, { "bytes": 4158, "stream": 142, "flow_id": "flow-1858bb170a5db682f392a42f", "packets": 12, "transport": "tcp", "last_frame": 10946, "first_frame": 10755, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49232, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.096043", "responder_bytes": 282, "first_seen_epoch": "1550950711.080062" }, { "bytes": 4158, "stream": 143, "flow_id": "flow-bc856e681559454a8321e06d", "packets": 12, "transport": "tcp", "last_frame": 10947, "first_frame": 10759, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49233, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.096111", "responder_bytes": 282, "first_seen_epoch": "1550950711.081621" }, { "bytes": 1054, "stream": 144, "flow_id": "flow-5bdb91502c17e983dac3ca6a", "packets": 10, "transport": "tcp", "last_frame": 10799, "first_frame": 10763, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49234, "responder_port": 445, "initiator_bytes": 418, "last_seen_epoch": "1550950711.088668", "responder_bytes": 636, "first_seen_epoch": "1550950711.083611" }, { "bytes": 4158, "stream": 145, "flow_id": "flow-651f938e32f46fe50868b5fa", "packets": 12, "transport": "tcp", "last_frame": 10925, "first_frame": 10773, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49235, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.09469", "responder_bytes": 282, "first_seen_epoch": "1550950711.085421" }, { "bytes": 4158, "stream": 146, "flow_id": "flow-899f35daf03ce65950111528", "packets": 12, "transport": "tcp", "last_frame": 10948, "first_frame": 10777, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49236, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.096223", "responder_bytes": 282, "first_seen_epoch": "1550950711.085903" }, { "bytes": 4158, "stream": 147, "flow_id": "flow-75f6a078d351e7945ffb8a52", "packets": 12, "transport": "tcp", "last_frame": 10949, "first_frame": 10781, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49237, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.096285", "responder_bytes": 282, "first_seen_epoch": "1550950711.086408" }, { "bytes": 4158, "stream": 148, "flow_id": "flow-80b164743e6f2607c83277a8", "packets": 12, "transport": "tcp", "last_frame": 10950, "first_frame": 10785, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49238, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.096337", "responder_bytes": 282, "first_seen_epoch": "1550950711.087041" }, { "bytes": 4158, "stream": 149, "flow_id": "flow-2b940159e92cff44b9b37307", "packets": 12, "transport": "tcp", "last_frame": 10951, "first_frame": 10789, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49239, "responder_port": 445, "initiator_bytes": 3876, "last_seen_epoch": "1550950711.096385", "responder_bytes": 282, "first_seen_epoch": "1550950711.087545" }, { "bytes": 196, "stream": 83, "flow_id": "flow-39319c77951ff206c736d9ed", "packets": 2, "transport": "udp", "last_frame": 10956, "first_frame": 10955, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 64990, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1550950711.107122", "responder_bytes": 106, "first_seen_epoch": "1550950711.105255" }, { "bytes": 287943, "stream": 150, "flow_id": "flow-b900a0c28a728e47d573e634", "packets": 320, "transport": "tcp", "last_frame": 15247, "first_frame": 10957, "initiator_ip": "10.2.23.231", "responder_ip": "85.143.218.7", "initiator_port": 49262, "responder_port": 80, "initiator_bytes": 5805, "last_seen_epoch": "1550950829.160035", "responder_bytes": 282138, "first_seen_epoch": "1550950711.10767" }, { "bytes": 132, "stream": 151, "flow_id": "flow-87bdfcab2dd7996ec7e1d04c", "packets": 2, "transport": "tcp", "last_frame": 11060, "first_frame": 10958, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.109", "initiator_port": 49263, "responder_port": 445, "initiator_bytes": 132, "last_seen_epoch": "1550950714.109132", "responder_bytes": 0, "first_seen_epoch": "1550950711.109321" }, { "bytes": 976894, "stream": 152, "flow_id": "flow-3e76a793cd847e0c30c45579", "packets": 1130, "transport": "tcp", "last_frame": 21113, "first_frame": 10983, "initiator_ip": "10.2.23.231", "responder_ip": "87.236.22.142", "initiator_port": 49265, "responder_port": 443, "initiator_bytes": 21881, "last_seen_epoch": "1550951011.181444", "responder_bytes": 955013, "first_seen_epoch": "1550950712.015728" }, { "bytes": 978365, "stream": 153, "flow_id": "flow-95693437fe1d6d140c3c4b52", "packets": 1147, "transport": "tcp", "last_frame": 20990, "first_frame": 10984, "initiator_ip": "10.2.23.231", "responder_ip": "87.236.22.142", "initiator_port": 49264, "responder_port": 443, "initiator_bytes": 22880, "last_seen_epoch": "1550950997.582959", "responder_bytes": 955485, "first_seen_epoch": "1550950712.015814" }, { "bytes": 976247, "stream": 154, "flow_id": "flow-f1c16bfa81325166cfdbe17e", "packets": 1127, "transport": "tcp", "last_frame": 21111, "first_frame": 10985, "initiator_ip": "10.2.23.231", "responder_ip": "87.236.22.142", "initiator_port": 49266, "responder_port": 443, "initiator_bytes": 21200, "last_seen_epoch": "1550951011.087909", "responder_bytes": 955047, "first_seen_epoch": "1550950712.016031" }, { "bytes": 9142, "stream": 155, "flow_id": "flow-14175a155d246e904db1bf61", "packets": 29, "transport": "tcp", "last_frame": 11335, "first_frame": 11263, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49267, "responder_port": 389, "initiator_bytes": 4419, "last_seen_epoch": "1550950724.819573", "responder_bytes": 4723, "first_seen_epoch": "1550950724.594527" }, { "bytes": 3972, "stream": 156, "flow_id": "flow-ed630a886f5d0f69c3e63e37", "packets": 12, "transport": "tcp", "last_frame": 11281, "first_frame": 11270, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49268, "responder_port": 88, "initiator_bytes": 1996, "last_seen_epoch": "1550950724.599321", "responder_bytes": 1976, "first_seen_epoch": "1550950724.597287" }, { "bytes": 333, "stream": 84, "flow_id": "flow-0e48db11dd6461eaacc5c61c", "packets": 2, "transport": "udp", "last_frame": 11291, "first_frame": 11290, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 53732, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1550950724.603463", "responder_bytes": 200, "first_seen_epoch": "1550950724.603184" }, { "bytes": 438, "stream": 85, "flow_id": "flow-96720b6dc27069bdeb14634a", "packets": 2, "transport": "udp", "last_frame": 11293, "first_frame": 11292, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 53733, "responder_port": 389, "initiator_bytes": 194, "last_seen_epoch": "1550950724.60531", "responder_bytes": 244, "first_seen_epoch": "1550950724.604973" }, { "bytes": 348, "stream": 157, "flow_id": "flow-7d1dabf9904358d057b53779", "packets": 6, "transport": "tcp", "last_frame": 11300, "first_frame": 11294, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49269, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1550950724.704724", "responder_bytes": 174, "first_seen_epoch": "1550950724.703483" }, { "bytes": 333, "stream": 86, "flow_id": "flow-64c134d74dc2f1225d526d45", "packets": 2, "transport": "udp", "last_frame": 11303, "first_frame": 11302, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49756, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1550950724.706232", "responder_bytes": 200, "first_seen_epoch": "1550950724.706" }, { "bytes": 438, "stream": 87, "flow_id": "flow-d58557caeba942ea1e08f008", "packets": 2, "transport": "udp", "last_frame": 11305, "first_frame": 11304, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49757, "responder_port": 389, "initiator_bytes": 194, "last_seen_epoch": "1550950724.707427", "responder_bytes": 244, "first_seen_epoch": "1550950724.707194" }, { "bytes": 348, "stream": 158, "flow_id": "flow-f522a523e4fd0764b9458aa0", "packets": 6, "transport": "tcp", "last_frame": 11312, "first_frame": 11306, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49270, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1550950724.813446", "responder_bytes": 174, "first_seen_epoch": "1550950724.812257" }, { "bytes": 348, "stream": 159, "flow_id": "flow-e417913711d0d6420d57452d", "packets": 6, "transport": "tcp", "last_frame": 11320, "first_frame": 11314, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49271, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1550950724.81582", "responder_bytes": 174, "first_seen_epoch": "1550950724.814481" }, { "bytes": 348, "stream": 160, "flow_id": "flow-7f3f46bdcaf9257fe3792dd7", "packets": 6, "transport": "tcp", "last_frame": 11328, "first_frame": 11322, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49272, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1550950724.817989", "responder_bytes": 174, "first_seen_epoch": "1550950724.816947" }, { "bytes": 288180, "stream": 161, "flow_id": "flow-617880cc34a5ce6e5f530fbe", "packets": 323, "transport": "tcp", "last_frame": 16170, "first_frame": 11980, "initiator_ip": "10.2.23.231", "responder_ip": "85.143.218.7", "initiator_port": 49273, "responder_port": 80, "initiator_bytes": 6042, "last_seen_epoch": "1550950850.094787", "responder_bytes": 282138, "first_seen_epoch": "1550950744.257683" }, { "bytes": 9104, "stream": 162, "flow_id": "flow-94ea6da29c5f9b423ce8de83", "packets": 29, "transport": "tcp", "last_frame": 12496, "first_frame": 12417, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49224, "responder_port": 389, "initiator_bytes": 4387, "last_seen_epoch": "1550950760.273685", "responder_bytes": 4717, "first_seen_epoch": "1550950760.043338" }, { "bytes": 3932, "stream": 163, "flow_id": "flow-f32216408775895c6ed339b8", "packets": 12, "transport": "tcp", "last_frame": 12435, "first_frame": 12424, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49225, "responder_port": 88, "initiator_bytes": 1976, "last_seen_epoch": "1550950760.048467", "responder_bytes": 1956, "first_seen_epoch": "1550950760.045415" }, { "bytes": 333, "stream": 88, "flow_id": "flow-ef54401523c1397da5df22dc", "packets": 2, "transport": "udp", "last_frame": 12445, "first_frame": 12444, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 51672, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1550950760.05275", "responder_bytes": 200, "first_seen_epoch": "1550950760.052491" }, { "bytes": 436, "stream": 89, "flow_id": "flow-b8d732ab23b6c4763464b63f", "packets": 2, "transport": "udp", "last_frame": 12447, "first_frame": 12446, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 51673, "responder_port": 389, "initiator_bytes": 192, "last_seen_epoch": "1550950760.053653", "responder_bytes": 244, "first_seen_epoch": "1550950760.053348" }, { "bytes": 348, "stream": 164, "flow_id": "flow-498f656e25d3bfb531b172bd", "packets": 6, "transport": "tcp", "last_frame": 12455, "first_frame": 12449, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49226, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1550950760.158919", "responder_bytes": 174, "first_seen_epoch": "1550950760.152027" }, { "bytes": 333, "stream": 90, "flow_id": "flow-46f68aff00adc00f28bf42ba", "packets": 2, "transport": "udp", "last_frame": 12458, "first_frame": 12457, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 62212, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1550950760.159942", "responder_bytes": 200, "first_seen_epoch": "1550950760.159727" }, { "bytes": 436, "stream": 91, "flow_id": "flow-7097e2004ecbfa3d4c1aab2c", "packets": 2, "transport": "udp", "last_frame": 12460, "first_frame": 12459, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 62213, "responder_port": 389, "initiator_bytes": 192, "last_seen_epoch": "1550950760.161005", "responder_bytes": 244, "first_seen_epoch": "1550950760.160756" }, { "bytes": 348, "stream": 165, "flow_id": "flow-2a5542d08d911246efc9abfc", "packets": 6, "transport": "tcp", "last_frame": 12473, "first_frame": 12467, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49227, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1550950760.261056", "responder_bytes": 174, "first_seen_epoch": "1550950760.260006" }, { "bytes": 348, "stream": 166, "flow_id": "flow-e202f08f4c662ea37f84cc16", "packets": 6, "transport": "tcp", "last_frame": 12481, "first_frame": 12475, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49228, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1550950760.267887", "responder_bytes": 174, "first_seen_epoch": "1550950760.262182" }, { "bytes": 348, "stream": 167, "flow_id": "flow-c0b56ec0ef8bbecfe2b13682", "packets": 6, "transport": "tcp", "last_frame": 12489, "first_frame": 12483, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49229, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1550950760.271546", "responder_bytes": 174, "first_seen_epoch": "1550950760.269667" }, { "bytes": 496, "stream": 92, "flow_id": "flow-6ad1a25178be2da92dfa9ccb", "packets": 2, "transport": "udp", "last_frame": 12946, "first_frame": 12945, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49758, "responder_port": 389, "initiator_bytes": 259, "last_seen_epoch": "1550950776.104879", "responder_bytes": 237, "first_seen_epoch": "1550950776.104552" }, { "bytes": 440, "stream": 93, "flow_id": "flow-6bbe1d5feee901c78d1d3fe2", "packets": 4, "transport": "udp", "last_frame": 28396, "first_frame": 12949, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 220, "last_seen_epoch": "1550951800.223143", "responder_bytes": 220, "first_seen_epoch": "1550950776.216811" }, { "bytes": 248, "stream": 168, "flow_id": "flow-648bc0c94e5144b457348b8b", "packets": 4, "transport": "tcp", "last_frame": 16934, "first_frame": 13260, "initiator_ip": "10.2.23.231", "responder_ip": "92.223.105.176", "initiator_port": 49274, "responder_port": 443, "initiator_bytes": 194, "last_seen_epoch": "1550950862.103402", "responder_bytes": 54, "first_seen_epoch": "1550950786.590862" }, { "bytes": 6386, "stream": 169, "flow_id": "flow-bc47a379946c1aebb9400996", "packets": 22, "transport": "tcp", "last_frame": 13978, "first_frame": 13328, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49275, "responder_port": 445, "initiator_bytes": 4674, "last_seen_epoch": "1550950801.51778", "responder_bytes": 1712, "first_seen_epoch": "1550950789.14012" }, { "bytes": 120, "stream": 170, "flow_id": "flow-94564e35fa69a9c8b4cff3e0", "packets": 2, "transport": "tcp", "last_frame": 13358, "first_frame": 13357, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.1", "initiator_port": 49277, "responder_port": 445, "initiator_bytes": 66, "last_seen_epoch": "1550950790.097117", "responder_bytes": 54, "first_seen_epoch": "1550950790.097037" }, { "bytes": 348, "stream": 171, "flow_id": "flow-c46e399ecef45e04cfe2e5ce", "packets": 6, "transport": "tcp", "last_frame": 13364, "first_frame": 13359, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49278, "responder_port": 445, "initiator_bytes": 174, "last_seen_epoch": "1550950790.098218", "responder_bytes": 174, "first_seen_epoch": "1550950790.097508" }, { "bytes": 53868, "stream": 172, "flow_id": "flow-2bdddd51dae6cbf432de52a9", "packets": 206, "transport": "tcp", "last_frame": 13654, "first_frame": 13365, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49280, "responder_port": 445, "initiator_bytes": 30706, "last_seen_epoch": "1550950795.345862", "responder_bytes": 23162, "first_seen_epoch": "1550950790.100382" }, { "bytes": 66, "stream": 173, "flow_id": "flow-d5d7f713cb72c0a98884bee9", "packets": 1, "transport": "tcp", "last_frame": 13396, "first_frame": 13396, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.109", "initiator_port": 49377, "responder_port": 445, "initiator_bytes": 66, "last_seen_epoch": "1550950790.145993", "responder_bytes": 0, "first_seen_epoch": "1550950790.145993" }, { "bytes": 66, "stream": 174, "flow_id": "flow-635dec65215950d3db3d6f05", "packets": 1, "transport": "tcp", "last_frame": 13398, "first_frame": 13398, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.254", "initiator_port": 49534, "responder_port": 445, "initiator_bytes": 66, "last_seen_epoch": "1550950790.215978", "responder_bytes": 0, "first_seen_epoch": "1550950790.215978" }, { "bytes": 120, "stream": 175, "flow_id": "flow-54db1237f8d1b24f03d6ef0e", "packets": 2, "transport": "tcp", "last_frame": 13520, "first_frame": 13519, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.1", "initiator_port": 49277, "responder_port": 445, "initiator_bytes": 66, "last_seen_epoch": "1550950790.61213", "responder_bytes": 54, "first_seen_epoch": "1550950790.61205" }, { "bytes": 79933, "stream": 176, "flow_id": "flow-498720e188b238ef2d32d3ba", "packets": 334, "transport": "tcp", "last_frame": 14121, "first_frame": 13655, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49536, "responder_port": 445, "initiator_bytes": 46900, "last_seen_epoch": "1550950805.578651", "responder_bytes": 33033, "first_seen_epoch": "1550950795.34626" }, { "bytes": 105322, "stream": 177, "flow_id": "flow-db3487ca708f0b81f5936248", "packets": 449, "transport": "tcp", "last_frame": 14738, "first_frame": 14122, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49537, "responder_port": 445, "initiator_bytes": 62594, "last_seen_epoch": "1550950820.820292", "responder_bytes": 42728, "first_seen_epoch": "1550950805.578843" }, { "bytes": 2671, "stream": 178, "flow_id": "flow-cc9655a90e470c82330d45e1", "packets": 19, "transport": "tcp", "last_frame": 14759, "first_frame": 14739, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49538, "responder_port": 445, "initiator_bytes": 1232, "last_seen_epoch": "1550950820.823196", "responder_bytes": 1439, "first_seen_epoch": "1550950820.820501" }, { "bytes": 28549, "stream": 179, "flow_id": "flow-d0794e82a1d7960540419ac3", "packets": 90, "transport": "tcp", "last_frame": 14853, "first_frame": 14757, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49539, "responder_port": 445, "initiator_bytes": 14892, "last_seen_epoch": "1550950821.037291", "responder_bytes": 13657, "first_seen_epoch": "1550950820.823082" }, { "bytes": 141027, "stream": 180, "flow_id": "flow-0a72f6ee1c80e7ca74206a31", "packets": 633, "transport": "tcp", "last_frame": 15967, "first_frame": 14854, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49540, "responder_port": 445, "initiator_bytes": 85997, "last_seen_epoch": "1550950846.29157", "responder_bytes": 55030, "first_seen_epoch": "1550950821.03753" }, { "bytes": 240, "stream": 94, "flow_id": "flow-3f1808ae02f18d969df2000a", "packets": 2, "transport": "udp", "last_frame": 15022, "first_frame": 15021, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 65138, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1550950823.597365", "responder_bytes": 159, "first_seen_epoch": "1550950823.596888" }, { "bytes": 152, "stream": 95, "flow_id": "flow-9a2d6944acb8b8410ef06131", "packets": 2, "transport": "udp", "last_frame": 15024, "first_frame": 15023, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 62461, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550950823.662806", "responder_bytes": 76, "first_seen_epoch": "1550950823.597824" }, { "bytes": 128, "stream": 96, "flow_id": "flow-9a73522e38c11fd0b6137ee4", "packets": 2, "transport": "udp", "last_frame": 15026, "first_frame": 15025, "initiator_ip": "10.2.23.109", "responder_ip": "224.0.0.252", "initiator_port": 61155, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1550950823.769319", "responder_bytes": 0, "first_seen_epoch": "1550950823.663417" }, { "bytes": 6346, "stream": 181, "flow_id": "flow-dccdc293037f1a54e88f4198", "packets": 22, "transport": "tcp", "last_frame": 15638, "first_frame": 15056, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49230, "responder_port": 445, "initiator_bytes": 4634, "last_seen_epoch": "1550950836.825417", "responder_bytes": 1712, "first_seen_epoch": "1550950825.335481" }, { "bytes": 462, "stream": 97, "flow_id": "flow-45f021c784187a8d13151c44", "packets": 6, "transport": "udp", "last_frame": 15656, "first_frame": 15210, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 50377, "responder_port": 53, "initiator_bytes": 385, "last_seen_epoch": "1550950837.917035", "responder_bytes": 77, "first_seen_epoch": "1550950826.266512" }, { "bytes": 248, "stream": 182, "flow_id": "flow-93fe2628b510662598312cc5", "packets": 4, "transport": "tcp", "last_frame": 18784, "first_frame": 15238, "initiator_ip": "10.2.23.231", "responder_ip": "92.223.105.176", "initiator_port": 49541, "responder_port": 443, "initiator_bytes": 194, "last_seen_epoch": "1550950904.184512", "responder_bytes": 54, "first_seen_epoch": "1550950828.646029" }, { "bytes": 79336, "stream": 183, "flow_id": "flow-920f21ca5104477eaa6f3c29", "packets": 322, "transport": "tcp", "last_frame": 16513, "first_frame": 15965, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49542, "responder_port": 445, "initiator_bytes": 46642, "last_seen_epoch": "1550950856.527579", "responder_bytes": 32694, "first_seen_epoch": "1550950846.291203" }, { "bytes": 253, "stream": 98, "flow_id": "flow-4b13fca93bb688d4c871e844", "packets": 2, "transport": "udp", "last_frame": 16108, "first_frame": 15999, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 63007, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1550950846.527507", "responder_bytes": 176, "first_seen_epoch": "1550950846.470491" }, { "bytes": 1485, "stream": 184, "flow_id": "flow-ae4d6b97014a3e229dc5c8c4", "packets": 7, "transport": "tcp", "last_frame": 16116, "first_frame": 16109, "initiator_ip": "10.2.23.109", "responder_ip": "23.218.156.17", "initiator_port": 49231, "responder_port": 80, "initiator_bytes": 371, "last_seen_epoch": "1550950846.730084", "responder_bytes": 1114, "first_seen_epoch": "1550950846.531226" }, { "bytes": 2671, "stream": 185, "flow_id": "flow-a4fb1853fa18f9a92628ffcc", "packets": 19, "transport": "tcp", "last_frame": 16534, "first_frame": 16514, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49543, "responder_port": 445, "initiator_bytes": 1232, "last_seen_epoch": "1550950856.530587", "responder_bytes": 1439, "first_seen_epoch": "1550950856.52788" }, { "bytes": 79659, "stream": 186, "flow_id": "flow-62d2e4d8211ee4b1234589db", "packets": 332, "transport": "tcp", "last_frame": 17112, "first_frame": 16532, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49544, "responder_port": 445, "initiator_bytes": 46866, "last_seen_epoch": "1550950866.761456", "responder_bytes": 32793, "first_seen_epoch": "1550950856.530401" }, { "bytes": 28742, "stream": 187, "flow_id": "flow-cb427b1dcfcfe1839773b4a9", "packets": 92, "transport": "tcp", "last_frame": 17209, "first_frame": 17110, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49545, "responder_port": 445, "initiator_bytes": 14950, "last_seen_epoch": "1550950866.978902", "responder_bytes": 13792, "first_seen_epoch": "1550950866.761236" }, { "bytes": 144168, "stream": 188, "flow_id": "flow-5f89b4c17ab0443a5c3df112", "packets": 607, "transport": "tcp", "last_frame": 18258, "first_frame": 17210, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49546, "responder_port": 445, "initiator_bytes": 85643, "last_seen_epoch": "1550950892.233287", "responder_bytes": 58525, "first_seen_epoch": "1550950866.979201" }, { "bytes": 248, "stream": 189, "flow_id": "flow-b1d8f66cd616fd4c0cac63a0", "packets": 4, "transport": "tcp", "last_frame": 20232, "first_frame": 17415, "initiator_ip": "10.2.23.231", "responder_ip": "92.223.105.176", "initiator_port": 49547, "responder_port": 443, "initiator_bytes": 194, "last_seen_epoch": "1550950946.101085", "responder_bytes": 54, "first_seen_epoch": "1550950870.702783" }, { "bytes": 2714, "stream": 190, "flow_id": "flow-050fff7a47b57a47594d84c9", "packets": 19, "transport": "tcp", "last_frame": 18274, "first_frame": 18255, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49548, "responder_port": 445, "initiator_bytes": 1286, "last_seen_epoch": "1550950892.23618", "responder_bytes": 1428, "first_seen_epoch": "1550950892.232833" }, { "bytes": 140571, "stream": 191, "flow_id": "flow-a1ea38f5839a4c84afb3d6b0", "packets": 625, "transport": "tcp", "last_frame": 19134, "first_frame": 18275, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49549, "responder_port": 445, "initiator_bytes": 86081, "last_seen_epoch": "1550950917.488427", "responder_bytes": 54490, "first_seen_epoch": "1550950892.236378" }, { "bytes": 34215, "stream": 192, "flow_id": "flow-fa08ab345e99fef454448f26", "packets": 74, "transport": "tcp", "last_frame": 21169, "first_frame": 19092, "initiator_ip": "10.2.23.231", "responder_ip": "213.226.68.112", "initiator_port": 49550, "responder_port": 443, "initiator_bytes": 28470, "last_seen_epoch": "1550951016.65522", "responder_bytes": 5745, "first_seen_epoch": "1550950913.743458" }, { "bytes": 240, "stream": 99, "flow_id": "flow-f7e60da3d9dd213e00830938", "packets": 2, "transport": "udp", "last_frame": 19106, "first_frame": 19105, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49944, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1550950915.53064", "responder_bytes": 159, "first_seen_epoch": "1550950915.530407" }, { "bytes": 152, "stream": 100, "flow_id": "flow-9cfd9c91e1ae1cd034700fa7", "packets": 2, "transport": "udp", "last_frame": 19114, "first_frame": 19107, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 63983, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1550950915.620746", "responder_bytes": 76, "first_seen_epoch": "1550950915.530943" }, { "bytes": 128, "stream": 101, "flow_id": "flow-d03c1a354af5c2dbbee37322", "packets": 2, "transport": "udp", "last_frame": 19116, "first_frame": 19115, "initiator_ip": "10.2.23.231", "responder_ip": "224.0.0.252", "initiator_port": 62716, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1550950915.724998", "responder_bytes": 0, "first_seen_epoch": "1550950915.621296" }, { "bytes": 28742, "stream": 193, "flow_id": "flow-fc62d58838d96f6c5957787c", "packets": 92, "transport": "tcp", "last_frame": 19230, "first_frame": 19132, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49551, "responder_port": 445, "initiator_bytes": 14950, "last_seen_epoch": "1550950917.695109", "responder_bytes": 13792, "first_seen_epoch": "1550950917.488203" }, { "bytes": 130466, "stream": 194, "flow_id": "flow-b699da840778a85e5905d4c6", "packets": 562, "transport": "tcp", "last_frame": 20074, "first_frame": 19231, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49552, "responder_port": 445, "initiator_bytes": 78492, "last_seen_epoch": "1550950937.944187", "responder_bytes": 51974, "first_seen_epoch": "1550950917.695363" }, { "bytes": 389, "stream": 102, "flow_id": "flow-0aa921c4fae345895cab959b", "packets": 2, "transport": "udp", "last_frame": 19574, "first_frame": 19573, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 53747, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1550950925.250935", "responder_bytes": 299, "first_seen_epoch": "1550950925.10121" }, { "bytes": 61104, "stream": 195, "flow_id": "flow-3590b57c2435fa141c2206f8", "packets": 72, "transport": "tcp", "last_frame": 21243, "first_frame": 19575, "initiator_ip": "10.2.23.231", "responder_ip": "72.21.81.240", "initiator_port": 49553, "responder_port": 80, "initiator_bytes": 1664, "last_seen_epoch": "1550951026.594464", "responder_bytes": 59440, "first_seen_epoch": "1550950925.254057" }, { "bytes": 204, "stream": 103, "flow_id": "flow-58936efaff107bf9f5e5c76f", "packets": 2, "transport": "udp", "last_frame": 19781, "first_frame": 19780, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 54176, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1550950931.792794", "responder_bytes": 134, "first_seen_epoch": "1550950931.732645" }, { "bytes": 1031, "stream": 196, "flow_id": "flow-cafcde0faff5dae87ac57c67", "packets": 8, "transport": "tcp", "last_frame": 21242, "first_frame": 19782, "initiator_ip": "10.2.23.231", "responder_ip": "216.239.32.21", "initiator_port": 49554, "responder_port": 80, "initiator_bytes": 473, "last_seen_epoch": "1550951026.594357", "responder_bytes": 558, "first_seen_epoch": "1550950931.794103" }, { "bytes": 4800, "stream": 197, "flow_id": "flow-edd9e7de951bca43bd3b0027", "packets": 17, "transport": "tcp", "last_frame": 21244, "first_frame": 19798, "initiator_ip": "10.2.23.231", "responder_ip": "216.239.32.21", "initiator_port": 49555, "responder_port": 443, "initiator_bytes": 921, "last_seen_epoch": "1550951026.594527", "responder_bytes": 3879, "first_seen_epoch": "1550950932.271558" }, { "bytes": 2521872, "stream": 198, "flow_id": "flow-0303786dcbc13839bc78c238", "packets": 2771, "transport": "tcp", "last_frame": 23839, "first_frame": 19954, "initiator_ip": "10.2.23.231", "responder_ip": "195.123.246.99", "initiator_port": 49556, "responder_port": 447, "initiator_bytes": 49967, "last_seen_epoch": "1550951365.566885", "responder_bytes": 2471905, "first_seen_epoch": "1550950935.332375" }, { "bytes": 2768, "stream": 199, "flow_id": "flow-885427a42a3d93f3739063d0", "packets": 20, "transport": "tcp", "last_frame": 20094, "first_frame": 20075, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49557, "responder_port": 445, "initiator_bytes": 1286, "last_seen_epoch": "1550950937.947056", "responder_bytes": 1482, "first_seen_epoch": "1550950937.944462" }, { "bytes": 288666, "stream": 200, "flow_id": "flow-84850d74cd6a8ef7b8cb3cb8", "packets": 332, "transport": "tcp", "last_frame": 20989, "first_frame": 20095, "initiator_ip": "10.2.23.231", "responder_ip": "85.143.218.7", "initiator_port": 49558, "responder_port": 80, "initiator_bytes": 6528, "last_seen_epoch": "1550950997.56578", "responder_bytes": 282138, "first_seen_epoch": "1550950937.947876" }, { "bytes": 2340, "stream": 201, "flow_id": "flow-d17346f19f2ff634a7c38b28", "packets": 14, "transport": "tcp", "last_frame": 21650, "first_frame": 21120, "initiator_ip": "10.2.23.231", "responder_ip": "87.236.22.142", "initiator_port": 49559, "responder_port": 443, "initiator_bytes": 933, "last_seen_epoch": "1550951074.064356", "responder_bytes": 1407, "first_seen_epoch": "1550951012.012899" }, { "bytes": 204504, "stream": 202, "flow_id": "flow-da78bf436697a1a12f49645b", "packets": 239, "transport": "tcp", "last_frame": 22649, "first_frame": 21838, "initiator_ip": "10.2.23.231", "responder_ip": "213.226.68.112", "initiator_port": 49560, "responder_port": 443, "initiator_bytes": 5819, "last_seen_epoch": "1550951184.291237", "responder_bytes": 198685, "first_seen_epoch": "1550951098.953573" }, { "bytes": 7755, "stream": 203, "flow_id": "flow-c9569c07f478421ef0e50568", "packets": 45, "transport": "tcp", "last_frame": 28872, "first_frame": 23087, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49561, "responder_port": 445, "initiator_bytes": 5579, "last_seen_epoch": "1550952571.828707", "responder_bytes": 2176, "first_seen_epoch": "1550951238.131975" }, { "bytes": 28721, "stream": 204, "flow_id": "flow-c01aaa803e3160be31b23da8", "packets": 148, "transport": "tcp", "last_frame": 28283, "first_frame": 23648, "initiator_ip": "10.2.23.231", "responder_ip": "213.226.68.112", "initiator_port": 49562, "responder_port": 443, "initiator_bytes": 15992, "last_seen_epoch": "1550951576.9992", "responder_bytes": 12729, "first_seen_epoch": "1550951299.058508" }, { "bytes": 26965, "stream": 205, "flow_id": "flow-a0ba01c04bc77aca4d8f72ca", "packets": 144, "transport": "tcp", "last_frame": 28292, "first_frame": 23664, "initiator_ip": "10.2.23.231", "responder_ip": "213.226.68.112", "initiator_port": 49563, "responder_port": 443, "initiator_bytes": 15320, "last_seen_epoch": "1550951598.910606", "responder_bytes": 11645, "first_seen_epoch": "1550951301.442093" }, { "bytes": 160, "stream": 104, "flow_id": "flow-ee637cde92da03ebb64c1d7a", "packets": 2, "transport": "udp", "last_frame": 23726, "first_frame": 23725, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 54324, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550951314.312083", "responder_bytes": 88, "first_seen_epoch": "1550951314.06532" }, { "bytes": 2340, "stream": 206, "flow_id": "flow-e78b012172b851c803885e88", "packets": 14, "transport": "tcp", "last_frame": 23847, "first_frame": 23727, "initiator_ip": "10.2.23.231", "responder_ip": "87.236.22.142", "initiator_port": 49564, "responder_port": 443, "initiator_bytes": 933, "last_seen_epoch": "1550951375.664452", "responder_bytes": 1407, "first_seen_epoch": "1550951314.315789" }, { "bytes": 1464, "stream": 207, "flow_id": "flow-84494b53d788487cc5b192e0", "packets": 11, "transport": "tcp", "last_frame": 23799, "first_frame": 23789, "initiator_ip": "10.2.23.231", "responder_ip": "190.146.112.216", "initiator_port": 49565, "responder_port": 8082, "initiator_bytes": 1051, "last_seen_epoch": "1550951353.957769", "responder_bytes": 413, "first_seen_epoch": "1550951353.114976" }, { "bytes": 1548, "stream": 208, "flow_id": "flow-dfb0cb99c29dd8eea5d22966", "packets": 13, "transport": "tcp", "last_frame": 23824, "first_frame": 23807, "initiator_ip": "10.2.23.231", "responder_ip": "190.146.112.216", "initiator_port": 49566, "responder_port": 8082, "initiator_bytes": 1081, "last_seen_epoch": "1550951357.341359", "responder_bytes": 467, "first_seen_epoch": "1550951355.635462" }, { "bytes": 248, "stream": 105, "flow_id": "flow-5ba060de3c1b74ab63b2b4fc", "packets": 2, "transport": "udp", "last_frame": 23843, "first_frame": 23842, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 60427, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1550951375.522153", "responder_bytes": 156, "first_seen_epoch": "1550951375.399923" }, { "bytes": 255, "stream": 106, "flow_id": "flow-e4e7904c50ffcac95d9adda0", "packets": 2, "transport": "udp", "last_frame": 23845, "first_frame": 23844, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 53062, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1550951375.636293", "responder_bytes": 164, "first_seen_epoch": "1550951375.523039" }, { "bytes": 196, "stream": 107, "flow_id": "flow-97bddfb169d893d7469bf57c", "packets": 2, "transport": "udp", "last_frame": 23848, "first_frame": 23846, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 58069, "responder_port": 53, "initiator_bytes": 98, "last_seen_epoch": "1550951375.734445", "responder_bytes": 98, "first_seen_epoch": "1550951375.637159" }, { "bytes": 264, "stream": 108, "flow_id": "flow-6dfdf1b6516765b645d75b59", "packets": 2, "transport": "udp", "last_frame": 23850, "first_frame": 23849, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 51913, "responder_port": 53, "initiator_bytes": 98, "last_seen_epoch": "1550951375.880503", "responder_bytes": 166, "first_seen_epoch": "1550951375.735581" }, { "bytes": 248, "stream": 109, "flow_id": "flow-8e2a09714c51ee58a8b49480", "packets": 2, "transport": "udp", "last_frame": 23852, "first_frame": 23851, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 62977, "responder_port": 53, "initiator_bytes": 96, "last_seen_epoch": "1550951376.102761", "responder_bytes": 152, "first_seen_epoch": "1550951375.881257" }, { "bytes": 52167, "stream": 209, "flow_id": "flow-535ca1254538f90a972b535d", "packets": 78, "transport": "tcp", "last_frame": 28225, "first_frame": 23860, "initiator_ip": "10.2.23.231", "responder_ip": "195.123.246.99", "initiator_port": 49567, "responder_port": 447, "initiator_bytes": 2446, "last_seen_epoch": "1550951473.652687", "responder_bytes": 49721, "first_seen_epoch": "1550951378.912199" }, { "bytes": 30395, "stream": 210, "flow_id": "flow-f7ce53420685521c875c6684", "packets": 119, "transport": "tcp", "last_frame": 24653, "first_frame": 24017, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49568, "responder_port": 3268, "initiator_bytes": 17834, "last_seen_epoch": "1550951414.882493", "responder_bytes": 12561, "first_seen_epoch": "1550951414.632563" }, { "bytes": 344, "stream": 110, "flow_id": "flow-bc69fc2a654ee8327aeaa43a", "packets": 2, "transport": "udp", "last_frame": 24136, "first_frame": 24135, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 64818, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1550951414.750142", "responder_bytes": 211, "first_seen_epoch": "1550951414.749873" }, { "bytes": 282, "stream": 111, "flow_id": "flow-ae9bbca2390e7f8cfef0ad12", "packets": 2, "transport": "udp", "last_frame": 24138, "first_frame": 24137, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 61120, "responder_port": 53, "initiator_bytes": 102, "last_seen_epoch": "1550951414.750662", "responder_bytes": 180, "first_seen_epoch": "1550951414.75052" }, { "bytes": 162923, "stream": 211, "flow_id": "flow-6d1d870cd5e23da1f29b3c38", "packets": 515, "transport": "tcp", "last_frame": 28569, "first_frame": 24139, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49569, "responder_port": 389, "initiator_bytes": 49540, "last_seen_epoch": "1550952336.486267", "responder_bytes": 113383, "first_seen_epoch": "1550951414.751372" }, { "bytes": 3284, "stream": 212, "flow_id": "flow-a149ba9f4e8cb9e0123ad1dc", "packets": 15, "transport": "tcp", "last_frame": 28266, "first_frame": 24657, "initiator_ip": "10.2.23.231", "responder_ip": "190.146.112.216", "initiator_port": 49570, "responder_port": 8082, "initiator_bytes": 2782, "last_seen_epoch": "1550951534.894672", "responder_bytes": 502, "first_seen_epoch": "1550951414.918109" }, { "bytes": 1376, "stream": 213, "flow_id": "flow-d683addee1cae31aceada8de", "packets": 12, "transport": "tcp", "last_frame": 25542, "first_frame": 24697, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49571, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1550951434.635105", "responder_bytes": 658, "first_seen_epoch": "1550951424.021003" }, { "bytes": 3119, "stream": 214, "flow_id": "flow-4c2c25b96ba5d7cbc574868b", "packets": 12, "transport": "tcp", "last_frame": 25540, "first_frame": 24704, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49572, "responder_port": 49158, "initiator_bytes": 1677, "last_seen_epoch": "1550951434.632935", "responder_bytes": 1442, "first_seen_epoch": "1550951424.022598" }, { "bytes": 170, "stream": 112, "flow_id": "flow-44ccdbaa05741141852736e1", "packets": 2, "transport": "udp", "last_frame": 24717, "first_frame": 24713, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 57995, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1550951426.486292", "responder_bytes": 93, "first_seen_epoch": "1550951426.323411" }, { "bytes": 193095, "stream": 215, "flow_id": "flow-236a5b2e17a74e80938d87dd", "packets": 254, "transport": "tcp", "last_frame": 27138, "first_frame": 24718, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49232, "responder_port": 80, "initiator_bytes": 7952, "last_seen_epoch": "1550951451.007866", "responder_bytes": 185143, "first_seen_epoch": "1550951426.510284" }, { "bytes": 175316, "stream": 216, "flow_id": "flow-cd68dd0f3808ca7876324676", "packets": 226, "transport": "tcp", "last_frame": 27160, "first_frame": 24719, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49233, "responder_port": 80, "initiator_bytes": 6952, "last_seen_epoch": "1550951451.178872", "responder_bytes": 168364, "first_seen_epoch": "1550951426.510357" }, { "bytes": 372, "stream": 113, "flow_id": "flow-8ee1d00de78b726c2f70b816", "packets": 4, "transport": "udp", "last_frame": 25109, "first_frame": 24733, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 52002, "responder_port": 53, "initiator_bytes": 240, "last_seen_epoch": "1550951430.255035", "responder_bytes": 132, "first_seen_epoch": "1550951426.961286" }, { "bytes": 290913, "stream": 217, "flow_id": "flow-61fd7098b968357b2bac39ef", "packets": 347, "transport": "tcp", "last_frame": 28204, "first_frame": 24736, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49234, "responder_port": 80, "initiator_bytes": 7511, "last_seen_epoch": "1550951463.558185", "responder_bytes": 283402, "first_seen_epoch": "1550951426.967513" }, { "bytes": 252, "stream": 218, "flow_id": "flow-01fbf0e9cbc7b88c71ae6731", "packets": 4, "transport": "tcp", "last_frame": 28166, "first_frame": 24737, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49235, "responder_port": 80, "initiator_bytes": 194, "last_seen_epoch": "1550951462.885792", "responder_bytes": 58, "first_seen_epoch": "1550951426.968154" }, { "bytes": 223254, "stream": 219, "flow_id": "flow-8958b89a123051220a9100e6", "packets": 267, "transport": "tcp", "last_frame": 28199, "first_frame": 24738, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49236, "responder_port": 80, "initiator_bytes": 6216, "last_seen_epoch": "1550951463.554561", "responder_bytes": 217038, "first_seen_epoch": "1550951426.968564" }, { "bytes": 786, "stream": 220, "flow_id": "flow-8fe5e18065f74823c449d865", "packets": 7, "transport": "tcp", "last_frame": 28202, "first_frame": 24739, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49237, "responder_port": 80, "initiator_bytes": 674, "last_seen_epoch": "1550951463.556849", "responder_bytes": 112, "first_seen_epoch": "1550951426.969075" }, { "bytes": 228, "stream": 114, "flow_id": "flow-80f34992351396e9476c777a", "packets": 2, "transport": "udp", "last_frame": 24759, "first_frame": 24740, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 64583, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1550951427.053264", "responder_bytes": 144, "first_seen_epoch": "1550951426.973506" }, { "bytes": 32439, "stream": 221, "flow_id": "flow-f082221a2dd5f7bac2fdce03", "packets": 50, "transport": "tcp", "last_frame": 28205, "first_frame": 24760, "initiator_ip": "10.2.23.109", "responder_ip": "172.217.1.200", "initiator_port": 49238, "responder_port": 443, "initiator_bytes": 1835, "last_seen_epoch": "1550951463.600358", "responder_bytes": 30604, "first_seen_epoch": "1550951427.054127" }, { "bytes": 4146, "stream": 222, "flow_id": "flow-205aa90dc8ddf0a3fda2a047", "packets": 15, "transport": "tcp", "last_frame": 28206, "first_frame": 24761, "initiator_ip": "10.2.23.109", "responder_ip": "172.217.1.200", "initiator_port": 49239, "responder_port": 443, "initiator_bytes": 760, "last_seen_epoch": "1550951463.600491", "responder_bytes": 3386, "first_seen_epoch": "1550951427.054222" }, { "bytes": 332293, "stream": 223, "flow_id": "flow-ff529013b128bb31b9e9ce8a", "packets": 403, "transport": "tcp", "last_frame": 28126, "first_frame": 24820, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49240, "responder_port": 80, "initiator_bytes": 9518, "last_seen_epoch": "1550951462.478849", "responder_bytes": 322775, "first_seen_epoch": "1550951427.529187" }, { "bytes": 315052, "stream": 224, "flow_id": "flow-3dd79111cc058baa896ba7a4", "packets": 379, "transport": "tcp", "last_frame": 28201, "first_frame": 24821, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49241, "responder_port": 80, "initiator_bytes": 8623, "last_seen_epoch": "1550951463.554977", "responder_bytes": 306429, "first_seen_epoch": "1550951427.529375" }, { "bytes": 360927, "stream": 225, "flow_id": "flow-5009eaff901132a754930a07", "packets": 414, "transport": "tcp", "last_frame": 28203, "first_frame": 25085, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49243, "responder_port": 80, "initiator_bytes": 8473, "last_seen_epoch": "1550951463.557684", "responder_bytes": 352454, "first_seen_epoch": "1550951429.836846" }, { "bytes": 193665, "stream": 226, "flow_id": "flow-f47a977eb6047e5dd759c235", "packets": 234, "transport": "tcp", "last_frame": 27690, "first_frame": 25086, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49242, "responder_port": 80, "initiator_bytes": 5653, "last_seen_epoch": "1550951457.517689", "responder_bytes": 188012, "first_seen_epoch": "1550951429.836921" }, { "bytes": 1639, "stream": 227, "flow_id": "flow-bf2dffbffffba46721a3e9f4", "packets": 8, "transport": "tcp", "last_frame": 28207, "first_frame": 25110, "initiator_ip": "10.2.23.109", "responder_ip": "172.217.2.10", "initiator_port": 49244, "responder_port": 80, "initiator_bytes": 648, "last_seen_epoch": "1550951463.60065", "responder_bytes": 991, "first_seen_epoch": "1550951430.255997" }, { "bytes": 232, "stream": 228, "flow_id": "flow-08475d18e348fd12b651137b", "packets": 4, "transport": "tcp", "last_frame": 28208, "first_frame": 25111, "initiator_ip": "10.2.23.109", "responder_ip": "172.217.2.10", "initiator_port": 49245, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1550951463.600803", "responder_bytes": 58, "first_seen_epoch": "1550951430.256082" }, { "bytes": 220, "stream": 115, "flow_id": "flow-6fd399813aeea91a57d3f108", "packets": 2, "transport": "udp", "last_frame": 25142, "first_frame": 25118, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 54136, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550951430.455767", "responder_bytes": 148, "first_seen_epoch": "1550951430.384352" }, { "bytes": 231, "stream": 116, "flow_id": "flow-b685c99812406c195a98a9e7", "packets": 2, "transport": "udp", "last_frame": 25140, "first_frame": 25119, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 61160, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550951430.455619", "responder_bytes": 159, "first_seen_epoch": "1550951430.384509" }, { "bytes": 260, "stream": 117, "flow_id": "flow-e8754ef6a011c58cada53125", "packets": 2, "transport": "udp", "last_frame": 25151, "first_frame": 25120, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 55433, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550951430.456347", "responder_bytes": 188, "first_seen_epoch": "1550951430.384807" }, { "bytes": 271, "stream": 118, "flow_id": "flow-a857aa948629c6c39afc6eda", "packets": 2, "transport": "udp", "last_frame": 25145, "first_frame": 25121, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 60199, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550951430.455991", "responder_bytes": 199, "first_seen_epoch": "1550951430.385017" }, { "bytes": 271, "stream": 119, "flow_id": "flow-a5e6b5f280bfea820326fa7b", "packets": 2, "transport": "udp", "last_frame": 25147, "first_frame": 25122, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 61234, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550951430.456116", "responder_bytes": 199, "first_seen_epoch": "1550951430.385119" }, { "bytes": 271, "stream": 120, "flow_id": "flow-3ced4e52e76b8403bd0eb81b", "packets": 2, "transport": "udp", "last_frame": 25148, "first_frame": 25123, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 56537, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550951430.456236", "responder_bytes": 199, "first_seen_epoch": "1550951430.385453" }, { "bytes": 142051, "stream": 229, "flow_id": "flow-42d00d6f0fac9f11e6a2c6c0", "packets": 174, "transport": "tcp", "last_frame": 28200, "first_frame": 25124, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49247, "responder_port": 80, "initiator_bytes": 4804, "last_seen_epoch": "1550951463.554828", "responder_bytes": 137247, "first_seen_epoch": "1550951430.399843" }, { "bytes": 136453, "stream": 230, "flow_id": "flow-41df228adf73d563e0db33b7", "packets": 164, "transport": "tcp", "last_frame": 27975, "first_frame": 25125, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49246, "responder_port": 80, "initiator_bytes": 3649, "last_seen_epoch": "1550951460.297176", "responder_bytes": 132804, "first_seen_epoch": "1550951430.399966" }, { "bytes": 232, "stream": 231, "flow_id": "flow-1a14a02f3faab63bebe84721", "packets": 4, "transport": "tcp", "last_frame": 28209, "first_frame": 25250, "initiator_ip": "10.2.23.109", "responder_ip": "204.79.197.200", "initiator_port": 49249, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1550951463.662337", "responder_bytes": 58, "first_seen_epoch": "1550951431.465843" }, { "bytes": 1260, "stream": 232, "flow_id": "flow-8e66cf2063edf389f4d0016d", "packets": 8, "transport": "tcp", "last_frame": 28210, "first_frame": 25251, "initiator_ip": "10.2.23.109", "responder_ip": "204.79.197.200", "initiator_port": 49248, "responder_port": 80, "initiator_bytes": 510, "last_seen_epoch": "1550951463.662453", "responder_bytes": 750, "first_seen_epoch": "1550951431.465924" }, { "bytes": 1728, "stream": 233, "flow_id": "flow-794cce301f3635c490bd2890", "packets": 14, "transport": "tcp", "last_frame": 28250, "first_frame": 26286, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49573, "responder_port": 135, "initiator_bytes": 940, "last_seen_epoch": "1550951504.022754", "responder_bytes": 788, "first_seen_epoch": "1550951444.019094" }, { "bytes": 6719, "stream": 234, "flow_id": "flow-2579a4f5b15c7250dd7562db", "packets": 26, "transport": "tcp", "last_frame": 28246, "first_frame": 26293, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49574, "responder_port": 49155, "initiator_bytes": 4190, "last_seen_epoch": "1550951504.022243", "responder_bytes": 2529, "first_seen_epoch": "1550951444.023187" }, { "bytes": 7871, "stream": 235, "flow_id": "flow-758b388102587a88e29c5d50", "packets": 19, "transport": "tcp", "last_frame": 26547, "first_frame": 26316, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49575, "responder_port": 3268, "initiator_bytes": 3288, "last_seen_epoch": "1550951444.104167", "responder_bytes": 4583, "first_seen_epoch": "1550951444.037538" }, { "bytes": 68117, "stream": 236, "flow_id": "flow-249bcb9d521d8d7b8a12fd43", "packets": 215, "transport": "tcp", "last_frame": 28738, "first_frame": 26333, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49576, "responder_port": 389, "initiator_bytes": 21110, "last_seen_epoch": "1550952366.50168", "responder_bytes": 47007, "first_seen_epoch": "1550951444.063614" }, { "bytes": 6073, "stream": 237, "flow_id": "flow-6c7e480f64721ba87fd88a26", "packets": 19, "transport": "tcp", "last_frame": 28271, "first_frame": 26549, "initiator_ip": "10.2.23.231", "responder_ip": "190.146.112.216", "initiator_port": 49577, "responder_port": 8082, "initiator_bytes": 5463, "last_seen_epoch": "1550951564.112402", "responder_bytes": 610, "first_seen_epoch": "1550951444.119632" }, { "bytes": 73234, "stream": 238, "flow_id": "flow-3731d536cb71b9e75a49ba24", "packets": 94, "transport": "tcp", "last_frame": 27251, "first_frame": 26931, "initiator_ip": "10.2.23.109", "responder_ip": "161.119.42.22", "initiator_port": 49250, "responder_port": 80, "initiator_bytes": 2810, "last_seen_epoch": "1550951452.271942", "responder_bytes": 70424, "first_seen_epoch": "1550951447.995727" }, { "bytes": 246, "stream": 121, "flow_id": "flow-5ac3d5e15a72e3f3b7b614e3", "packets": 2, "transport": "udp", "last_frame": 27600, "first_frame": 27599, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 65315, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1550951456.504409", "responder_bytes": 164, "first_seen_epoch": "1550951456.440109" }, { "bytes": 6374, "stream": 239, "flow_id": "flow-574186686c1e207173e45af8", "packets": 15, "transport": "tcp", "last_frame": 28211, "first_frame": 27601, "initiator_ip": "10.2.23.109", "responder_ip": "72.21.81.200", "initiator_port": 49252, "responder_port": 443, "initiator_bytes": 608, "last_seen_epoch": "1550951463.662593", "responder_bytes": 5766, "first_seen_epoch": "1550951456.505194" }, { "bytes": 45262, "stream": 240, "flow_id": "flow-9a8c91319077fa49b112576a", "packets": 64, "transport": "tcp", "last_frame": 28212, "first_frame": 27602, "initiator_ip": "10.2.23.109", "responder_ip": "72.21.81.200", "initiator_port": 49251, "responder_port": 443, "initiator_bytes": 2071, "last_seen_epoch": "1550951463.662677", "responder_bytes": 43191, "first_seen_epoch": "1550951456.505264" }, { "bytes": 2340, "stream": 241, "flow_id": "flow-e4889601042a43786d826e0a", "packets": 14, "transport": "tcp", "last_frame": 28316, "first_frame": 28295, "initiator_ip": "10.2.23.231", "responder_ip": "87.236.22.142", "initiator_port": 49578, "responder_port": 443, "initiator_bytes": 933, "last_seen_epoch": "1550951678.509988", "responder_bytes": 1407, "first_seen_epoch": "1550951615.662253" }, { "bytes": 6386, "stream": 242, "flow_id": "flow-22be3e86da681c484c1d2cd3", "packets": 22, "transport": "tcp", "last_frame": 28345, "first_frame": 28322, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 49579, "responder_port": 445, "initiator_bytes": 4674, "last_seen_epoch": "1550951701.520078", "responder_bytes": 1712, "first_seen_epoch": "1550951689.145687" }, { "bytes": 6346, "stream": 243, "flow_id": "flow-7bd1d683ad2c398f6551dd55", "packets": 22, "transport": "tcp", "last_frame": 28385, "first_frame": 28349, "initiator_ip": "10.2.23.109", "responder_ip": "10.2.23.2", "initiator_port": 49253, "responder_port": 445, "initiator_bytes": 4634, "last_seen_epoch": "1550951736.81709", "responder_bytes": 1712, "first_seen_epoch": "1550951725.347336" }, { "bytes": 3399, "stream": 244, "flow_id": "flow-e21369fc9545fdf4353348ef", "packets": 20, "transport": "tcp", "last_frame": 28403, "first_frame": 28368, "initiator_ip": "10.2.23.231", "responder_ip": "213.226.68.112", "initiator_port": 49580, "responder_port": 443, "initiator_bytes": 1105, "last_seen_epoch": "1550951800.618567", "responder_bytes": 2294, "first_seen_epoch": "1550951733.360794" }, { "bytes": 160, "stream": 122, "flow_id": "flow-cc2b148581d37348cfb51b2d", "packets": 2, "transport": "udp", "last_frame": 28424, "first_frame": 28423, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 50435, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550951918.866154", "responder_bytes": 88, "first_seen_epoch": "1550951918.502707" }, { "bytes": 2340, "stream": 245, "flow_id": "flow-29c26fea862c744b7958129e", "packets": 14, "transport": "tcp", "last_frame": 28467, "first_frame": 28425, "initiator_ip": "10.2.23.231", "responder_ip": "87.236.22.142", "initiator_port": 49581, "responder_port": 443, "initiator_bytes": 933, "last_seen_epoch": "1550951983.986299", "responder_bytes": 1407, "first_seen_epoch": "1550951918.869037" }, { "bytes": 3507, "stream": 246, "flow_id": "flow-cc0d418bb33f247a0c86e621", "packets": 22, "transport": "tcp", "last_frame": 28480, "first_frame": 28443, "initiator_ip": "10.2.23.231", "responder_ip": "213.226.68.112", "initiator_port": 49582, "responder_port": 443, "initiator_bytes": 1159, "last_seen_epoch": "1550952003.413679", "responder_bytes": 2348, "first_seen_epoch": "1550951935.862661" }, { "bytes": 3399, "stream": 247, "flow_id": "flow-4e2cabe51d82ae5beff97844", "packets": 20, "transport": "tcp", "last_frame": 28532, "first_frame": 28501, "initiator_ip": "10.2.23.231", "responder_ip": "213.226.68.112", "initiator_port": 49583, "responder_port": 443, "initiator_bytes": 1105, "last_seen_epoch": "1550952206.051642", "responder_bytes": 2294, "first_seen_epoch": "1550952138.617238" }, { "bytes": 2340, "stream": 248, "flow_id": "flow-71bb9ef5716a944b0a53a6d7", "packets": 14, "transport": "tcp", "last_frame": 28557, "first_frame": 28535, "initiator_ip": "10.2.23.231", "responder_ip": "87.236.22.142", "initiator_port": 49584, "responder_port": 443, "initiator_bytes": 933, "last_seen_epoch": "1550952286.034714", "responder_bytes": 1407, "first_seen_epoch": "1550952223.985593" }, { "bytes": 203044, "stream": 249, "flow_id": "flow-f0825eeba5bf23dc2d4a3ad6", "packets": 247, "transport": "tcp", "last_frame": 28835, "first_frame": 28570, "initiator_ip": "10.2.23.231", "responder_ip": "213.226.68.112", "initiator_port": 49585, "responder_port": 443, "initiator_bytes": 5919, "last_seen_epoch": "1550952445.804571", "responder_bytes": 197125, "first_seen_epoch": "1550952341.228114" }, { "bytes": 160, "stream": 123, "flow_id": "flow-94cd794c7023653fcb52c940", "packets": 2, "transport": "udp", "last_frame": 28848, "first_frame": 28847, "initiator_ip": "10.2.23.231", "responder_ip": "10.2.23.2", "initiator_port": 63203, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1550952526.309792", "responder_bytes": 88, "first_seen_epoch": "1550952526.030101" }, { "bytes": 2286, "stream": 250, "flow_id": "flow-a590ff36dc560061f7b1ffa0", "packets": 13, "transport": "tcp", "last_frame": 28861, "first_frame": 28849, "initiator_ip": "10.2.23.231", "responder_ip": "87.236.22.142", "initiator_port": 49586, "responder_port": 443, "initiator_bytes": 879, "last_seen_epoch": "1550952529.300018", "responder_bytes": 1407, "first_seen_epoch": "1550952526.313525" }, { "bytes": 2861, "stream": 251, "flow_id": "flow-097b314a15d326b1c9a91d58", "packets": 12, "transport": "tcp", "last_frame": 28884, "first_frame": 28873, "initiator_ip": "10.2.23.231", "responder_ip": "213.226.68.112", "initiator_port": 49587, "responder_port": 443, "initiator_bytes": 836, "last_seen_epoch": "1550952584.866718", "responder_bytes": 2025, "first_seen_epoch": "1550952580.812837" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-e143f8a36e42581c61d8f232", "src_port": 54067, "tcp_stream": null, "udp_stream": 2, "frame_number": 4, "timestamp_epoch": "1550949876.446053000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "_ldap._tcp.dc._msdcs.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 54067, "event_id": "evt-d24214e5b38c1bcb1f7e79d5", "src_port": 53, "tcp_stream": null, "udp_stream": 2, "frame_number": 5, "timestamp_epoch": "1550949876.446376000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "stormtheory-dc.stormtheory.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-bce50b43428e2906d4c987bd", "src_port": 59311, "tcp_stream": null, "udp_stream": 3, "frame_number": 6, "timestamp_epoch": "1550949876.448007000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "stormtheory-dc.stormtheory.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 59311, "event_id": "evt-72a4cdf9d9707dee813a276f", "src_port": 53, "tcp_stream": null, "udp_stream": 3, "frame_number": 7, "timestamp_epoch": "1550949876.448229000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-a457deb0aeb00fb1ae57c733", "src_port": 52802, "tcp_stream": null, "udp_stream": 5, "frame_number": 10, "timestamp_epoch": "1550949876.550153000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 52802, "event_id": "evt-6cd52aed5189520e117b891e", "src_port": 53, "tcp_stream": null, "udp_stream": 5, "frame_number": 11, "timestamp_epoch": "1550949876.550993000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-576ba0b83805e7e1e4f09a6e", "src_port": 50926, "tcp_stream": null, "udp_stream": 7, "frame_number": 137, "timestamp_epoch": "1550949877.467480000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 50926, "event_id": "evt-73fa0e248bcf97d7666315aa", "src_port": 53, "tcp_stream": null, "udp_stream": 7, "frame_number": 138, "timestamp_epoch": "1550949877.467782000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-f9406678e26e76003d7ba353", "src_port": 49964, "tcp_stream": null, "udp_stream": 8, "frame_number": 139, "timestamp_epoch": "1550949877.468259000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "_ldap._tcp.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 49964, "event_id": "evt-52d1cf0b6e8d1411435338ab", "src_port": 53, "tcp_stream": null, "udp_stream": 8, "frame_number": 140, "timestamp_epoch": "1550949877.468436000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "stormtheory.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-fbb259da2efa25843b60aefe", "src_port": 65360, "tcp_stream": null, "udp_stream": 9, "frame_number": 179, "timestamp_epoch": "1550949877.534398000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "stormtheory.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 65360, "event_id": "evt-c6c302a2d84674306cce4fe6", "src_port": 53, "tcp_stream": null, "udp_stream": 9, "frame_number": 180, "timestamp_epoch": "1550949877.534662000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "wpad.stormtheory.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-79e29b534e8a267e7375e190", "src_port": 64510, "tcp_stream": null, "udp_stream": 13, "frame_number": 294, "timestamp_epoch": "1550949879.499617000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "wpad.stormtheory.info", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 64510, "event_id": "evt-65dd32c8607389b9580ca96e", "src_port": 53, "tcp_stream": null, "udp_stream": 13, "frame_number": 295, "timestamp_epoch": "1550949879.499844000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-d4375f12dce4ea7f86abc828", "src_port": 60408, "tcp_stream": null, "udp_stream": 14, "frame_number": 296, "timestamp_epoch": "1550949879.500798000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 60408, "event_id": "evt-8021fa247f1c5e90eda3bf28", "src_port": 53, "tcp_stream": null, "udp_stream": 14, "frame_number": 297, "timestamp_epoch": "1550949879.553934000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-db7a8ee4faaecab2ecf2691d", "src_port": 59128, "tcp_stream": null, "udp_stream": 16, "frame_number": 300, "timestamp_epoch": "1550949879.597368000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 59128, "event_id": "evt-997d4f51ae8a540f7475eb4b", "src_port": 53, "tcp_stream": null, "udp_stream": 16, "frame_number": 301, "timestamp_epoch": "1550949879.597678000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-ca4be975c1f3cbedce6e9bba", "src_port": 64019, "tcp_stream": null, "udp_stream": 17, "frame_number": 307, "timestamp_epoch": "1550949882.140710000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "23.223.195.42,23.223.195.33", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 64019, "event_id": "evt-1359f9cf758936ae07ef3f18", "src_port": 53, "tcp_stream": null, "udp_stream": 17, "frame_number": 308, "timestamp_epoch": "1550949882.246164000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "Ferguson-Win-PC.stormtheory.info", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-60c5764d1db506e102d91d23", "src_port": 61003, "tcp_stream": null, "udp_stream": 18, "frame_number": 319, "timestamp_epoch": "1550949884.482276000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "Ferguson-Win-PC.stormtheory.info", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 61003, "event_id": "evt-01af948ccf28a3ae3031f7b2", "src_port": 53, "tcp_stream": null, "udp_stream": 18, "frame_number": 320, "timestamp_epoch": "1550949884.482553000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.a": "10.2.23.231", "dns.qry.name": "stormtheory.info", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-1aab4cdfc5508cd56a5b94d2", "src_port": 63154, "tcp_stream": null, "udp_stream": 19, "frame_number": 321, "timestamp_epoch": "1550949884.483779000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.231", "dns.qry.name": "stormtheory.info", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 63154, "event_id": "evt-cbbe49fcefbf4210ba887b7f", "src_port": 53, "tcp_stream": null, "udp_stream": 19, "frame_number": 322, "timestamp_epoch": "1550949884.485879000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "Stormtheory-DC.stormtheory.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-ecb6ca88fa2b3be7e0abbde9", "src_port": 53808, "tcp_stream": null, "udp_stream": 20, "frame_number": 323, "timestamp_epoch": "1550949889.106247000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "Stormtheory-DC.stormtheory.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 53808, "event_id": "evt-763e3d4be5469fbac350005b", "src_port": 53, "tcp_stream": null, "udp_stream": 20, "frame_number": 324, "timestamp_epoch": "1550949889.106593000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-430b70ab3bedba723af0a235", "src_port": 62653, "tcp_stream": null, "udp_stream": 22, "frame_number": 398, "timestamp_epoch": "1550949914.332048000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 62653, "event_id": "evt-4026568478c0170977af8365", "src_port": 53, "tcp_stream": null, "udp_stream": 22, "frame_number": 399, "timestamp_epoch": "1550949914.332445000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-91b48b6cb22a504000642ad8", "src_port": 59698, "tcp_stream": null, "udp_stream": 24, "frame_number": 405, "timestamp_epoch": "1550949914.606011000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "_ldap._tcp.dc._msdcs.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 59698, "event_id": "evt-a78073b87ee3e712e24b03a7", "src_port": 53, "tcp_stream": null, "udp_stream": 24, "frame_number": 406, "timestamp_epoch": "1550949914.606513000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "stormtheory-dc.stormtheory.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-5c60ca73db3231a0775a217a", "src_port": 57856, "tcp_stream": null, "udp_stream": 25, "frame_number": 407, "timestamp_epoch": "1550949914.608879000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "stormtheory-dc.stormtheory.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 57856, "event_id": "evt-016702123dc6b7c55d8c734d", "src_port": 53, "tcp_stream": null, "udp_stream": 25, "frame_number": 408, "timestamp_epoch": "1550949914.609075000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-c697c9b9f13f4f95e67af33c", "src_port": 63409, "tcp_stream": null, "udp_stream": 27, "frame_number": 411, "timestamp_epoch": "1550949914.710463000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 63409, "event_id": "evt-6aae5129f32b131c35c9f095", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 412, "timestamp_epoch": "1550949914.710748000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "wpad.stormtheory.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-6b6db358b1e70260ac619f1c", "src_port": 57257, "tcp_stream": null, "udp_stream": 33, "frame_number": 495, "timestamp_epoch": "1550949917.549427000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.qry.name": "wpad.stormtheory.info", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 57257, "event_id": "evt-e380dc55640d3b6de0308866", "src_port": 53, "tcp_stream": null, "udp_stream": 33, "frame_number": 496, "timestamp_epoch": "1550949917.549677000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-b30ffd14654ebacc0def3881", "src_port": 51832, "tcp_stream": null, "udp_stream": 34, "frame_number": 497, "timestamp_epoch": "1550949917.550716000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 51832, "event_id": "evt-1affbf6f35572c383f5ce321", "src_port": 53, "tcp_stream": null, "udp_stream": 34, "frame_number": 498, "timestamp_epoch": "1550949917.550893000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-0020857e84cb51c1e78adaa8", "src_port": 56962, "tcp_stream": null, "udp_stream": 37, "frame_number": 541, "timestamp_epoch": "1550949919.833437000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 56962, "event_id": "evt-5a90496772a3e904226aeddb", "src_port": 53, "tcp_stream": null, "udp_stream": 37, "frame_number": 542, "timestamp_epoch": "1550949919.833781000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "Stormtheory-DC.stormtheory.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-eb9343966df592fe9348b84b", "src_port": 64814, "tcp_stream": null, "udp_stream": 38, "frame_number": 545, "timestamp_epoch": "1550949919.924923000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "Stormtheory-DC.stormtheory.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 64814, "event_id": "evt-afbe72e73a1e4b77b59358e9", "src_port": 53, "tcp_stream": null, "udp_stream": 38, "frame_number": 546, "timestamp_epoch": "1550949919.925158000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-953e11771f6b63bbfa55b6d2", "src_port": 55197, "tcp_stream": null, "udp_stream": 39, "frame_number": 618, "timestamp_epoch": "1550949920.115754000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 55197, "event_id": "evt-fef159824f869883803d2dd5", "src_port": 53, "tcp_stream": null, "udp_stream": 39, "frame_number": 619, "timestamp_epoch": "1550949920.115975000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-2e1a9ef4bc1fa93e9216b771", "src_port": 63630, "tcp_stream": null, "udp_stream": 40, "frame_number": 620, "timestamp_epoch": "1550949920.116688000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.qry.name": "_ldap._tcp.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 63630, "event_id": "evt-5737ac3e111839842e23b481", "src_port": 53, "tcp_stream": null, "udp_stream": 40, "frame_number": 621, "timestamp_epoch": "1550949920.116852000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "stormtheory.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-e4ea4578ae7c8756f9536bb3", "src_port": 63248, "tcp_stream": null, "udp_stream": 41, "frame_number": 662, "timestamp_epoch": "1550949920.141213000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "stormtheory.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 63248, "event_id": "evt-1c92296b42cb0f24910e50b4", "src_port": 53, "tcp_stream": null, "udp_stream": 41, "frame_number": 663, "timestamp_epoch": "1550949920.141407000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "Sutton-Win-PC.stormtheory.info", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-de1a6b4f26d5b36ad0d6bafb", "src_port": 53083, "tcp_stream": null, "udp_stream": 42, "frame_number": 725, "timestamp_epoch": "1550949922.538276000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "Sutton-Win-PC.stormtheory.info", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 53083, "event_id": "evt-cdcb4dbb0bc52b40d5d98043", "src_port": 53, "tcp_stream": null, "udp_stream": 42, "frame_number": 726, "timestamp_epoch": "1550949922.538610000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.a": "10.2.23.109", "dns.qry.name": "stormtheory.info", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-e114e3a8dd8e9182282e1700", "src_port": 63997, "tcp_stream": null, "udp_stream": 43, "frame_number": 727, "timestamp_epoch": "1550949922.539960000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "10.2.23.109", "dns.qry.name": "stormtheory.info", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 63997, "event_id": "evt-23829b3933e4a46ad6cd27b5", "src_port": 53, "tcp_stream": null, "udp_stream": 43, "frame_number": 728, "timestamp_epoch": "1550949922.541944000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-89a884fac9bd017ee1ab1d9e", "src_port": 60722, "tcp_stream": null, "udp_stream": 44, "frame_number": 745, "timestamp_epoch": "1550949924.687316000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "23.223.195.42,23.223.195.33", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 60722, "event_id": "evt-569176678f5f38158b653bbd", "src_port": 53, "tcp_stream": null, "udp_stream": 44, "frame_number": 746, "timestamp_epoch": "1550949924.782455000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-67c8c73dbd830c84cf4cc4ca", "src_port": 62222, "tcp_stream": null, "udp_stream": 45, "frame_number": 867, "timestamp_epoch": "1550949937.842588000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 62222, "event_id": "evt-cee144e6cbb046968828b6f1", "src_port": 53, "tcp_stream": null, "udp_stream": 45, "frame_number": 868, "timestamp_epoch": "1550949937.842847000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-45d4fca13a20ef31c8788679", "src_port": 56776, "tcp_stream": null, "udp_stream": 46, "frame_number": 869, "timestamp_epoch": "1550949937.843265000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "_ldap._tcp.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 56776, "event_id": "evt-ebec8d4a9dd55da1a6d1c320", "src_port": 53, "tcp_stream": null, "udp_stream": 46, "frame_number": 870, "timestamp_epoch": "1550949937.843432000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "rootscafeslc.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-6a1bbfa889b600b7f902eb9c", "src_port": 59718, "tcp_stream": null, "udp_stream": 47, "frame_number": 1176, "timestamp_epoch": "1550949983.441602000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "198.185.159.136", "dns.qry.name": "rootscafeslc.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 59718, "event_id": "evt-d6cb9d91265f9a5cd492d3c1", "src_port": 53, "tcp_stream": null, "udp_stream": 47, "frame_number": 1177, "timestamp_epoch": "1550949983.592832000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.rootscafeslc.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-ca5ec660ff1e3b0362d710bd", "src_port": 53704, "tcp_stream": null, "udp_stream": 48, "frame_number": 1191, "timestamp_epoch": "1550949984.840704000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "198.185.159.135", "dns.qry.name": "www.rootscafeslc.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 53704, "event_id": "evt-506eaee2e14d79478a7eb61c", "src_port": 53, "tcp_stream": null, "udp_stream": 48, "frame_number": 1192, "timestamp_epoch": "1550949985.000129000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "use.typekit.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-4dc41151130bdcf66a03577b", "src_port": 52247, "tcp_stream": null, "udp_stream": 49, "frame_number": 1205, "timestamp_epoch": "1550949985.985154000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-e19650737c516055ee1bba24", "src_port": 63472, "tcp_stream": null, "udp_stream": 50, "frame_number": 1206, "timestamp_epoch": "1550949985.987562000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "static.squarespace.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-05ac53f6eaf45e31e415307e", "src_port": 60118, "tcp_stream": null, "udp_stream": 51, "frame_number": 1207, "timestamp_epoch": "1550949985.989617000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "static1.squarespace.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-d8b7642fd7ea5ccf9a5bc2aa", "src_port": 53674, "tcp_stream": null, "udp_stream": 52, "frame_number": 1212, "timestamp_epoch": "1550949986.109212000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "151.101.0.238,151.101.64.238,151.101.128.238,151.101.192.238", "dns.cname": "prod.squarespace.map.fastly.net", "dns.qry.name": "static1.squarespace.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 53674, "event_id": "evt-0cf4341b62f5deb1c8f30bf0", "src_port": 53, "tcp_stream": null, "udp_stream": 52, "frame_number": 1213, "timestamp_epoch": "1550949986.211340000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-ca7b4410546b071f1a13a9a1", "src_port": 63472, "tcp_stream": null, "udp_stream": 50, "frame_number": 1267, "timestamp_epoch": "1550949986.996665000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "static.squarespace.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-cc2a157cd88dbf48d25a2986", "src_port": 60118, "tcp_stream": null, "udp_stream": 51, "frame_number": 1268, "timestamp_epoch": "1550949986.996850000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "use.typekit.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-3b868466022d3c442d7bfa85", "src_port": 52247, "tcp_stream": null, "udp_stream": 49, "frame_number": 1269, "timestamp_epoch": "1550949986.996939000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-4a976d0c4425fb9ab767b041", "src_port": 55591, "tcp_stream": null, "udp_stream": 53, "frame_number": 1290, "timestamp_epoch": "1550949987.933921000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-0754c99913d4f17fb4c17dea", "src_port": 63426, "tcp_stream": null, "udp_stream": 54, "frame_number": 1291, "timestamp_epoch": "1550949987.935237000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-b04dce1f2e371644ab71e1fd", "src_port": 53256, "tcp_stream": null, "udp_stream": 55, "frame_number": 1292, "timestamp_epoch": "1550949987.935983000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-abc8726db6a26d55ce7f5a9a", "src_port": 54028, "tcp_stream": null, "udp_stream": 56, "frame_number": 1293, "timestamp_epoch": "1550949987.937966000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-d4aef51c1a7868bda222d4d6", "src_port": 62186, "tcp_stream": null, "udp_stream": 57, "frame_number": 1294, "timestamp_epoch": "1550949987.938668000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-fb61123e438553c49a463efe", "src_port": 54606, "tcp_stream": null, "udp_stream": 58, "frame_number": 1295, "timestamp_epoch": "1550949987.939588000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 63426, "event_id": "evt-673a1bcb4eef90057d6d0b15", "src_port": 53, "tcp_stream": null, "udp_stream": 54, "frame_number": 1298, "timestamp_epoch": "1550949987.996656000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 55591, "event_id": "evt-f1464a7efc552359a5188f7f", "src_port": 53, "tcp_stream": null, "udp_stream": 53, "frame_number": 1299, "timestamp_epoch": "1550949987.996754000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "use.typekit.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-58d8db6c2ebd2893dc140f01", "src_port": 52247, "tcp_stream": null, "udp_stream": 49, "frame_number": 1300, "timestamp_epoch": "1550949988.010225000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "static.squarespace.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-3a30134276ab9930f9be1946", "src_port": 60118, "tcp_stream": null, "udp_stream": 51, "frame_number": 1301, "timestamp_epoch": "1550949988.010365000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-6c8d85905b6531c018f7cc95", "src_port": 63472, "tcp_stream": null, "udp_stream": 50, "frame_number": 1302, "timestamp_epoch": "1550949988.010465000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 54028, "event_id": "evt-34bbd02d2d6599943ab3b817", "src_port": 53, "tcp_stream": null, "udp_stream": 56, "frame_number": 1303, "timestamp_epoch": "1550949988.034813000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 62186, "event_id": "evt-d47373f91bd12199c8fe287f", "src_port": 53, "tcp_stream": null, "udp_stream": 57, "frame_number": 1304, "timestamp_epoch": "1550949988.034951000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 54606, "event_id": "evt-bcaed78a5e81a221d0388552", "src_port": 53, "tcp_stream": null, "udp_stream": 58, "frame_number": 1305, "timestamp_epoch": "1550949988.035045000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 53256, "event_id": "evt-0514dc64c41fcd1ad3ace83b", "src_port": 53, "tcp_stream": null, "udp_stream": 55, "frame_number": 1306, "timestamp_epoch": "1550949988.035122000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "static.squarespace.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-b0551d26529870b60608a7eb", "src_port": 60118, "tcp_stream": null, "udp_stream": 51, "frame_number": 1390, "timestamp_epoch": "1550949990.022735000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-af0cbcc356011bdf011e67e0", "src_port": 63472, "tcp_stream": null, "udp_stream": 50, "frame_number": 1391, "timestamp_epoch": "1550949990.022897000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "use.typekit.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-b1957941d576c5cd1ace3367", "src_port": 52247, "tcp_stream": null, "udp_stream": 49, "frame_number": 1392, "timestamp_epoch": "1550949990.023081000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-c9658c577ccf68768f259af6", "src_port": 63472, "tcp_stream": null, "udp_stream": 50, "frame_number": 1417, "timestamp_epoch": "1550949994.032676000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "static.squarespace.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-43e4f31f0305e303f476794d", "src_port": 60118, "tcp_stream": null, "udp_stream": 51, "frame_number": 1418, "timestamp_epoch": "1550949994.032774000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "use.typekit.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-e7c8e22cd6a8eaf3be6e2769", "src_port": 52247, "tcp_stream": null, "udp_stream": 49, "frame_number": 1419, "timestamp_epoch": "1550949994.032866000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.qry.name": "static.squarespace.com", "dns.qry.type": "1", "dns.flags.rcode": "2", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 60118, "event_id": "evt-15bbd81d4e85cdab5a1066c0", "src_port": 53, "tcp_stream": null, "udp_stream": 51, "frame_number": 1421, "timestamp_epoch": "1550949997.308649000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.qry.name": "use.typekit.net", "dns.qry.type": "1", "dns.flags.rcode": "2", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 52247, "event_id": "evt-939f1b52e352e253da08f3c9", "src_port": 53, "tcp_stream": null, "udp_stream": 49, "frame_number": 1422, "timestamp_epoch": "1550949997.308765000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "2", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 63472, "event_id": "evt-3fab5f7cbae7c6f286d97d8d", "src_port": 53, "tcp_stream": null, "udp_stream": 50, "frame_number": 1423, "timestamp_epoch": "1550949997.308863000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "static.squarespace.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-3904550053c41aebe6c719f2", "src_port": 49963, "tcp_stream": null, "udp_stream": 60, "frame_number": 1425, "timestamp_epoch": "1550949997.309683000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-aaea9cc92a82cdfe2ca1d408", "src_port": 54061, "tcp_stream": null, "udp_stream": 61, "frame_number": 1426, "timestamp_epoch": "1550949997.310632000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "172.217.2.10", "dns.cname": "googleadapis.l.google.com", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 54061, "event_id": "evt-2f69e2b67ef81bc38a9f2f75", "src_port": 53, "tcp_stream": null, "udp_stream": 61, "frame_number": 1427, "timestamp_epoch": "1550949997.401197000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "151.101.64.238,151.101.128.238,151.101.192.238,151.101.0.238", "dns.cname": "prod.squarespace.map.fastly.net", "dns.qry.name": "static.squarespace.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 49963, "event_id": "evt-1b4ad465394af628fa0a8e17", "src_port": 53, "tcp_stream": null, "udp_stream": 60, "frame_number": 1429, "timestamp_epoch": "1550949997.407985000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-7d0295b2541d71ea4d254c70", "src_port": 54557, "tcp_stream": null, "udp_stream": 62, "frame_number": 1440, "timestamp_epoch": "1550949997.825696000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 54557, "event_id": "evt-4c68eaefe79e9c52d39eea50", "src_port": 53, "tcp_stream": null, "udp_stream": 62, "frame_number": 1441, "timestamp_epoch": "1550949997.877899000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-60c21f803cc794f52f29e2f3", "src_port": 62878, "tcp_stream": null, "udp_stream": 63, "frame_number": 1442, "timestamp_epoch": "1550949997.878519000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.aaaa": "fd3e:4f5a:5b81::1", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 62878, "event_id": "evt-566064fbbe6a9d3d1a280fa5", "src_port": 53, "tcp_stream": null, "udp_stream": 63, "frame_number": 1443, "timestamp_epoch": "1550949997.932320000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "use.typekit.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-dffbbd8b07a7a3e0035d64e8", "src_port": 63705, "tcp_stream": null, "udp_stream": 64, "frame_number": 1512, "timestamp_epoch": "1550949999.603647000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "23.63.25.226", "dns.cname": "use.typekit.net-v3.edgekey.net,e6653.f.akamaiedge.net", "dns.qry.name": "use.typekit.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 63705, "event_id": "evt-719ed52dc69797244bf894e9", "src_port": 53, "tcp_stream": null, "udp_stream": 64, "frame_number": 1515, "timestamp_epoch": "1550949999.720570000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "iecvlist.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-fa581486ccd1675192cb85e0", "src_port": 49481, "tcp_stream": null, "udp_stream": 65, "frame_number": 1839, "timestamp_epoch": "1550950013.988524000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "72.21.81.200", "dns.cname": "ie9comview.vo.msecnd.net,cs9.wpc.v0cdn.net", "dns.qry.name": "iecvlist.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 49481, "event_id": "evt-e959a136b6534322733e9f4d", "src_port": 53, "tcp_stream": null, "udp_stream": 65, "frame_number": 1840, "timestamp_epoch": "1550950014.051797000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-7da6a7a98ea9b91a34cdae1c", "src_port": 64987, "tcp_stream": null, "udp_stream": 66, "frame_number": 2059, "timestamp_epoch": "1550950019.929210000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "172.217.2.3", "dns.cname": "gstaticadssl.l.google.com", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 64987, "event_id": "evt-c94f70874c701a8d6e586e41", "src_port": 53, "tcp_stream": null, "udp_stream": 66, "frame_number": 2092, "timestamp_epoch": "1550950020.020502000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "p.typekit.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-9e082ec46d349832ecf2514a", "src_port": 65316, "tcp_stream": null, "udp_stream": 67, "frame_number": 2383, "timestamp_epoch": "1550950021.748523000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "23.63.25.226", "dns.cname": "p.typekit.net-v3.edgekey.net,e6653.dscf.akamaiedge.net", "dns.qry.name": "p.typekit.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 65316, "event_id": "evt-b96d642985496e8cdee4be57", "src_port": 53, "tcp_stream": null, "udp_stream": 67, "frame_number": 2408, "timestamp_epoch": "1550950021.846199000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.pdc._msdcs.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-1ccf048a020a82f05671f306", "src_port": 62566, "tcp_stream": null, "udp_stream": 68, "frame_number": 4395, "timestamp_epoch": "1550950076.073666000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "_ldap._tcp.pdc._msdcs.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 62566, "event_id": "evt-76bca5ecda11d65a591fb53f", "src_port": 53, "tcp_stream": null, "udp_stream": 68, "frame_number": 4396, "timestamp_epoch": "1550950076.073886000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "dicarkadar.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-75562d7df46255dab8d24eb8", "src_port": 59048, "tcp_stream": null, "udp_stream": 70, "frame_number": 6142, "timestamp_epoch": "1550950376.282884000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "181.215.47.171", "dns.qry.name": "dicarkadar.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 59048, "event_id": "evt-bd55caab5812a5487c623a59", "src_port": 53, "tcp_stream": null, "udp_stream": 70, "frame_number": 6143, "timestamp_epoch": "1550950376.813125000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-daefb9a42cb8eb80fc41f9a7", "src_port": 53432, "tcp_stream": null, "udp_stream": 71, "frame_number": 6150, "timestamp_epoch": "1550950399.114908000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 53432, "event_id": "evt-88926407e72ece1898dd84b6", "src_port": 53, "tcp_stream": null, "udp_stream": 71, "frame_number": 6151, "timestamp_epoch": "1550950399.176094000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-8ca0715ae3dd64c72c3dc062", "src_port": 55003, "tcp_stream": null, "udp_stream": 72, "frame_number": 6152, "timestamp_epoch": "1550950399.176507000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.aaaa": "fd3e:4f5a:5b81::1", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 55003, "event_id": "evt-52ecb4d1f8684ce04a975f24", "src_port": 53, "tcp_stream": null, "udp_stream": 72, "frame_number": 6153, "timestamp_epoch": "1550950399.176718000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "cranetisti.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-a55640f5699042b8cb96f030", "src_port": 51800, "tcp_stream": null, "udp_stream": 73, "frame_number": 6154, "timestamp_epoch": "1550950402.861168000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "185.246.116.239", "dns.qry.name": "cranetisti.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 51800, "event_id": "evt-95c6d68e945768b43dcbe4dd", "src_port": 53, "tcp_stream": null, "udp_stream": 73, "frame_number": 6155, "timestamp_epoch": "1550950403.232285000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-bb1cf69475ce356e44788aeb", "src_port": 59866, "tcp_stream": null, "udp_stream": 74, "frame_number": 6165, "timestamp_epoch": "1550950404.337831000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "8.253.129.66,8.252.250.126,67.26.187.254,8.252.15.254,8.253.203.254", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,fg.download.windowsupdate.com.c.footprint.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 59866, "event_id": "evt-e7e3bbba36e7ae40ca100756", "src_port": 53, "tcp_stream": null, "udp_stream": 74, "frame_number": 6167, "timestamp_epoch": "1550950404.667581000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "superhaps.pw", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-217c2c2e49e694c4bd0855f9", "src_port": 62933, "tcp_stream": null, "udp_stream": 75, "frame_number": 7506, "timestamp_epoch": "1550950467.015679000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "87.236.22.142", "dns.qry.name": "superhaps.pw", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 62933, "event_id": "evt-203f2278e1ec80d06edcf78f", "src_port": 53, "tcp_stream": null, "udp_stream": 75, "frame_number": 7515, "timestamp_epoch": "1550950467.267304000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "superhaps.pw", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-0721004815e547dab7f99174", "src_port": 58525, "tcp_stream": null, "udp_stream": 79, "frame_number": 10362, "timestamp_epoch": "1550950709.945992000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "87.236.22.142", "dns.qry.name": "superhaps.pw", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 58525, "event_id": "evt-904e672c152bcc298fb8295a", "src_port": 53, "tcp_stream": null, "udp_stream": 79, "frame_number": 10363, "timestamp_epoch": "1550950709.946337000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-04e20a6e70801c6f91e66554", "src_port": 52279, "tcp_stream": null, "udp_stream": 80, "frame_number": 10388, "timestamp_epoch": "1550950710.838951000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 52279, "event_id": "evt-25a3bee8ebe5c5afe0d3172c", "src_port": 53, "tcp_stream": null, "udp_stream": 80, "frame_number": 10389, "timestamp_epoch": "1550950710.839666000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "STORMTHEORY-DC.stormtheory.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-7a200817b8b7aba451e1c3c9", "src_port": 60662, "tcp_stream": null, "udp_stream": 82, "frame_number": 10621, "timestamp_epoch": "1550950711.062623000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "STORMTHEORY-DC.stormtheory.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 60662, "event_id": "evt-f439454328175b3b7be9f89f", "src_port": 53, "tcp_stream": null, "udp_stream": 82, "frame_number": 10622, "timestamp_epoch": "1550950711.062834000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "SUTTON-WIN-PC.stormtheory.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-9f05c617670156291ec3f1a6", "src_port": 64990, "tcp_stream": null, "udp_stream": 83, "frame_number": 10955, "timestamp_epoch": "1550950711.105255000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.109", "dns.qry.name": "SUTTON-WIN-PC.stormtheory.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 64990, "event_id": "evt-ad7d2dc329876d164d8b6866", "src_port": 53, "tcp_stream": null, "udp_stream": 83, "frame_number": 10956, "timestamp_epoch": "1550950711.107122000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-bf746438fe5389028a4deadc", "src_port": 53732, "tcp_stream": null, "udp_stream": 84, "frame_number": 11290, "timestamp_epoch": "1550950724.603184000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 53732, "event_id": "evt-cab3476ec8127a8573db9071", "src_port": 53, "tcp_stream": null, "udp_stream": 84, "frame_number": 11291, "timestamp_epoch": "1550950724.603463000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-a11b6b96b1aeccf62a51e862", "src_port": 49756, "tcp_stream": null, "udp_stream": 86, "frame_number": 11302, "timestamp_epoch": "1550950724.706000000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 49756, "event_id": "evt-cfac4844e7549ac0f3308603", "src_port": 53, "tcp_stream": null, "udp_stream": 86, "frame_number": 11303, "timestamp_epoch": "1550950724.706232000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-ab532a61cbdaffcab6519988", "src_port": 51672, "tcp_stream": null, "udp_stream": 88, "frame_number": 12444, "timestamp_epoch": "1550950760.052491000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 51672, "event_id": "evt-29a7b0cdc3d06d51ad24b1f6", "src_port": 53, "tcp_stream": null, "udp_stream": 88, "frame_number": 12445, "timestamp_epoch": "1550950760.052750000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-3dad1864541b9eafdf9d8ec4", "src_port": 62212, "tcp_stream": null, "udp_stream": 90, "frame_number": 12457, "timestamp_epoch": "1550950760.159727000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "10.2.23.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 62212, "event_id": "evt-ac5c3f2779b3a69d2c0b08cf", "src_port": 53, "tcp_stream": null, "udp_stream": 90, "frame_number": 12458, "timestamp_epoch": "1550950760.159942000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "wpad.stormtheory.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-bcc8ea2bf670a6f957457572", "src_port": 65138, "tcp_stream": null, "udp_stream": 94, "frame_number": 15021, "timestamp_epoch": "1550950823.596888000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.qry.name": "wpad.stormtheory.info", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 65138, "event_id": "evt-90cba2c58cd4ecc4fee98894", "src_port": 53, "tcp_stream": null, "udp_stream": 94, "frame_number": 15022, "timestamp_epoch": "1550950823.597365000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-38ddf79bdaf32a8488be8f30", "src_port": 62461, "tcp_stream": null, "udp_stream": 95, "frame_number": 15023, "timestamp_epoch": "1550950823.597824000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 62461, "event_id": "evt-fd5df27947bf87528a71647d", "src_port": 53, "tcp_stream": null, "udp_stream": 95, "frame_number": 15024, "timestamp_epoch": "1550950823.662806000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "crl.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-4d1057a0933213282e9cc07f", "src_port": 50377, "tcp_stream": null, "udp_stream": 97, "frame_number": 15210, "timestamp_epoch": "1550950826.266512000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "crl.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-0e5219de225f4b27d4981665", "src_port": 50377, "tcp_stream": null, "udp_stream": 97, "frame_number": 15218, "timestamp_epoch": "1550950827.277293000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "crl.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-2cef1e26cebd5bca3e8e15f5", "src_port": 50377, "tcp_stream": null, "udp_stream": 97, "frame_number": 15236, "timestamp_epoch": "1550950828.291339000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "crl.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-315fbc0125eab0237da07a27", "src_port": 50377, "tcp_stream": null, "udp_stream": 97, "frame_number": 15255, "timestamp_epoch": "1550950830.303739000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "crl.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-51bd7d1edaab7bb72943021f", "src_port": 50377, "tcp_stream": null, "udp_stream": 97, "frame_number": 15455, "timestamp_epoch": "1550950834.312890000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.qry.name": "crl.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "2", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 50377, "event_id": "evt-a3c9afc046207493ecb89377", "src_port": 53, "tcp_stream": null, "udp_stream": 97, "frame_number": 15656, "timestamp_epoch": "1550950837.917035000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "crl.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-c12e849ff16620f294db887c", "src_port": 63007, "tcp_stream": null, "udp_stream": 98, "frame_number": 15999, "timestamp_epoch": "1550950846.470491000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "23.218.156.17,23.218.156.10", "dns.cname": "crl.www.ms.akadns.net,a1363.dscg.akamai.net", "dns.qry.name": "crl.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 63007, "event_id": "evt-ca75b85c62453c0072db42bf", "src_port": 53, "tcp_stream": null, "udp_stream": 98, "frame_number": 16108, "timestamp_epoch": "1550950846.527507000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "wpad.stormtheory.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-7f7d51b22bb76eb86fa3dab6", "src_port": 49944, "tcp_stream": null, "udp_stream": 99, "frame_number": 19105, "timestamp_epoch": "1550950915.530407000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "wpad.stormtheory.info", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 49944, "event_id": "evt-7f20e23d66121122ebdb73c3", "src_port": 53, "tcp_stream": null, "udp_stream": 99, "frame_number": 19106, "timestamp_epoch": "1550950915.530640000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-0128bad3ff609b5939644933", "src_port": 63983, "tcp_stream": null, "udp_stream": 100, "frame_number": 19107, "timestamp_epoch": "1550950915.530943000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 63983, "event_id": "evt-4f31cbfd740cddbfe5aada0e", "src_port": 53, "tcp_stream": null, "udp_stream": 100, "frame_number": 19114, "timestamp_epoch": "1550950915.620746000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-26afbc7216bb66b0d11fb07f", "src_port": 53747, "tcp_stream": null, "udp_stream": 102, "frame_number": 19573, "timestamp_epoch": "1550950925.101210000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "72.21.81.240", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,wu.azureedge.net,wu.ec.azureedge.net,wu.wpc.apr-52dd2.edgecastdns.net,hlb.apr-52dd2-0.edgecastdns.net,cs11.wpc.v0cdn.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 53747, "event_id": "evt-db4958b5a275b70b650626fd", "src_port": 53, "tcp_stream": null, "udp_stream": 102, "frame_number": 19574, "timestamp_epoch": "1550950925.250935000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "ipecho.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-180fc2aacac7b5e42d2967b3", "src_port": 54176, "tcp_stream": null, "udp_stream": 103, "frame_number": 19780, "timestamp_epoch": "1550950931.732645000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "216.239.32.21,216.239.34.21,216.239.36.21,216.239.38.21", "dns.qry.name": "ipecho.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 54176, "event_id": "evt-4a81e43258638f658f7196bb", "src_port": 53, "tcp_stream": null, "udp_stream": 103, "frame_number": 19781, "timestamp_epoch": "1550950931.792794000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "superhaps.pw", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-0e7f67eeeb4b67c83c3d2c7b", "src_port": 54324, "tcp_stream": null, "udp_stream": 104, "frame_number": 23725, "timestamp_epoch": "1550951314.065320000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "87.236.22.142", "dns.qry.name": "superhaps.pw", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 54324, "event_id": "evt-a849701d0070f9d1cdc63188", "src_port": 53, "tcp_stream": null, "udp_stream": 104, "frame_number": 23726, "timestamp_epoch": "1550951314.312083000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "112.146.166.173.zen.spamhaus.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-65ae24fd4c79fe29228c935a", "src_port": 60427, "tcp_stream": null, "udp_stream": 105, "frame_number": 23842, "timestamp_epoch": "1550951375.399923000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "112.146.166.173.zen.spamhaus.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 60427, "event_id": "evt-be86fea07aa4b16172039ccd", "src_port": 53, "tcp_stream": null, "udp_stream": 105, "frame_number": 23843, "timestamp_epoch": "1550951375.522153000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "112.146.166.173.cbl.abuseat.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-ff6965dd43df0d48f9634908", "src_port": 53062, "tcp_stream": null, "udp_stream": 106, "frame_number": 23844, "timestamp_epoch": "1550951375.523039000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "112.146.166.173.cbl.abuseat.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 53062, "event_id": "evt-1d82bffc1d36777d872dd01c", "src_port": 53, "tcp_stream": null, "udp_stream": 106, "frame_number": 23845, "timestamp_epoch": "1550951375.636293000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "112.146.166.173.b.barracudacentral.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-42a328459287fed136b3a6eb", "src_port": 58069, "tcp_stream": null, "udp_stream": 107, "frame_number": 23846, "timestamp_epoch": "1550951375.637159000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "112.146.166.173.b.barracudacentral.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 58069, "event_id": "evt-adb87caee116806eb69230de", "src_port": 53, "tcp_stream": null, "udp_stream": 107, "frame_number": 23848, "timestamp_epoch": "1550951375.734445000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "112.146.166.173.dnsbl-1.uceprotect.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-d7cfb8e8f9ec181d50ba5a3e", "src_port": 51913, "tcp_stream": null, "udp_stream": 108, "frame_number": 23849, "timestamp_epoch": "1550951375.735581000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "112.146.166.173.dnsbl-1.uceprotect.net", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 51913, "event_id": "evt-f0f03a3d8e76ca8d7846fff3", "src_port": 53, "tcp_stream": null, "udp_stream": 108, "frame_number": 23850, "timestamp_epoch": "1550951375.880503000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "112.146.166.173.spam.dnsbl.sorbs.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-21aee22ac5c8ee7723676e2d", "src_port": 62977, "tcp_stream": null, "udp_stream": 109, "frame_number": 23851, "timestamp_epoch": "1550951375.881257000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "112.146.166.173.spam.dnsbl.sorbs.net", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 62977, "event_id": "evt-a57fd8ee187ec55ce28e4aa6", "src_port": 53, "tcp_stream": null, "udp_stream": 109, "frame_number": 23852, "timestamp_epoch": "1550951376.102761000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-9eb8a4becf5ade4e24185915", "src_port": 64818, "tcp_stream": null, "udp_stream": 110, "frame_number": 24135, "timestamp_epoch": "1550951414.749873000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 64818, "event_id": "evt-65ee86258325d779137fb799", "src_port": 53, "tcp_stream": null, "udp_stream": 110, "frame_number": 24136, "timestamp_epoch": "1550951414.750142000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "_ldap._tcp.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-12bbe4385f498da041500d7c", "src_port": 61120, "tcp_stream": null, "udp_stream": 111, "frame_number": 24137, "timestamp_epoch": "1550951414.750520000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.qry.name": "_ldap._tcp.Stormtheory-DC.stormtheory.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 61120, "event_id": "evt-b1142c0c9ded17a0c5c88530", "src_port": 53, "tcp_stream": null, "udp_stream": 111, "frame_number": 24138, "timestamp_epoch": "1550951414.750662000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.co.utah.ut.us", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-a88520490ebc34b0030578f8", "src_port": 57995, "tcp_stream": null, "udp_stream": 112, "frame_number": 24713, "timestamp_epoch": "1550951426.323411000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "161.119.42.22", "dns.qry.name": "www.co.utah.ut.us", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 57995, "event_id": "evt-3fe45e88cc9e33945c226194", "src_port": 53, "tcp_stream": null, "udp_stream": 112, "frame_number": 24717, "timestamp_epoch": "1550951426.486292000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-ff6d1cb1dd24aaa85e86dfc3", "src_port": 52002, "tcp_stream": null, "udp_stream": 113, "frame_number": 24733, "timestamp_epoch": "1550951426.961286000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.googletagmanager.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-2b1653dbc7131db8afe2d188", "src_port": 64583, "tcp_stream": null, "udp_stream": 114, "frame_number": 24740, "timestamp_epoch": "1550951426.973506000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "172.217.1.200", "dns.cname": "www-googletagmanager.l.google.com", "dns.qry.name": "www.googletagmanager.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 64583, "event_id": "evt-40363cd7fb81ccccf93a04b3", "src_port": 53, "tcp_stream": null, "udp_stream": 114, "frame_number": 24759, "timestamp_epoch": "1550951427.053264000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-e0ed53cd5ffbec8ba5f17225", "src_port": 52002, "tcp_stream": null, "udp_stream": 113, "frame_number": 24868, "timestamp_epoch": "1550951427.964847000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-f90a492ac002db61b1f2692e", "src_port": 52002, "tcp_stream": null, "udp_stream": 113, "frame_number": 24990, "timestamp_epoch": "1550951428.980007000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "172.217.2.10", "dns.cname": "googleadapis.l.google.com", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 52002, "event_id": "evt-bca944d17ac9e3ceb55d8a4f", "src_port": 53, "tcp_stream": null, "udp_stream": 113, "frame_number": 25109, "timestamp_epoch": "1550951430.255035000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-ff7a038c447e397583893baa", "src_port": 54136, "tcp_stream": null, "udp_stream": 115, "frame_number": 25118, "timestamp_epoch": "1550951430.384352000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-d186b7401e82eb9322963215", "src_port": 61160, "tcp_stream": null, "udp_stream": 116, "frame_number": 25119, "timestamp_epoch": "1550951430.384509000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-518fb67d692190bfba963f6c", "src_port": 55433, "tcp_stream": null, "udp_stream": 117, "frame_number": 25120, "timestamp_epoch": "1550951430.384807000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-bf0cfc0de7a6888146828533", "src_port": 60199, "tcp_stream": null, "udp_stream": 118, "frame_number": 25121, "timestamp_epoch": "1550951430.385017000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-c45b1c291b5b6613115a0fc7", "src_port": 61234, "tcp_stream": null, "udp_stream": 119, "frame_number": 25122, "timestamp_epoch": "1550951430.385119000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-334796960a31460ad865da21", "src_port": 56537, "tcp_stream": null, "udp_stream": 120, "frame_number": 25123, "timestamp_epoch": "1550951430.385453000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 61160, "event_id": "evt-c316450403dfec932fd9913b", "src_port": 53, "tcp_stream": null, "udp_stream": 116, "frame_number": 25140, "timestamp_epoch": "1550951430.455619000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 54136, "event_id": "evt-bc94a97caf2a67a3e04711ed", "src_port": 53, "tcp_stream": null, "udp_stream": 115, "frame_number": 25142, "timestamp_epoch": "1550951430.455767000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 60199, "event_id": "evt-f1529275b26a7ddd70c10006", "src_port": 53, "tcp_stream": null, "udp_stream": 118, "frame_number": 25145, "timestamp_epoch": "1550951430.455991000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 61234, "event_id": "evt-56f9da383534617007ad3846", "src_port": 53, "tcp_stream": null, "udp_stream": 119, "frame_number": 25147, "timestamp_epoch": "1550951430.456116000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 56537, "event_id": "evt-7977e3b2dd28f9bdcf7b02c3", "src_port": 53, "tcp_stream": null, "udp_stream": 120, "frame_number": 25148, "timestamp_epoch": "1550951430.456236000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 55433, "event_id": "evt-2dbe873aceef6cc72c79193e", "src_port": 53, "tcp_stream": null, "udp_stream": 117, "frame_number": 25151, "timestamp_epoch": "1550951430.456347000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "iecvlist.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": 53, "event_id": "evt-3b9d3b276fb7ffbf2fa7ab0a", "src_port": 65315, "tcp_stream": null, "udp_stream": 121, "frame_number": 27599, "timestamp_epoch": "1550951456.440109000" }, { "kind": "dns", "dst_ip": "10.2.23.109", "fields": { "dns.a": "72.21.81.200", "dns.cname": "ie9comview.vo.msecnd.net,cs9.wpc.v0cdn.net", "dns.qry.name": "iecvlist.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 65315, "event_id": "evt-46dddc14820571b0f59f0e60", "src_port": 53, "tcp_stream": null, "udp_stream": 121, "frame_number": 27600, "timestamp_epoch": "1550951456.504409000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "superhaps.pw", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-983ab086362fcc73357d00ce", "src_port": 50435, "tcp_stream": null, "udp_stream": 122, "frame_number": 28423, "timestamp_epoch": "1550951918.502707000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "87.236.22.142", "dns.qry.name": "superhaps.pw", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 50435, "event_id": "evt-b4244cb88b21204be02985b8", "src_port": 53, "tcp_stream": null, "udp_stream": 122, "frame_number": 28424, "timestamp_epoch": "1550951918.866154000" }, { "kind": "dns", "dst_ip": "10.2.23.2", "fields": { "dns.qry.name": "superhaps.pw", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": 53, "event_id": "evt-b9a2e613d552db77d44fd152", "src_port": 63203, "tcp_stream": null, "udp_stream": 123, "frame_number": 28847, "timestamp_epoch": "1550952526.030101000" }, { "kind": "dns", "dst_ip": "10.2.23.231", "fields": { "dns.a": "87.236.22.142", "dns.qry.name": "superhaps.pw", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.2.23.2", "dst_port": 63203, "event_id": "evt-c15c00a4c21da4b18cb92114", "src_port": 53, "tcp_stream": null, "udp_stream": 123, "frame_number": 28848, "timestamp_epoch": "1550952526.309792000" } ], "dhcp": [ { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "00:11:0a:9f:c0:2d", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:0a:9f:c0:2d,00:11:0a:9f:c0:2d", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Ferguson-Win-PC" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e85431bf31bc42567d1a1e7c", "src_port": null, "tcp_stream": null, "udp_stream": 11, "frame_number": 292, "timestamp_epoch": "1550949879.493176000" }, { "kind": "dhcp", "dst_ip": "10.2.23.231", "fields": { "eth.src": "00:04:c0:83:b4:1a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:0a:9f:c0:2d", "dhcp.option.dhcp": "5" }, "src_ip": "10.2.23.254", "dst_port": null, "event_id": "evt-859a384a816f4e374dcd0cd7", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 293, "timestamp_epoch": "1550949879.493272000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "20:cf:30:10:c7:2b", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "20:cf:30:10:c7:2b,20:cf:30:10:c7:2b", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Sutton-Win-PC" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-6f546a74c491f8ddf92a1295", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 493, "timestamp_epoch": "1550949917.544521000" }, { "kind": "dhcp", "dst_ip": "10.2.23.109", "fields": { "eth.src": "00:04:c0:83:b4:1a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "20:cf:30:10:c7:2b", "dhcp.option.dhcp": "5" }, "src_ip": "10.2.23.254", "dst_port": null, "event_id": "evt-4dc7a17034c056aa333a4fec", "src_port": null, "tcp_stream": null, "udp_stream": 32, "frame_number": 494, "timestamp_epoch": "1550949917.544618000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "20:cf:30:10:c7:2b", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "20:cf:30:10:c7:2b,20:cf:30:10:c7:2b", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Sutton-Win-PC" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ed2064dc6c93f264699decb4", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 1179, "timestamp_epoch": "1550949984.015382000" }, { "kind": "dhcp", "dst_ip": "10.2.23.109", "fields": { "eth.src": "00:04:c0:83:b4:1a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "20:cf:30:10:c7:2b", "dhcp.option.dhcp": "5" }, "src_ip": "10.2.23.254", "dst_port": null, "event_id": "evt-e99665525c9f668724c69d0f", "src_port": null, "tcp_stream": null, "udp_stream": 32, "frame_number": 1180, "timestamp_epoch": "1550949984.015463000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "00:11:0a:9f:c0:2d", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:0a:9f:c0:2d,00:11:0a:9f:c0:2d", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Ferguson-Win-PC" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-221ceb5e0d759f147661c140", "src_port": null, "tcp_stream": null, "udp_stream": 11, "frame_number": 3113, "timestamp_epoch": "1550950028.069692000" }, { "kind": "dhcp", "dst_ip": "10.2.23.231", "fields": { "eth.src": "00:04:c0:83:b4:1a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:0a:9f:c0:2d", "dhcp.option.dhcp": "5" }, "src_ip": "10.2.23.254", "dst_port": null, "event_id": "evt-10509f9f7ad4b357b94cbcde", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 3114, "timestamp_epoch": "1550950028.069767000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "20:cf:30:10:c7:2b", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "20:cf:30:10:c7:2b,20:cf:30:10:c7:2b", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Sutton-Win-PC" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-06e1a610c82a2150f6391532", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 14586, "timestamp_epoch": "1550950816.715592000" }, { "kind": "dhcp", "dst_ip": "10.2.23.109", "fields": { "eth.src": "00:04:c0:83:b4:1a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "20:cf:30:10:c7:2b", "dhcp.option.dhcp": "5" }, "src_ip": "10.2.23.254", "dst_port": null, "event_id": "evt-3c0e141e32234bce80bc819e", "src_port": null, "tcp_stream": null, "udp_stream": 32, "frame_number": 14587, "timestamp_epoch": "1550950816.715680000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "00:11:0a:9f:c0:2d", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:0a:9f:c0:2d,00:11:0a:9f:c0:2d", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Ferguson-Win-PC" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9cf96f1981a920228ada65f4", "src_port": null, "tcp_stream": null, "udp_stream": 11, "frame_number": 19103, "timestamp_epoch": "1550950915.527117000" }, { "kind": "dhcp", "dst_ip": "10.2.23.231", "fields": { "eth.src": "00:04:c0:83:b4:1a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:0a:9f:c0:2d", "dhcp.option.dhcp": "5" }, "src_ip": "10.2.23.254", "dst_port": null, "event_id": "evt-62d70a375fd9c54c1af20a44", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 19104, "timestamp_epoch": "1550950915.527174000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "00:11:0a:9f:c0:2d", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:0a:9f:c0:2d,00:11:0a:9f:c0:2d", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Ferguson-Win-PC" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a3e81b656835da89f8228987", "src_port": null, "tcp_stream": null, "udp_stream": 11, "frame_number": 24655, "timestamp_epoch": "1550951414.909026000" }, { "kind": "dhcp", "dst_ip": "10.2.23.231", "fields": { "eth.src": "00:04:c0:83:b4:1a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:0a:9f:c0:2d", "dhcp.option.dhcp": "5" }, "src_ip": "10.2.23.254", "dst_port": null, "event_id": "evt-d27eb1fce75a96c2b93dac8d", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 24656, "timestamp_epoch": "1550951414.909275000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "20:cf:30:10:c7:2b", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "20:cf:30:10:c7:2b,20:cf:30:10:c7:2b", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Sutton-Win-PC" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ad39cb7dba00346908728eb9", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 24715, "timestamp_epoch": "1550951426.475706000" }, { "kind": "dhcp", "dst_ip": "10.2.23.109", "fields": { "eth.src": "00:04:c0:83:b4:1a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "20:cf:30:10:c7:2b", "dhcp.option.dhcp": "5" }, "src_ip": "10.2.23.254", "dst_port": null, "event_id": "evt-63a82978cf9a1d5dd4826fee", "src_port": null, "tcp_stream": null, "udp_stream": 32, "frame_number": 24716, "timestamp_epoch": "1550951426.475796000" } ], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "FERGUSON-WIN-PC<20>,FERGUSON-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b1d1b605fac0c10ef342a201", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1550949876.172365000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:0a:9f:c0:2d", "dns.qry.name": "Ferguson-Win-PC" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1ae0bc0ef6a7ac7a0428ebcd", "src_port": null, "tcp_stream": null, "udp_stream": 1, "frame_number": 2, "timestamp_epoch": "1550949876.217560000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "10", "kerberos.CNameString": "ferguson-win-pc$" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f716e18bfcd73068a4ae127b", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 24, "timestamp_epoch": "1550949876.662904000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f81c1a703f077acfe87d1ec8", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 25, "timestamp_epoch": "1550949876.664845000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "10", "kerberos.CNameString": "ferguson-win-pc$" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-060487c87dc850375d802c9b", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 32, "timestamp_epoch": "1550949876.683669000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "FERGUSON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-60eb44139ce0dc5443856b0f", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 34, "timestamp_epoch": "1550949876.685054000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6d31d6c384f378b89e0916fc", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 43, "timestamp_epoch": "1550949876.698346000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "FERGUSON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-39fbc722a883b8e06b9a6ed7", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 46, "timestamp_epoch": "1550949876.701186000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a6a6a388686fb8333b0b9d3c", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 52, "timestamp_epoch": "1550949876.702314000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-03efee6065df95fa6eea83f7", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 54, "timestamp_epoch": "1550949876.702943000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "FERGUSON-WIN-PC<00>,FERGUSON-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-afeafc691762cada4e1176dc", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 83, "timestamp_epoch": "1550949876.857474000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-21e1ef722a6a991ba78311a3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 84, "timestamp_epoch": "1550949876.857681000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "FERGUSON-WIN-PC<20>,FERGUSON-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3ba9de10cd7049d61f9d502b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 85, "timestamp_epoch": "1550949876.935082000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "10", "kerberos.CNameString": "ruby.ferguson" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-eba477b3a22039a86574e187", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 96, "timestamp_epoch": "1550949877.406742000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-41a0e7566b75d416f8792bd8", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 97, "timestamp_epoch": "1550949877.407157000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "10", "kerberos.CNameString": "ruby.ferguson" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0085539d5ff1bd64b433bf3f", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 104, "timestamp_epoch": "1550949877.419022000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "ruby.ferguson" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f997396edbe09b904f1f7315", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 106, "timestamp_epoch": "1550949877.419814000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1e92cee1361fea35b7378e16", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 115, "timestamp_epoch": "1550949877.420894000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "ruby.ferguson" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-bdbc55115ccba573eabde151", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 118, "timestamp_epoch": "1550949877.421635000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6a7546b6ebd030c25340f127", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 124, "timestamp_epoch": "1550949877.426902000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-671afcffa436655d76acd15e", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 126, "timestamp_epoch": "1550949877.427482000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b3932b88766dc2e06db7eb4a", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 127, "timestamp_epoch": "1550949877.427839000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-cb29e720e1eccf716344b853", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 152, "timestamp_epoch": "1550949877.472646000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "ruby.ferguson" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cc294680264e5ddc28449750", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 155, "timestamp_epoch": "1550949877.473451000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8f7a1b7403b96ccb7fa81a89", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 161, "timestamp_epoch": "1550949877.474293000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e684e34832751aeaf6ea5e80", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 163, "timestamp_epoch": "1550949877.474857000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4a2a679987d5f5aaa24cab37", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 170, "timestamp_epoch": "1550949877.485116000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c983ba764edbefadebfb8786", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 172, "timestamp_epoch": "1550949877.486118000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5e7afb80e19f631cc27ea2be", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 185, "timestamp_epoch": "1550949877.540006000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b838092e4744616aaef01cdd", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 190, "timestamp_epoch": "1550949877.540776000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4ead5f67bca265693d1d033d", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 191, "timestamp_epoch": "1550949877.540891000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-95037a809b10b7f41fce1598", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 192, "timestamp_epoch": "1550949877.541033000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-850f4da462393a4d577d7581", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 193, "timestamp_epoch": "1550949877.541071000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4bdf8a43b58e1bd910d64ec2", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 194, "timestamp_epoch": "1550949877.541247000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8f14d760e31736574ddaef6e", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 199, "timestamp_epoch": "1550949877.542146000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-321ef66b4cba9de7292237ea", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 201, "timestamp_epoch": "1550949877.542519000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b41aee54e97e435b4313bdaf", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 209, "timestamp_epoch": "1550949877.543111000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "ruby.ferguson" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-916f55be311095d5eb7ccd13", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 212, "timestamp_epoch": "1550949877.544872000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c2841c7aa2deef12a756fea5", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 221, "timestamp_epoch": "1550949877.546614000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "ruby.ferguson" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4dbdabc42939cb1845440acf", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 224, "timestamp_epoch": "1550949877.546943000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ef8d5faade6c01c3f0452923", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 232, "timestamp_epoch": "1550949877.547692000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-374bd6c70a0ef67d804a1caa", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 233, "timestamp_epoch": "1550949877.548318000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5481edf4691554b7164c30d7", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 234, "timestamp_epoch": "1550949877.549510000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fac08af0d4ce84301b876733", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 235, "timestamp_epoch": "1550949877.549631000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-98821d67f49371aebcc8d984", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 236, "timestamp_epoch": "1550949877.550708000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-62c2e077787dea35840e5c93", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 237, "timestamp_epoch": "1550949877.551624000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-27e4e69af436a480b7157e8b", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 238, "timestamp_epoch": "1550949877.553440000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "FERGUSON-WIN-PC", "ntlmssp.auth.username": "ruby.ferguson" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a895f2f98c0dd04dc7b6d563", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 239, "timestamp_epoch": "1550949877.555162000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b105ce544453ea598bc07697", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 240, "timestamp_epoch": "1550949877.555943000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f219ca9e89134099172ce656", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 241, "timestamp_epoch": "1550949877.556219000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-be660861902a89d91cf06a94", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 242, "timestamp_epoch": "1550949877.556400000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1281fc1ee19d35843018eba4", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 243, "timestamp_epoch": "1550949877.556840000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2d088e96d0bb439aa3f50f16", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 244, "timestamp_epoch": "1550949877.563406000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d9be8bd2e20ef579b2b6932f", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 249, "timestamp_epoch": "1550949877.570243000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e4d7096091a0d64966b4da39", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 250, "timestamp_epoch": "1550949877.570447000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-da0e6239f7d9184315d8f125", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 251, "timestamp_epoch": "1550949877.570694000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-449f96f7ccf13f38a5109f41", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 255, "timestamp_epoch": "1550949877.573275000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a6cc13e6abd5631ea455b42a", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 256, "timestamp_epoch": "1550949877.573873000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a5a830bd5f878842040d4474", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 257, "timestamp_epoch": "1550949877.574699000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9e75ab38421d0fe022cd23be", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 258, "timestamp_epoch": "1550949877.574845000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-55fadae98bd649123be8c0d5", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 259, "timestamp_epoch": "1550949877.576103000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-40a1a0ac082efebf501c1f92", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 260, "timestamp_epoch": "1550949877.576541000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-81ef88558f381ab691ba6378", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 261, "timestamp_epoch": "1550949877.578090000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-31325aa859f7f662208cc512", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 262, "timestamp_epoch": "1550949877.578814000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-48d90b1f60ecf03f42836d91", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 267, "timestamp_epoch": "1550949877.621817000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "FERGUSON-WIN-PC<00>,FERGUSON-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-14149fee745e23185dde657d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 268, "timestamp_epoch": "1550949877.621970000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "FERGUSON-WIN-PC<20>,FERGUSON-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8fc79520b18f24a3dc9be335", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 271, "timestamp_epoch": "1550949877.699560000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f03f772d797fdd9bf13e618e", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 273, "timestamp_epoch": "1550949877.772081000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6eafeba79571f055fb4f60f9", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 274, "timestamp_epoch": "1550949877.772501000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5690a99d447114172aa65a8b", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 275, "timestamp_epoch": "1550949877.772691000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9744f01f0f387d1e0dd0a9ac", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 276, "timestamp_epoch": "1550949877.775165000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-062665c4ff43ff7c13dae828", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 277, "timestamp_epoch": "1550949877.775312000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "FERGUSON-WIN-PC<00>,FERGUSON-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3120c35464743d4830a91b07", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 284, "timestamp_epoch": "1550949878.388200000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-854bb3f091d2fbff22227481", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 285, "timestamp_epoch": "1550949878.388563000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "FERGUSON-WIN-PC<20>,FERGUSON-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c67ec913808eb985687038e1", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 286, "timestamp_epoch": "1550949878.465251000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b26a03f31a4e4ab9d4994a95", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 287, "timestamp_epoch": "1550949879.150287000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "FERGUSON-WIN-PC<00>,FERGUSON-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4c1e8e1b47cbd7037b57073e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 288, "timestamp_epoch": "1550949879.150469000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:0a:9f:c0:2d", "dns.qry.name": "Ferguson-Win-PC" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7480dc19906edc3cad6394ab", "src_port": null, "tcp_stream": null, "udp_stream": 10, "frame_number": 291, "timestamp_epoch": "1550949879.476358000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:0a:9f:c0:2d", "dns.qry.name": "wpad" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8b8f57cc4912f76a21843a14", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 298, "timestamp_epoch": "1550949879.554859000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:0a:9f:c0:2d", "dns.qry.name": "Ferguson-Win-PC" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7adee3cc260da505c7f2c8a4", "src_port": null, "tcp_stream": null, "udp_stream": 10, "frame_number": 299, "timestamp_epoch": "1550949879.572632000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:0a:9f:c0:2d", "dns.qry.name": "wpad" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e7e444047cb9f7c90918057d", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 302, "timestamp_epoch": "1550949879.650857000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-34fdef75599fa8b40d10bf35", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 304, "timestamp_epoch": "1550949879.852793000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1272dbd707f4a2104ac7fb3c", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 305, "timestamp_epoch": "1550949880.617784000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e3fe5079dca002bf686bee1d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 306, "timestamp_epoch": "1550949881.395579000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ef16b2135d969632ac149749", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 328, "timestamp_epoch": "1550949889.110594000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cf9c35c73bc670df0cf51d5a", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 329, "timestamp_epoch": "1550949889.110859000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c7de6a24fb75148a42073cf1", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 334, "timestamp_epoch": "1550949889.112110000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "FERGUSON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1c1eae4fdd4a21294ba6977b", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 337, "timestamp_epoch": "1550949889.114509000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8dd0970b88ba2b99b7393d80", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 346, "timestamp_epoch": "1550949889.115120000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "FERGUSON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c74dc067ae33fc84b81e2671", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 349, "timestamp_epoch": "1550949889.115398000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-290e58d32d53f03e75f9b3cc", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 357, "timestamp_epoch": "1550949889.116365000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-51f92195b3ce610bdea96bc3", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 358, "timestamp_epoch": "1550949889.116943000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-38898a604000f4c64fc1d552", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 359, "timestamp_epoch": "1550949889.117302000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1403059210f56e5e227bd973", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 360, "timestamp_epoch": "1550949889.117406000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-78b6c0b8cf810ad85ba28eff", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 361, "timestamp_epoch": "1550949889.117740000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2ce16746e6340b4260e6491d", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 362, "timestamp_epoch": "1550949889.117979000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-413e6f1b0359a5a1b09c0091", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 364, "timestamp_epoch": "1550949889.522386000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f7a5d6926290f0fdff9be877", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 365, "timestamp_epoch": "1550949889.522636000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d387293d7595540d55bb0388", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 366, "timestamp_epoch": "1550949889.522928000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1b2b115e9b82ecb0759801f1", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 367, "timestamp_epoch": "1550949889.523106000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a54f7e273779591eb97e952e", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 368, "timestamp_epoch": "1550949889.523424000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0d60c6a9ba97e3e1c8784cba", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 370, "timestamp_epoch": "1550949889.523633000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-dc28f6d43f7a89c6ec9b343a", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 371, "timestamp_epoch": "1550949889.523875000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b52a4bd53e8c7c603dea96c0", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 372, "timestamp_epoch": "1550949889.524002000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-49d5c6a08f3632caf4762384", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 373, "timestamp_epoch": "1550949889.524326000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0991992a6f43eb69e49b177f", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 375, "timestamp_epoch": "1550949889.524525000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e1b78a1327eb4d8e7533ca10", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 377, "timestamp_epoch": "1550949901.521602000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b72e20cb6e3c2362a2577715", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 378, "timestamp_epoch": "1550949901.521837000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5a3c93dc28cc83462bd779c8", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 379, "timestamp_epoch": "1550949901.522092000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-bee87bda99376ec108b2f205", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 380, "timestamp_epoch": "1550949901.522257000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "20:cf:30:10:c7:2b", "dns.qry.name": "Sutton-Win-PC" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-b6c4749514c6d026f1835310", "src_port": null, "tcp_stream": null, "udp_stream": 21, "frame_number": 397, "timestamp_epoch": "1550949914.331138000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<00>,SUTTON-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-f77686b3ea7d2259c7d340d7", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 400, "timestamp_epoch": "1550949914.394571000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-2a828d39ba0171a03cec75c1", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 401, "timestamp_epoch": "1550949914.394756000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<20>,SUTTON-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-495ea8c1c01c1624e9830f23", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 402, "timestamp_epoch": "1550949914.394937000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "20:cf:30:10:c7:2b", "dns.qry.name": "Sutton-Win-PC" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-e628b480021118e69089f97b", "src_port": null, "tcp_stream": null, "udp_stream": 21, "frame_number": 403, "timestamp_epoch": "1550949914.425379000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "10", "kerberos.CNameString": "sutton-win-pc$" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-67e207fc2ed3fb033ee0c9c5", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 425, "timestamp_epoch": "1550949914.824781000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c3d58c2bcbcbe995d79bd343", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 426, "timestamp_epoch": "1550949914.826607000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "10", "kerberos.CNameString": "sutton-win-pc$" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-e85b3c083114b93095ac975f", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 433, "timestamp_epoch": "1550949914.843629000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "SUTTON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-658e190b04535740939100c1", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 435, "timestamp_epoch": "1550949914.844221000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-52ec87e05c7031b8260b6e5d", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 444, "timestamp_epoch": "1550949914.846184000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SUTTON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2725b1b77cdb3e18f9fab826", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 447, "timestamp_epoch": "1550949914.847512000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-10299c3e4206448633821176", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 453, "timestamp_epoch": "1550949914.848560000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-970ac2ef1e4653d819787dab", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 455, "timestamp_epoch": "1550949914.849135000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<20>,SUTTON-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-88cc3d225f71ae81f8053a07", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 482, "timestamp_epoch": "1550949915.907515000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-1b7930fcde0dc452a3a5d6f6", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 483, "timestamp_epoch": "1550949915.907612000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<00>,SUTTON-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-3cf7ccfa3c444909a8e4ed74", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 484, "timestamp_epoch": "1550949915.907663000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<00>,SUTTON-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ff50dc23e8927b3c08141cfe", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 487, "timestamp_epoch": "1550949917.421163000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-a3b00d6a8497e7419846ac08", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 488, "timestamp_epoch": "1550949917.421253000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<20>,SUTTON-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-49811c08a40275953af46795", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 489, "timestamp_epoch": "1550949917.421301000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "20:cf:30:10:c7:2b", "dns.qry.name": "Sutton-Win-PC" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-4cb243adeedcbbd67720d78c", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 492, "timestamp_epoch": "1550949917.538218000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "20:cf:30:10:c7:2b", "dns.qry.name": "wpad" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-640a59a0531dcca0f311288b", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 499, "timestamp_epoch": "1550949917.551698000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "20:cf:30:10:c7:2b", "dns.qry.name": "Sutton-Win-PC" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-15755abb7111b432daa7ec7b", "src_port": null, "tcp_stream": null, "udp_stream": 30, "frame_number": 500, "timestamp_epoch": "1550949917.640448000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "20:cf:30:10:c7:2b", "dns.qry.name": "wpad" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-78037ec162677c2a3cd1f9af", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 501, "timestamp_epoch": "1550949917.654985000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-1d9a361deb6a8e938a0a800e", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 502, "timestamp_epoch": "1550949917.858129000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<00>,SUTTON-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-3eb0052a849bb64fd25ddb09", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 504, "timestamp_epoch": "1550949918.965191000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-c6061b1eef1818ddb35b0837", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 505, "timestamp_epoch": "1550949918.965412000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<20>,SUTTON-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-7af339a177c082a92578d09f", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 506, "timestamp_epoch": "1550949918.965588000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-8cd9c7e05823f1b3684a7cf4", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 508, "timestamp_epoch": "1550949919.370655000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "10", "kerberos.CNameString": "byron.sutton" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-f5bbad891bf6d06df66f3151", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 511, "timestamp_epoch": "1550949919.370910000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-713a0d2c3228069d049422b1", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 512, "timestamp_epoch": "1550949919.372267000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "10", "kerberos.CNameString": "byron.sutton" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ef6dcfa447fe067b9966ab4d", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 519, "timestamp_epoch": "1550949919.383115000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "byron.sutton" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4e48be21e3c090ab6c52df06", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 521, "timestamp_epoch": "1550949919.383637000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-5465a1a98a8cb9f08b322341", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 530, "timestamp_epoch": "1550949919.384515000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "byron.sutton" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a4b72e166ca18175d05b1b84", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 533, "timestamp_epoch": "1550949919.385468000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<20>,SUTTON-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-e796731d7e05545b51ea396e", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 538, "timestamp_epoch": "1550949919.729383000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-9b79281015515a9b50b78c61", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 539, "timestamp_epoch": "1550949919.729590000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<00>,SUTTON-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-678fea59c55ab0e5b6ca0c0f", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 540, "timestamp_epoch": "1550949919.729674000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-4b6e0f12a5e17cd1923bd32a", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 554, "timestamp_epoch": "1550949919.927002000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "byron.sutton" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-080eefc37cb9ee867af5203f", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 557, "timestamp_epoch": "1550949919.927703000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-bca2493e5d30986168cf78aa", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 563, "timestamp_epoch": "1550949919.928239000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1b43ea60e500350e9a2645d9", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 565, "timestamp_epoch": "1550949919.928688000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-eacef6da82ba7ae5865d9c2a", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 566, "timestamp_epoch": "1550949919.928822000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-85c256042060362f2a740337", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 580, "timestamp_epoch": "1550949919.991898000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-71f7dfc079f61614beec3ace", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 581, "timestamp_epoch": "1550949919.992017000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-032b801844751e8dcf1aa782", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 582, "timestamp_epoch": "1550949919.992204000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-6b677901524f9ffe91f4b3a5", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 587, "timestamp_epoch": "1550949919.993596000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "byron.sutton" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-653cbacbe00bae19c1e5b02b", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 590, "timestamp_epoch": "1550949919.994396000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-c3c0fd277078be99b3977fc2", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 599, "timestamp_epoch": "1550949919.995013000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "byron.sutton" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d8414ce38bbb82d51c57d0eb", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 602, "timestamp_epoch": "1550949919.995288000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-33188660b9be90360877cf7b", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 610, "timestamp_epoch": "1550949919.995755000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-87dc6d3cacd82ad0cf5186e5", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 611, "timestamp_epoch": "1550949919.996382000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-85346432df02137a27b519bd", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 612, "timestamp_epoch": "1550949919.996714000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-db459f3e7eb01a4f4979d6cc", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 613, "timestamp_epoch": "1550949919.996899000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-c3c6b8d479dbc4bbcc41edc6", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 614, "timestamp_epoch": "1550949919.997496000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5ed6b53667731c8ac72e4336", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 615, "timestamp_epoch": "1550949920.108909000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ecccbf92b3535daf99526570", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 616, "timestamp_epoch": "1550949920.112209000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3f429444455f7c1c82fc2ae3", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 617, "timestamp_epoch": "1550949920.112394000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-27feb8485557e129eb6b7a09", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 634, "timestamp_epoch": "1550949920.125087000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "byron.sutton" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1c5ac643ac049f22a759ef5e", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 637, "timestamp_epoch": "1550949920.125815000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-00c59ec1c40cb8b492af107d", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 643, "timestamp_epoch": "1550949920.127670000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d836099324e10b7af00ec6c4", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 645, "timestamp_epoch": "1550949920.128325000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-8351ed1e291ec6fe39ffdc05", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 653, "timestamp_epoch": "1550949920.137467000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-056819737d47c5a6aa47e470", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 655, "timestamp_epoch": "1550949920.138197000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-db3b55113427326be113da97", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 668, "timestamp_epoch": "1550949920.144275000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-55da50b3df4bc1cd6feb2f31", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 669, "timestamp_epoch": "1550949920.144417000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-54ac1fc38a105f46b78d01b7", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 670, "timestamp_epoch": "1550949920.144743000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-76f46f8388276340ee777ec8", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 675, "timestamp_epoch": "1550949920.145744000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-978652508590a8e4a8181cb6", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 677, "timestamp_epoch": "1550949920.146076000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-d9f5d8bf92dd830a5296441c", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 681, "timestamp_epoch": "1550949920.155068000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4865bb9487d27a5f701db8c2", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 682, "timestamp_epoch": "1550949920.155632000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "SUTTON-WIN-PC", "ntlmssp.auth.username": "byron.sutton" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-2dbe7ab29edcd08887b5a290", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 683, "timestamp_epoch": "1550949920.156300000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ea4b28b188c4092105d20bd4", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 684, "timestamp_epoch": "1550949920.157109000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-32000af1076a86a7a50ac571", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 685, "timestamp_epoch": "1550949920.157474000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b39f72e674191d97f43547f5", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 686, "timestamp_epoch": "1550949920.157615000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-4cc5b9a60d78098195f0db43", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 687, "timestamp_epoch": "1550949920.158217000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-56a166c145dd3adde0a71d09", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 688, "timestamp_epoch": "1550949920.158480000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e89e3dcf12edcf512fd9e8d6", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 693, "timestamp_epoch": "1550949920.160769000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-20a9416507d9c7fa77760f6a", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 694, "timestamp_epoch": "1550949920.160980000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-75c74179aff5a859acea5d0d", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 695, "timestamp_epoch": "1550949920.161271000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-8256d455d17c557f8484954d", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 699, "timestamp_epoch": "1550949920.162514000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9dfcfb4d205bf4f04d480b8a", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 700, "timestamp_epoch": "1550949920.163145000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-e2909672b588ae0d78ba9a2a", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 701, "timestamp_epoch": "1550949920.163710000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9cc38840b430f8dfd641759e", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 702, "timestamp_epoch": "1550949920.163889000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-c3859a9f541a4d8087e3e016", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 703, "timestamp_epoch": "1550949920.164431000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-de16e0bc9b403699f6701b38", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 704, "timestamp_epoch": "1550949920.164851000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-08a2710714993d665ab3726d", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 705, "timestamp_epoch": "1550949920.165250000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2e6bdc368ac4695f72cd5038", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 706, "timestamp_epoch": "1550949920.165446000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<00>,SUTTON-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ed643a565614ca713ae565bc", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 713, "timestamp_epoch": "1550949920.493943000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-32bba24cb099e5537768033e", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 714, "timestamp_epoch": "1550949920.494255000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<20>,SUTTON-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-dae921bd37fdde8f83dfb2e3", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 715, "timestamp_epoch": "1550949920.494390000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-f4629075857296b3199933ed", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 720, "timestamp_epoch": "1550949920.883784000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<20>,SUTTON-WIN-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-04e6090874bf68c765a7d070", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 721, "timestamp_epoch": "1550949921.259548000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-6a800cb9f257f016cca36e18", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 722, "timestamp_epoch": "1550949921.259662000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "SUTTON-WIN-PC<00>,SUTTON-WIN-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-49e783253dfa9e336b20769b", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 723, "timestamp_epoch": "1550949921.259735000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-3e2e87b0ac578184f8c45386", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 724, "timestamp_epoch": "1550949922.406904000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-4a1c5a32328954382a8e49b4", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 729, "timestamp_epoch": "1550949923.156738000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-c0bf04cfbd630f99e47e8d21", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 730, "timestamp_epoch": "1550949923.919662000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-2a293f43ebe65810b48f1087", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 757, "timestamp_epoch": "1550949925.330788000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fc079dbb931fbc754f3df77f", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 758, "timestamp_epoch": "1550949925.331037000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-75b6fe790d22d18e7e3ede92", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 763, "timestamp_epoch": "1550949925.332130000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SUTTON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6c04888a5bf34bb8acff75c8", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 766, "timestamp_epoch": "1550949925.332914000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-e3806e95b78e1e7abf271e06", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 775, "timestamp_epoch": "1550949925.333574000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SUTTON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e980ac9056294f63bfaf7eab", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 778, "timestamp_epoch": "1550949925.333884000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ffbd803b1c2d6773a5e002bc", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 786, "timestamp_epoch": "1550949925.334668000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-908a34fa21baba9d863c235c", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 787, "timestamp_epoch": "1550949925.335213000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-70362b3000d09c3376a52d4e", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 788, "timestamp_epoch": "1550949925.335579000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-050d4747a337a3f2f921f7f9", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 789, "timestamp_epoch": "1550949925.335704000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-6d234237c1475c31123e1b83", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 790, "timestamp_epoch": "1550949925.336033000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1e75a7a1673268e20d330c58", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 791, "timestamp_epoch": "1550949925.336175000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-56caa8d2afa47314468de524", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 792, "timestamp_epoch": "1550949925.336456000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-8626171e9247b9b3e9b57665", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 793, "timestamp_epoch": "1550949925.336587000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-d14a9923805cb07cc1197d09", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 801, "timestamp_epoch": "1550949930.815153000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-bd84d4796cedb7fa7fc63a34", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 802, "timestamp_epoch": "1550949930.815370000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-a4cab14c3d99c36cf64f2e97", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 803, "timestamp_epoch": "1550949930.815614000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a09422eb3128c823c943bfd9", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 804, "timestamp_epoch": "1550949930.815742000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-0a325e96d88bc1a9d62849f1", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 805, "timestamp_epoch": "1550949930.815957000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-11bd249d21f7d8ec33012443", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 806, "timestamp_epoch": "1550949930.816105000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-81efc05810dc530497fb2209", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 809, "timestamp_epoch": "1550949936.820872000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-df7d07d85ca56b6c284b70ef", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 810, "timestamp_epoch": "1550949936.821048000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-6a3fa99354cd8da9fbea73eb", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 811, "timestamp_epoch": "1550949936.821238000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-61a152be847de29a9c5e43a8", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 812, "timestamp_epoch": "1550949936.821525000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-d9caba77af2b17b4fcf86bbb", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 813, "timestamp_epoch": "1550949936.821793000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-42cf2d7a884d39b7d31d4905", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 815, "timestamp_epoch": "1550949936.822215000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-186b4bd9f8bbe1871899205f", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 816, "timestamp_epoch": "1550949936.822396000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-28e0498ec6915e156dad61d8", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 817, "timestamp_epoch": "1550949936.822508000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "10", "kerberos.CNameString": "ferguson-win-pc$" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c416a5551b0cea6d3defc2f0", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 824, "timestamp_epoch": "1550949937.298595000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fba92a4b61b614e050efd7dc", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 825, "timestamp_epoch": "1550949937.299128000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "10", "kerberos.CNameString": "ferguson-win-pc$" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-010b5d559c56bf144eea7a9e", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 832, "timestamp_epoch": "1550949937.316268000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "FERGUSON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-75a4b63490d40fed920b6286", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 834, "timestamp_epoch": "1550949937.316946000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4b5d232acfcf2c2a8947ac4b", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 843, "timestamp_epoch": "1550949937.317962000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "FERGUSON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-54b0c88536b95d398ca2983d", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 846, "timestamp_epoch": "1550949937.318681000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4ade528eb36c391bbf9b05f0", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 852, "timestamp_epoch": "1550949937.319283000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d87d7c8872433385b34b1e3a", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 854, "timestamp_epoch": "1550949937.319768000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-982d243182470703ede75550", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 855, "timestamp_epoch": "1550949937.319979000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2db8c341ad09e0f1472ce28d", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 875, "timestamp_epoch": "1550949937.846826000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-34539332b8e3fb77c4ade5ae", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 877, "timestamp_epoch": "1550949937.847436000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f08c43b302e447f5861bdda2", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 882, "timestamp_epoch": "1550949937.852560000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "FERGUSON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-15cbe0a851a5cabd2927a386", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 885, "timestamp_epoch": "1550949937.853682000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-af646ae3dad3fa21b130686d", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 897, "timestamp_epoch": "1550949937.869770000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cfc681c939c112511d5909a5", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 900, "timestamp_epoch": "1550949937.870555000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0222d746d2f6a88ad40e01af", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 905, "timestamp_epoch": "1550949937.871480000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "FERGUSON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b6c59c68e92ddff328330535", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 911, "timestamp_epoch": "1550949937.873385000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4545c38777f9f074dea3a8b2", "src_port": null, "tcp_stream": 56, "udp_stream": null, "frame_number": 920, "timestamp_epoch": "1550949937.874153000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-087712a8a93632ac5ba380dc", "src_port": null, "tcp_stream": 56, "udp_stream": null, "frame_number": 922, "timestamp_epoch": "1550949937.874600000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c8a5fb662c388bb3c9a8e384", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 931, "timestamp_epoch": "1550949937.894945000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-dccd3c8fc7616c99b4f491ba", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 932, "timestamp_epoch": "1550949937.895084000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0d76a570c0ee66cb2663f714", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 933, "timestamp_epoch": "1550949937.895258000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e94b8188ac44da841f4ac4ab", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 938, "timestamp_epoch": "1550949937.896518000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "FERGUSON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ad5a7051eaa1e8d3506a02a5", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 941, "timestamp_epoch": "1550949937.897286000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c171fab4e322cb3e124e6655", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 950, "timestamp_epoch": "1550949937.898086000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "FERGUSON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1eb568f4aa9f227d3e42b996", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 953, "timestamp_epoch": "1550949937.898388000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5e8fb6485115dc6d023869f2", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 961, "timestamp_epoch": "1550949937.899126000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7d3f6f4d2dc07511a17425ed", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 962, "timestamp_epoch": "1550949937.899619000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-aed530c586408fa7a1d31535", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 963, "timestamp_epoch": "1550949937.900052000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-99a43d58f58182eb0aa4da1e", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 964, "timestamp_epoch": "1550949937.900198000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-bbec5707597b5907d0f55867", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 965, "timestamp_epoch": "1550949937.900537000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-88d2dd59f47b85431c5c200e", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 966, "timestamp_epoch": "1550949937.900804000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7f19d422df2f8462ee2ba82d", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 967, "timestamp_epoch": "1550949937.901065000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9ba051f1b39ad61e21d4534c", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 968, "timestamp_epoch": "1550949937.901217000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-45bd873415462a51b8d1202c", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 998, "timestamp_epoch": "1550949960.807054000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a44ed4f65a711e8d0d3e2d5c", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 999, "timestamp_epoch": "1550949960.807268000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c06d22ece6ab32419a830802", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 1000, "timestamp_epoch": "1550949960.807439000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ba9763e18d1ce0d20c435ef0", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 1001, "timestamp_epoch": "1550949960.916867000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-47701d3c27c3bdca2265c542", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1003, "timestamp_epoch": "1550949961.520608000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7d7c019e3139976debf035f4", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1004, "timestamp_epoch": "1550949961.520915000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-774eb0f5a0e50f3a7b108909", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 1014, "timestamp_epoch": "1550949973.517644000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-82982beba3101d060a517468", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 1015, "timestamp_epoch": "1550949973.517998000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-cf927bf9ede4b91748719069", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1016, "timestamp_epoch": "1550949973.518392000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5e6a46eb1dd67b91c46bb365", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1017, "timestamp_epoch": "1550949973.518668000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-09735b27bc60dc40435b64bd", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1018, "timestamp_epoch": "1550949973.518905000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3f3ffc1cb1ead0b8a5a97b2f", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1019, "timestamp_epoch": "1550949973.519183000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "10", "kerberos.CNameString": "sutton-win-pc$" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ee047ede3f6efb4fd2861b45", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1027, "timestamp_epoch": "1550949975.131962000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-eb08420fd06fc0c0ae9efefe", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1028, "timestamp_epoch": "1550949975.132669000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "10", "kerberos.CNameString": "sutton-win-pc$" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-74c72c07efaf98e99447167d", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 1035, "timestamp_epoch": "1550949975.149951000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "SUTTON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f4dfb02669e3762aa80bedef", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 1037, "timestamp_epoch": "1550949975.150727000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-5b3fdce8062482b2ae92f0aa", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1046, "timestamp_epoch": "1550949975.151811000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SUTTON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d45f674db8d93226065ea1c4", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1049, "timestamp_epoch": "1550949975.152387000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-2333d2f2df1fa0c05840087b", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 1055, "timestamp_epoch": "1550949975.152911000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e668c21715099ecd5256bb67", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 1057, "timestamp_epoch": "1550949975.153414000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-645915e24babf28fd761450d", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 1058, "timestamp_epoch": "1550949975.153687000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-5b598df7a051d3f6ff4361e5", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1074, "timestamp_epoch": "1550949975.677202000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1b7b47fd7f9d11adae5175ee", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1076, "timestamp_epoch": "1550949975.677926000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-92c2b9a5d22304fba2944f5d", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1081, "timestamp_epoch": "1550949975.683036000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SUTTON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e090b7d9e03800b752ccc278", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1084, "timestamp_epoch": "1550949975.683772000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-33c756331c005139387f5bac", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 1094, "timestamp_epoch": "1550949975.685886000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SUTTON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cf7d0259e22170dd9bd100ed", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 1098, "timestamp_epoch": "1550949975.687054000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-e23d76002ce6882d6db8bf9b", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 1107, "timestamp_epoch": "1550949975.687837000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-8905dab95265b69e81f53223", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 1109, "timestamp_epoch": "1550949975.688335000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-68a48bea750556aa3eae5b90", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 1117, "timestamp_epoch": "1550949975.690069000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e6649d1d08c2d780cbcaa952", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 1119, "timestamp_epoch": "1550949975.690548000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4c69a50941abf06268ba41ec", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1130, "timestamp_epoch": "1550949975.695335000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ef2a7fdff612dd673272bfaf", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1131, "timestamp_epoch": "1550949975.695470000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-375654a2a71dddac3b8b16cf", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1132, "timestamp_epoch": "1550949975.695659000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-608376c5801788b3d9255a43", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1137, "timestamp_epoch": "1550949975.696695000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SUTTON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-97d9c9a9b998d92fd011fe14", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1140, "timestamp_epoch": "1550949975.697491000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-3e65a943d6df5af8786539db", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1149, "timestamp_epoch": "1550949975.698192000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SUTTON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cd357f51979b752b4ceee18e", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1152, "timestamp_epoch": "1550949975.698475000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-3efdf312580d876f3cd8ef3d", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1160, "timestamp_epoch": "1550949975.699059000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-bac84b773cfb230b3c2eb2c4", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1161, "timestamp_epoch": "1550949975.699578000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-33ee92aad146f8b74f9fa866", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1162, "timestamp_epoch": "1550949975.699946000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-24ab012609ba25f2a9d19342", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1163, "timestamp_epoch": "1550949975.700051000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-14941c77a464f99feeafcc02", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1164, "timestamp_epoch": "1550949975.700370000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d0e422fe4d0a7020151e965e", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1165, "timestamp_epoch": "1550949975.700605000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-51ccc54cc02dd901827fd758", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1166, "timestamp_epoch": "1550949975.700867000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a5c39b021550bd87409152ad", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1167, "timestamp_epoch": "1550949975.700977000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-2a2860e2c51fab1ce57be424", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 1178, "timestamp_epoch": "1550949984.012106000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-1742c1e9bdff7c428bde70c4", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 1199, "timestamp_epoch": "1550949985.513462000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-cb691dcc502f8692492d6fb9", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 1272, "timestamp_epoch": "1550949987.027352000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-e6269cefe7ea16a2fd020423", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 1324, "timestamp_epoch": "1550949988.571963000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-95e92cfde52c68cb6d535d6b", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 1363, "timestamp_epoch": "1550949989.336825000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-4985814fd0bed779ef7ba484", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 1395, "timestamp_epoch": "1550949990.100815000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1c00f64a6a0cf94c73ac6dce", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 1420, "timestamp_epoch": "1550949996.104675000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "USE.TYPEKIT.NET<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-cdd3806677785fc363473035", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 1424, "timestamp_epoch": "1550949997.309569000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d2ea81e0cd998a14bb191c8d", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 1435, "timestamp_epoch": "1550949997.617393000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "USE.TYPEKIT.NET<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-5d21642f527d4345b7c24288", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 1449, "timestamp_epoch": "1550949998.073471000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "USE.TYPEKIT.NET<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-095147e74194b0dc2ef592fc", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 1478, "timestamp_epoch": "1550949998.836351000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b3af9037dd98f63ac693f0fe", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 1492, "timestamp_epoch": "1550949999.130514000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-01d614b453ea1fedbe813b37", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1638, "timestamp_epoch": "1550950002.815429000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1591700137a268a027f40969", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1639, "timestamp_epoch": "1550950002.815950000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-75482898a33bf3337a2e83d4", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 1725, "timestamp_epoch": "1550950009.472384000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c4d3418cc651a5adfa2d38b1", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 1726, "timestamp_epoch": "1550950009.472735000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-a2ec11b14b745d8ca9d805a2", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1883, "timestamp_epoch": "1550950014.812026000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-09d0f4b0d31cd6740697c7c1", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1884, "timestamp_epoch": "1550950014.812263000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-abd630aa13edf25b1eaf1edd", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1885, "timestamp_epoch": "1550950014.812531000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7ff2e9a99c215a57a56544cf", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 1886, "timestamp_epoch": "1550950014.812677000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a3aa66e5677518436a99c3c4", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3045, "timestamp_epoch": "1550950027.677087000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0e6734101266f4dc6bf016da", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3046, "timestamp_epoch": "1550950027.677231000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5e00b76a2d91c6d26cd7ba7f", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3047, "timestamp_epoch": "1550950027.677446000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ce3faddbcb2db294b71dcdc2", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3051, "timestamp_epoch": "1550950027.680956000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6a92e03ee9d38e07ec916a98", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3052, "timestamp_epoch": "1550950027.681995000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-db8355e21667c5614e244318", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3053, "timestamp_epoch": "1550950027.682485000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ba903e5202a83be139c233a4", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3054, "timestamp_epoch": "1550950027.682642000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-708aa61a7d5b06b59fee8212", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3055, "timestamp_epoch": "1550950027.682987000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-34a804033e2d66d0f500d94d", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3056, "timestamp_epoch": "1550950027.683202000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0aed4896b022735b8d9f4337", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3057, "timestamp_epoch": "1550950027.683364000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2effe59dd31a291f67e6bf5f", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3058, "timestamp_epoch": "1550950027.683490000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1d87535d2abaccb381554930", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 3063, "timestamp_epoch": "1550950027.684767000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "ruby.ferguson" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-41e28d9546dfc526bf97d399", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 3066, "timestamp_epoch": "1550950027.686127000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-42502df37b7bab15a5af54a5", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3072, "timestamp_epoch": "1550950027.686653000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-8521e3fe7d8125c354f2e5be", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3074, "timestamp_epoch": "1550950027.687130000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-90f9956e1568f34aaaf233ab", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3075, "timestamp_epoch": "1550950027.687324000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-600c49a82bd5b8887de50eb8", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3076, "timestamp_epoch": "1550950027.687428000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fa6827b02e3a4b152bc7d9fb", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3077, "timestamp_epoch": "1550950027.687672000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-60aabd69bf4bba6f8490dd17", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3078, "timestamp_epoch": "1550950027.687874000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a545338832860dfa6e2a481f", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3079, "timestamp_epoch": "1550950027.688060000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fe92d80225b1c4cb8f8b6282", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3080, "timestamp_epoch": "1550950027.688223000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5bfa3638a50c8a6ca1878a0a", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3081, "timestamp_epoch": "1550950027.688546000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b67216fe3da3b2bca54fe9c1", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3082, "timestamp_epoch": "1550950027.693258000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ee91f337434dba78a1458602", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3083, "timestamp_epoch": "1550950027.693510000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-94f3cba9a350059b84637343", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3084, "timestamp_epoch": "1550950027.693728000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2ef3e6a9aee33d09ac8f030e", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3085, "timestamp_epoch": "1550950027.870568000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a689b3ea521701ec0bab15b6", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3086, "timestamp_epoch": "1550950027.870866000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8c825c9b0da78b665ea30c56", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3087, "timestamp_epoch": "1550950027.871083000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d72f1c3008b8ef688a642880", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3088, "timestamp_epoch": "1550950027.871226000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-734fea1647b66cf2974d4af7", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3090, "timestamp_epoch": "1550950027.871663000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ad30e9f30f42f8b3bba0a487", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3092, "timestamp_epoch": "1550950027.872321000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d206c82c376b0b37b5ca749c", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3093, "timestamp_epoch": "1550950027.872574000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5f598acb8b4dc494f8b9ecc3", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3094, "timestamp_epoch": "1550950027.872768000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c02c83916d5a7d6e974da1a8", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3095, "timestamp_epoch": "1550950027.873137000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a8ccb19534afc3d7b0dbf950", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3096, "timestamp_epoch": "1550950027.873519000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0e1d2b1a755ae9fbdcdb11b3", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3097, "timestamp_epoch": "1550950027.873801000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c8962a62ebe21f381d8e91bc", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3098, "timestamp_epoch": "1550950027.873989000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3f0ba1105d6b397f820685fb", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3099, "timestamp_epoch": "1550950027.874407000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4a8ddc6d22a3d2ce7d14a91b", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3100, "timestamp_epoch": "1550950027.874741000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-dc2fb932a28c2e977bdd00f2", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3101, "timestamp_epoch": "1550950027.875064000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-df17317ac008939770cb850f", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3102, "timestamp_epoch": "1550950027.875315000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-28f65cbeee46feefe4cc1230", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 3112, "timestamp_epoch": "1550950028.061073000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-716a798f8003fae2e14e211b", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 3153, "timestamp_epoch": "1550950029.568047000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-abe191bb5edfcf188ad5d6b2", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 3229, "timestamp_epoch": "1550950031.081038000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4c1696f24291b02c10efe7f5", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3261, "timestamp_epoch": "1550950032.625527000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0234a4ca6528add24644e5fa", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3299, "timestamp_epoch": "1550950033.391067000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fcdf6d682e740a0dd04008ed", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3311, "timestamp_epoch": "1550950034.154507000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-0ad269e86d76c3e8d6d64383", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 3321, "timestamp_epoch": "1550950034.331348000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-6415fef1d3fccce8cc5d7c21", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 3339, "timestamp_epoch": "1550950035.845599000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-3738d6f95a789e2b9f63b1a1", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 3403, "timestamp_epoch": "1550950037.358005000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a8f54dd69d3dd4d574ce7762", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3513, "timestamp_epoch": "1550950039.521666000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6c06561075ad34396cd406bf", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3514, "timestamp_epoch": "1550950039.522075000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-916c4038d0c6c2b768d50863", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3515, "timestamp_epoch": "1550950039.522983000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7490359301e2026891ce7dd6", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 3516, "timestamp_epoch": "1550950039.523206000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-79c91b56283e9aba4ceccd7a", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 5091, "timestamp_epoch": "1550950116.105501000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d68382ee8c1b209db8b9dda3", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 5126, "timestamp_epoch": "1550950117.606932000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7505f6b9b252dc04056d00f4", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 5165, "timestamp_epoch": "1550950119.108943000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-6e113c26793a193ed43994e1", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 5834, "timestamp_epoch": "1550950154.340591000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-30601d10328192450080dd79", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 5884, "timestamp_epoch": "1550950155.853599000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-d0e1fa6359a3dc0729844a5f", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 5930, "timestamp_epoch": "1550950157.365752000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9aba6e80da0e46fb89901e13", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 6127, "timestamp_epoch": "1550950236.110108000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-09b8cab86749cc319db7f3df", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 6128, "timestamp_epoch": "1550950237.622165000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7f6aff4bc13634f782e721a4", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 6129, "timestamp_epoch": "1550950239.135247000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-9a4f020f72acbb9f56a1153a", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 6132, "timestamp_epoch": "1550950274.351910000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-54f8538c67649848e08be669", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 6133, "timestamp_epoch": "1550950275.864088000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-c06fb1d2825c6ab41cac9941", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 6134, "timestamp_epoch": "1550950277.376956000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-276918ca888f695bda5fc094", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 6137, "timestamp_epoch": "1550950356.120232000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e3aaf41d5cb90695066733f3", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 6138, "timestamp_epoch": "1550950357.633552000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a1190c52ae473f394e377424", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 6139, "timestamp_epoch": "1550950359.146255000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-1434e38fd1fe8702218c7be7", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 6147, "timestamp_epoch": "1550950394.363093000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-f852e08098e77a408e87f6e8", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 6148, "timestamp_epoch": "1550950395.875225000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-5d26440cd26924ef3102b3f9", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 6149, "timestamp_epoch": "1550950397.388178000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2aca26adb3924ba7515a8996", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 7614, "timestamp_epoch": "1550950476.130949000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-16ca6259a2dd79d2603ea085", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 7651, "timestamp_epoch": "1550950477.643762000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-48e1004055dc76a7ecd7550c", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 7668, "timestamp_epoch": "1550950479.157443000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-bb5c8936705c8d5e5286595d", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 7992, "timestamp_epoch": "1550950514.373723000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-5890bfd9320f00f419d3e855", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 8013, "timestamp_epoch": "1550950515.886726000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-1083fa42a8c53115c03b67cd", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 8026, "timestamp_epoch": "1550950517.398817000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a22772845bb3c02d23a8d612", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 8962, "timestamp_epoch": "1550950596.142544000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-88497b3712b7c877e3826367", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 8981, "timestamp_epoch": "1550950597.655109000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ca2ece8bfff322185f26702b", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 8996, "timestamp_epoch": "1550950599.168553000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-5d67858277f98b0c63140668", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 9475, "timestamp_epoch": "1550950634.384899000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-7350b71b1dc823871fc1be61", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 9494, "timestamp_epoch": "1550950635.897862000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-b8dc4c069a0963520432c764", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 9520, "timestamp_epoch": "1550950637.409839000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5f3214c2bbb40b4ef42e17cf", "src_port": null, "tcp_stream": null, "udp_stream": 76, "frame_number": 10278, "timestamp_epoch": "1550950700.919313000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1d54309319a2480682a5ee33", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 10279, "timestamp_epoch": "1550950700.919491000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-68291866585dc53cefe916ce", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 10304, "timestamp_epoch": "1550950702.424590000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-44ee3c78afdbbc7b831a90fd", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 10315, "timestamp_epoch": "1550950703.937926000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b5f5d39ebe4f473a336ca52b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 10322, "timestamp_epoch": "1550950705.482560000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "nbns.name": "STORMTHEORY<1b> (Domain Master Browser)", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c15d87ea47530b43237ff3a5", "src_port": null, "tcp_stream": null, "udp_stream": 77, "frame_number": 10323, "timestamp_epoch": "1550950705.483289000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-18826b325993ab2644fe6f81", "src_port": null, "tcp_stream": null, "udp_stream": 78, "frame_number": 10324, "timestamp_epoch": "1550950705.484266000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-58f0575a20cf3e0a32707122", "src_port": null, "tcp_stream": null, "udp_stream": 76, "frame_number": 10332, "timestamp_epoch": "1550950706.496342000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c913c0c3d079aa3303cda085", "src_port": null, "tcp_stream": null, "udp_stream": 78, "frame_number": 10333, "timestamp_epoch": "1550950706.496617000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-60570c30a48c9cfc9f400e03", "src_port": null, "tcp_stream": null, "udp_stream": 76, "frame_number": 10340, "timestamp_epoch": "1550950707.510395000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c67363c1759228312b460723", "src_port": null, "tcp_stream": null, "udp_stream": 78, "frame_number": 10341, "timestamp_epoch": "1550950707.510611000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b727a297d991984b3ed98ef1", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 10344, "timestamp_epoch": "1550950708.524310000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-da7ed9a109ce368f62a54bdc", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 10354, "timestamp_epoch": "1550950709.289077000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-07fa6e162500c141412c4c85", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 10370, "timestamp_epoch": "1550950710.053319000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-650a644e2bb320bb0132dfe4", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10405, "timestamp_epoch": "1550950710.960943000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-720a8c4a7087a53c58e4baa7", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10407, "timestamp_epoch": "1550950710.961636000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-73ae4ebd8c91b8abd7b27bee", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 11103, "timestamp_epoch": "1550950716.153988000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-39733b55c37817a93bfef188", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 11135, "timestamp_epoch": "1550950717.666480000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2d26ce9d6e1b15f5d558c858", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 11178, "timestamp_epoch": "1550950719.180151000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-450801a58779a85ccfa80841", "src_port": null, "tcp_stream": 156, "udp_stream": null, "frame_number": 11274, "timestamp_epoch": "1550950724.597609000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "FERGUSON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d08f2bb207862420402af97c", "src_port": null, "tcp_stream": 156, "udp_stream": null, "frame_number": 11277, "timestamp_epoch": "1550950724.598993000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f0c762044955167f97e65f10", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11283, "timestamp_epoch": "1550950724.599570000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ffe02d90fbea180d9ff7f981", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11285, "timestamp_epoch": "1550950724.600058000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-a04f329f3f668a46b4478289", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 12257, "timestamp_epoch": "1550950754.394249000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-aea69cfac9265603f4c83e61", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 12285, "timestamp_epoch": "1550950755.908554000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-3a2bf98c1e89265ccb614bf9", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 12329, "timestamp_epoch": "1550950757.420359000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "12,14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-6452217e7b7fe7dd76897542", "src_port": null, "tcp_stream": 163, "udp_stream": null, "frame_number": 12428, "timestamp_epoch": "1550950760.045835000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SUTTON-WIN-PC$" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b62490ec2aba99377480ccea", "src_port": null, "tcp_stream": 163, "udp_stream": null, "frame_number": 12431, "timestamp_epoch": "1550950760.048098000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-67e490029ae7cb4c5d5c665d", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12437, "timestamp_epoch": "1550950760.048703000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7b56b5d00d64e618bb56fadf", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12439, "timestamp_epoch": "1550950760.049410000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-508fd2674f241168067a7cac", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13332, "timestamp_epoch": "1550950789.140766000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f6f6a68ceeaa968afd590ac1", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13333, "timestamp_epoch": "1550950789.140947000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-72e14687ad1630ce3ec3f7fa", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13334, "timestamp_epoch": "1550950789.141183000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a97aaf7098b4d4a4634caea6", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13338, "timestamp_epoch": "1550950789.142282000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-dbd325921b6066b2d3fb058c", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13339, "timestamp_epoch": "1550950789.143021000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2db269a5bf71ea0980b9dce6", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13340, "timestamp_epoch": "1550950789.143380000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3cbab7cae090076768b892e4", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13341, "timestamp_epoch": "1550950789.143492000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b289abf33916a0e37a036735", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13342, "timestamp_epoch": "1550950789.143774000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-330589a93577a23226683595", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13343, "timestamp_epoch": "1550950789.143992000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c8bd1adc5502f8e6d59f1649", "src_port": null, "tcp_stream": 172, "udp_stream": null, "frame_number": 13370, "timestamp_epoch": "1550950790.108630000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ddbe295f2badbb2e1515180d", "src_port": null, "tcp_stream": 172, "udp_stream": null, "frame_number": 13371, "timestamp_epoch": "1550950790.108977000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c4fccc7e1831e80bde641f0e", "src_port": null, "tcp_stream": 172, "udp_stream": null, "frame_number": 13372, "timestamp_epoch": "1550950790.110804000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-87f2329b97dc0cf8f752674b", "src_port": null, "tcp_stream": 176, "udp_stream": null, "frame_number": 13660, "timestamp_epoch": "1550950795.347161000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3f05b796227ee46afdaa299e", "src_port": null, "tcp_stream": 176, "udp_stream": null, "frame_number": 13661, "timestamp_epoch": "1550950795.347371000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b3a0edd9c5ed5bda95587192", "src_port": null, "tcp_stream": 176, "udp_stream": null, "frame_number": 13662, "timestamp_epoch": "1550950795.347802000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fe39b69c2ad1d4b844942745", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13974, "timestamp_epoch": "1550950801.516511000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3a84d9f256c4b715d9938f42", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13975, "timestamp_epoch": "1550950801.516751000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8cdc2cbbcb0564bb9959c43e", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13976, "timestamp_epoch": "1550950801.516951000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ed2c7fdf8f59c290c3214a40", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 13977, "timestamp_epoch": "1550950801.517141000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d8c3d68d4331352402e5eca1", "src_port": null, "tcp_stream": 177, "udp_stream": null, "frame_number": 14127, "timestamp_epoch": "1550950805.579567000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-76e1124d40fc4743ed3e19f9", "src_port": null, "tcp_stream": 177, "udp_stream": null, "frame_number": 14128, "timestamp_epoch": "1550950805.579735000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9fa9f56dd10bae9cb78204ad", "src_port": null, "tcp_stream": 177, "udp_stream": null, "frame_number": 14129, "timestamp_epoch": "1550950805.579902000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-937421cf8e4af0de6a7552b3", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 14588, "timestamp_epoch": "1550950816.719048000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ecfb2ff5c7fa61c7f8234f3c", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 14618, "timestamp_epoch": "1550950818.230637000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-0eff10e6fa031a556b9f85c9", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 14643, "timestamp_epoch": "1550950819.743300000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ee47db5941c90a16b9797a4f", "src_port": null, "tcp_stream": 178, "udp_stream": null, "frame_number": 14744, "timestamp_epoch": "1550950820.821314000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ae9d5aeae52a4d8e6ff2271f", "src_port": null, "tcp_stream": 178, "udp_stream": null, "frame_number": 14745, "timestamp_epoch": "1550950820.821476000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-43cc158bc51224962bbca4f7", "src_port": null, "tcp_stream": 178, "udp_stream": null, "frame_number": 14746, "timestamp_epoch": "1550950820.821693000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-480384bb5d87d1a24531d775", "src_port": null, "tcp_stream": 179, "udp_stream": null, "frame_number": 14763, "timestamp_epoch": "1550950820.823658000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0e645644089f504424f3a077", "src_port": null, "tcp_stream": 179, "udp_stream": null, "frame_number": 14764, "timestamp_epoch": "1550950820.823795000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-41cdad4619552cf54bc87ddc", "src_port": null, "tcp_stream": 179, "udp_stream": null, "frame_number": 14765, "timestamp_epoch": "1550950820.823992000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1168e64ccc50c056d538f6b5", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 14859, "timestamp_epoch": "1550950821.038282000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1fbe7ddb5c2da04cb54bf54a", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 14860, "timestamp_epoch": "1550950821.038474000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d8fa17e3c7c24bac42ecd8ab", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 14861, "timestamp_epoch": "1550950821.038689000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-debd41096d4f3b0d6b131f48", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 14996, "timestamp_epoch": "1550950821.288003000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-12dc7869d7986dddd3ace73e", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 15003, "timestamp_epoch": "1550950822.053410000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-732f112c8586e580fc883e86", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 15011, "timestamp_epoch": "1550950822.817038000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "20:cf:30:10:c7:2b", "dns.qry.name": "wpad" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-2125b496805c32215ef45a4e", "src_port": null, "tcp_stream": null, "udp_stream": 96, "frame_number": 15025, "timestamp_epoch": "1550950823.663417000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "20:cf:30:10:c7:2b", "dns.qry.name": "wpad" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-69d4565301a213a121bdec1e", "src_port": null, "tcp_stream": null, "udp_stream": 96, "frame_number": 15026, "timestamp_epoch": "1550950823.769319000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-b9fe8728b090a662a4ba03b3", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 15027, "timestamp_epoch": "1550950823.971514000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-92c0c377fd4ccc1ec732383a", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 15038, "timestamp_epoch": "1550950824.736033000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5046023a0a0c278fc38e172d", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15060, "timestamp_epoch": "1550950825.336156000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-a9fc77371f408797fe073094", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15061, "timestamp_epoch": "1550950825.336334000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-96fe07bc170123ed18319d95", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15062, "timestamp_epoch": "1550950825.336484000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-8162c8e6b863ff2da7a7568e", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15066, "timestamp_epoch": "1550950825.337583000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cb88a97c283b7065185a1e5e", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15067, "timestamp_epoch": "1550950825.338133000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-916edd96362cad9cabeb3bb6", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15068, "timestamp_epoch": "1550950825.338585000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c9a12de1420da10517fef6af", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15069, "timestamp_epoch": "1550950825.338719000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-e6ae82df40e3a33c57f63f05", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15070, "timestamp_epoch": "1550950825.338998000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3f2e104de7ea1440214c2420", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15071, "timestamp_epoch": "1550950825.339247000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-20c6cde07fea09974a37464f", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 15075, "timestamp_epoch": "1550950825.500662000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f835ae8789e661be221c15ca", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 15496, "timestamp_epoch": "1550950836.163720000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-25ef4daa1648ae6b89bfaa9d", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15634, "timestamp_epoch": "1550950836.824694000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6b38027d97c8371f5071844f", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15635, "timestamp_epoch": "1550950836.824939000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-7f8b984884acd4e6249e5ff2", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15636, "timestamp_epoch": "1550950836.825112000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cf7735591f9971fbe64351d2", "src_port": null, "tcp_stream": 181, "udp_stream": null, "frame_number": 15637, "timestamp_epoch": "1550950836.825247000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-7e9dc0c54b84063e270bb680", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 15642, "timestamp_epoch": "1550950837.314362000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-327ba12ac37c42bc6c61f0e3", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 15647, "timestamp_epoch": "1550950837.677794000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-99ebc3385fd72e82ab09057f", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 15674, "timestamp_epoch": "1550950838.822512000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8fa1dbc31c370f66abdf77cd", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 15686, "timestamp_epoch": "1550950839.190452000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-487fb4baf8baba68ccbdc7b9", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 15713, "timestamp_epoch": "1550950840.336805000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-92e575f57c536fab9506c9b8", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 15855, "timestamp_epoch": "1550950841.879885000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-b3fdab296beb662980a5d05a", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 15873, "timestamp_epoch": "1550950842.645030000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-fbad7580e886d7a582b89002", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 15889, "timestamp_epoch": "1550950843.409057000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ee4573e20f99b0063989fb9f", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 15911, "timestamp_epoch": "1550950844.187024000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-8b0e47cfe36495bf943928ce", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 15926, "timestamp_epoch": "1550950844.937924000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-7e865bac9e4ab339ec3de317", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 15942, "timestamp_epoch": "1550950845.701650000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fc6b2bf56e558404ff4e3ee4", "src_port": null, "tcp_stream": 183, "udp_stream": null, "frame_number": 15971, "timestamp_epoch": "1550950846.292452000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6948039c03b04cc27962b644", "src_port": null, "tcp_stream": 183, "udp_stream": null, "frame_number": 15972, "timestamp_epoch": "1550950846.292724000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f034f15b87f286850b4f0ee8", "src_port": null, "tcp_stream": 183, "udp_stream": null, "frame_number": 15973, "timestamp_epoch": "1550950846.293019000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-26d5441116a3b8880b1a6bd3", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 16519, "timestamp_epoch": "1550950856.528609000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-97ce13da79b0fc0065fdd0c2", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 16520, "timestamp_epoch": "1550950856.528847000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d5d10c8325b38f351232a4f4", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 16521, "timestamp_epoch": "1550950856.529033000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-408437a92efa21b59c187170", "src_port": null, "tcp_stream": 186, "udp_stream": null, "frame_number": 16538, "timestamp_epoch": "1550950856.531020000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2d685f64fa40ed85befc0aa3", "src_port": null, "tcp_stream": 186, "udp_stream": null, "frame_number": 16539, "timestamp_epoch": "1550950856.531160000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-66331c12810bef5f541727eb", "src_port": null, "tcp_stream": 186, "udp_stream": null, "frame_number": 16540, "timestamp_epoch": "1550950856.531368000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a6124562c79f6b4c8f568ef6", "src_port": null, "tcp_stream": 187, "udp_stream": null, "frame_number": 17117, "timestamp_epoch": "1550950866.761969000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cf3ce4d1b7ca562f3ed88c00", "src_port": null, "tcp_stream": 187, "udp_stream": null, "frame_number": 17118, "timestamp_epoch": "1550950866.762118000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-025d9e6b29983f60c2c6c4fe", "src_port": null, "tcp_stream": 187, "udp_stream": null, "frame_number": 17119, "timestamp_epoch": "1550950866.762282000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-bf29bf9704188e0a55026755", "src_port": null, "tcp_stream": 188, "udp_stream": null, "frame_number": 17215, "timestamp_epoch": "1550950866.979961000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3cdb5c40593d6a0410dc59db", "src_port": null, "tcp_stream": 188, "udp_stream": null, "frame_number": 17216, "timestamp_epoch": "1550950866.980190000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b2d2db15310b1f63f2e0718a", "src_port": null, "tcp_stream": 188, "udp_stream": null, "frame_number": 17217, "timestamp_epoch": "1550950866.980374000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-30e586d3b4fd9e062f556daf", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 17661, "timestamp_epoch": "1550950874.405594000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-7ad809046d76e451676ae6d3", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 17673, "timestamp_epoch": "1550950875.918142000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-c6a86ffbf746e5615ec93b73", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 17756, "timestamp_epoch": "1550950877.431398000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-cc2091f690615aa59534db14", "src_port": null, "tcp_stream": 190, "udp_stream": null, "frame_number": 18261, "timestamp_epoch": "1550950892.233694000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b065ead984b0ae029f1fcac1", "src_port": null, "tcp_stream": 190, "udp_stream": null, "frame_number": 18262, "timestamp_epoch": "1550950892.233908000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2372508ddc8fa5bdeeb73436", "src_port": null, "tcp_stream": 190, "udp_stream": null, "frame_number": 18263, "timestamp_epoch": "1550950892.234163000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d0cdd6abe4b6f9804a64a718", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 18280, "timestamp_epoch": "1550950892.237184000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-762cc7d6b7c019c4950c3b02", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 18281, "timestamp_epoch": "1550950892.237397000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-72a7456016c329ca45df2c93", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 18282, "timestamp_epoch": "1550950892.237627000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:0a:9f:c0:2d", "dns.qry.name": "wpad" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8b721238d3028d383b653e8c", "src_port": null, "tcp_stream": null, "udp_stream": 101, "frame_number": 19115, "timestamp_epoch": "1550950915.621296000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:0a:9f:c0:2d", "dns.qry.name": "wpad" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4e547783a50312a327105de5", "src_port": null, "tcp_stream": null, "udp_stream": 101, "frame_number": 19116, "timestamp_epoch": "1550950915.724998000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ac4fd9a8378ef570a269e4b9", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 19118, "timestamp_epoch": "1550950915.926915000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ccda1e8f46948f546e2b515e", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 19120, "timestamp_epoch": "1550950917.439861000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-830c7003d85dd4a4e18f6855", "src_port": null, "tcp_stream": 193, "udp_stream": null, "frame_number": 19138, "timestamp_epoch": "1550950917.488984000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2891ecdcf17be7a73b43f317", "src_port": null, "tcp_stream": 193, "udp_stream": null, "frame_number": 19139, "timestamp_epoch": "1550950917.489166000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-599e553129ceab7fc222747b", "src_port": null, "tcp_stream": 193, "udp_stream": null, "frame_number": 19140, "timestamp_epoch": "1550950917.489373000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-82d1e12cced51f24c738db46", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 19236, "timestamp_epoch": "1550950917.695996000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-94aca032923e192953da5d3b", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 19237, "timestamp_epoch": "1550950917.696156000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-eaaebd7ee28895ce1b9d8833", "src_port": null, "tcp_stream": 194, "udp_stream": null, "frame_number": 19238, "timestamp_epoch": "1550950917.696330000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2e1a666db16fc1f3f0d5646c", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 19380, "timestamp_epoch": "1550950918.954275000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-79e12b2d8f94da30e0d6008b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 19389, "timestamp_epoch": "1550950920.497777000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0b8666c1bc8fc48b5c9a85b2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 19399, "timestamp_epoch": "1550950921.261782000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-28402461169dbfd32db01b8f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 19409, "timestamp_epoch": "1550950922.027007000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2ef507e7d42bae7717c637a7", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 19424, "timestamp_epoch": "1550950922.807215000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c76948705372390d77fa7495", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 19551, "timestamp_epoch": "1550950923.571953000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fbf2b0365951aeebb7bc6eb0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 19563, "timestamp_epoch": "1550950924.335624000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-654b96b4a4d220bf54141ac0", "src_port": null, "tcp_stream": 199, "udp_stream": null, "frame_number": 20080, "timestamp_epoch": "1550950937.945157000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-170f70d91ad0d76601a79a15", "src_port": null, "tcp_stream": 199, "udp_stream": null, "frame_number": 20081, "timestamp_epoch": "1550950937.945317000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "ntlmssp.auth.domain": "STORMTHEORY", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c2951a2200135e700c4dc966", "src_port": null, "tcp_stream": 199, "udp_stream": null, "frame_number": 20082, "timestamp_epoch": "1550950937.945540000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3da4a583db58f31bfdc6fc50", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 20372, "timestamp_epoch": "1550950956.175397000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-51aaa7c1908d57653e87ff49", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 20390, "timestamp_epoch": "1550950957.689385000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-24190fdfef7c3d26a85ce513", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 20406, "timestamp_epoch": "1550950959.201308000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2fd1eceaca1be59933a42a91", "src_port": null, "tcp_stream": null, "udp_stream": 76, "frame_number": 20905, "timestamp_epoch": "1550950987.648029000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b7e3a85dc7066e3cfd3e92b7", "src_port": null, "tcp_stream": null, "udp_stream": 78, "frame_number": 20906, "timestamp_epoch": "1550950987.648199000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5eca206f6ea6d7063c7877fd", "src_port": null, "tcp_stream": null, "udp_stream": 76, "frame_number": 20917, "timestamp_epoch": "1550950988.654766000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-61758ba4acea290c0dc63b58", "src_port": null, "tcp_stream": null, "udp_stream": 78, "frame_number": 20918, "timestamp_epoch": "1550950988.654981000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f0778377c8c1cd176b3008d0", "src_port": null, "tcp_stream": null, "udp_stream": 76, "frame_number": 20926, "timestamp_epoch": "1550950989.668825000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1fef7e7875fdbf3e3d9107ff", "src_port": null, "tcp_stream": null, "udp_stream": 78, "frame_number": 20927, "timestamp_epoch": "1550950989.668998000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c149fd5b91ae1daf594f0913", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 20935, "timestamp_epoch": "1550950990.682075000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0550e9dd8e63099147f52ba2", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 20948, "timestamp_epoch": "1550950992.195088000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-559b1a50897e8f6f035954d4", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 20957, "timestamp_epoch": "1550950993.708590000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-27dc61d21a30ee444e625363", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 20960, "timestamp_epoch": "1550950994.417112000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d820743e520cdfa4e8beed3f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 20970, "timestamp_epoch": "1550950995.254036000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-5f3b5631ab8a17c6c21038ed", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 20973, "timestamp_epoch": "1550950995.929183000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4b103707c84138122a422e47", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 20974, "timestamp_epoch": "1550950996.017487000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-35aa9da58613a885eed6e7ce", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 20982, "timestamp_epoch": "1550950996.781533000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-fa33e00588a904497f6c87b2", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 20988, "timestamp_epoch": "1550950997.442703000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-bef463a54e7fe0a60f574bdb", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 21658, "timestamp_epoch": "1550951076.187216000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-181e1e4dbcb77b4fc55600e2", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 21667, "timestamp_epoch": "1550951077.699239000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c7c1f0e3e6b02c5118e540d5", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 21675, "timestamp_epoch": "1550951079.212958000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-58dc59d7fecdd3ed1d4252c4", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 22063, "timestamp_epoch": "1550951114.428805000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-9e4808b032d9b64a6a26829e", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 22067, "timestamp_epoch": "1550951115.942265000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-347437a66a233295a70cb0d8", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 22071, "timestamp_epoch": "1550951117.454800000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ad7de3ecd4a9519481db852a", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 22745, "timestamp_epoch": "1550951196.197218000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a3c5d8eb7ec3ecc223dfba45", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 22750, "timestamp_epoch": "1550951197.709853000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9cddf0df9f661d594546975e", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 22769, "timestamp_epoch": "1550951199.224990000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-32e08ae145b3358e965349d5", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 23056, "timestamp_epoch": "1550951234.439592000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-a099045de79124e74d941ae5", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 23069, "timestamp_epoch": "1550951235.951920000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-fe3ca712709e2279379390bf", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 23079, "timestamp_epoch": "1550951237.465887000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1f70ccb5708b559413dddc60", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23090, "timestamp_epoch": "1550951238.132635000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-51dfed1ac15b2b35447ea862", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23091, "timestamp_epoch": "1550951238.132941000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c1e1018d938f4217f5f86eec", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23095, "timestamp_epoch": "1550951238.133752000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9f76d6a681b4db46271667ca", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23096, "timestamp_epoch": "1550951238.134665000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7c7f07ba383defe13a5c85b9", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23097, "timestamp_epoch": "1550951238.134957000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9225c449fefdd2ae1d87aa51", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23098, "timestamp_epoch": "1550951238.135120000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-526995cc1d4c8771fdc2922f", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23099, "timestamp_epoch": "1550951238.135528000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9c274f5a72b4660c40596fb8", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23100, "timestamp_epoch": "1550951238.254945000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a7b3b2ef4f376960a84d3276", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23101, "timestamp_epoch": "1550951238.255625000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-55b6240941bae4a52a58b68b", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23102, "timestamp_epoch": "1550951238.255799000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ae392edb66a41fcdc0f53aef", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23113, "timestamp_epoch": "1550951238.630560000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-30b0a95f64f33af7fe3f3851", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23114, "timestamp_epoch": "1550951238.630883000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b46afd4b736856339d7bf4fe", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23218, "timestamp_epoch": "1550951251.520439000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3c29eb80c553bbb0f9800444", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 23219, "timestamp_epoch": "1550951251.520680000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-cc647e1d77749b099f696e92", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 23742, "timestamp_epoch": "1550951316.212226000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0763bc77d764520864d57519", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 23747, "timestamp_epoch": "1550951317.725448000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6370f8477f3ad3b8e71039bd", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 23750, "timestamp_epoch": "1550951319.238763000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-e85a14c5cba6d9fc9859976e", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 23802, "timestamp_epoch": "1550951354.450625000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-f11e6bbf5dae044573b81fd4", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 23818, "timestamp_epoch": "1550951355.963608000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-8632dfb416475026a55f391d", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 23826, "timestamp_epoch": "1550951357.476297000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4797d1d4a2bb79da53f754e8", "src_port": null, "tcp_stream": null, "udp_stream": 76, "frame_number": 23955, "timestamp_epoch": "1550951403.991506000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-623342f4a45bb77caeff0ec3", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 23956, "timestamp_epoch": "1550951403.991714000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ef45b0d62c0e596503953b76", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 23959, "timestamp_epoch": "1550951405.492464000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8ab65a0c6be6b7f2926dd549", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 23966, "timestamp_epoch": "1550951407.005506000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9b2d85a24126ea8816340416", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 23971, "timestamp_epoch": "1550951408.548825000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "nbns.name": "STORMTHEORY<1b> (Domain Master Browser)", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.nb_flags.group": "False" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2701829c6bcba615201eb085", "src_port": null, "tcp_stream": null, "udp_stream": 77, "frame_number": 23972, "timestamp_epoch": "1550951408.549229000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c5e5b392b3d5764f3669907e", "src_port": null, "tcp_stream": null, "udp_stream": 78, "frame_number": 23973, "timestamp_epoch": "1550951408.549454000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e61d8b240015b015d6dc3152", "src_port": null, "tcp_stream": null, "udp_stream": 76, "frame_number": 23981, "timestamp_epoch": "1550951409.563403000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-038d2c9155e290d20b54806d", "src_port": null, "tcp_stream": null, "udp_stream": 78, "frame_number": 23982, "timestamp_epoch": "1550951409.563644000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-552f5649a6b57d6f850d9cda", "src_port": null, "tcp_stream": null, "udp_stream": 76, "frame_number": 23989, "timestamp_epoch": "1550951410.577083000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b52a413e7cf787fd64aa63b6", "src_port": null, "tcp_stream": null, "udp_stream": 78, "frame_number": 23990, "timestamp_epoch": "1550951410.577478000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d54cf3d66809ffb4be50d1b2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 24000, "timestamp_epoch": "1550951411.591126000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0d7830cffd51c691477fb487", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 24002, "timestamp_epoch": "1550951412.356769000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-223cd1206a57b49fa6dbbf5a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 24011, "timestamp_epoch": "1550951413.120224000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-cb31057d142b19b7d66e33c2", "src_port": null, "tcp_stream": null, "udp_stream": 76, "frame_number": 24012, "timestamp_epoch": "1550951414.019156000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a98a3eed095b82736068649b", "src_port": null, "tcp_stream": null, "udp_stream": 78, "frame_number": 24013, "timestamp_epoch": "1550951414.019351000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-31c81b28a0ebf2a0e7b6c64b", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24025, "timestamp_epoch": "1550951414.636529000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-dd183b55f226ee0354f021b9", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24027, "timestamp_epoch": "1550951414.637421000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-75305e81671dea2e5a00e21f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24147, "timestamp_epoch": "1550951414.752929000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f77d32e72a0ec6e911be849f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24149, "timestamp_epoch": "1550951414.753529000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f71547d6e6b21ce98359e1df", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 24654, "timestamp_epoch": "1550951414.905168000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e814afbf145a439528741a0a", "src_port": null, "tcp_stream": null, "udp_stream": 76, "frame_number": 24658, "timestamp_epoch": "1550951415.023229000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-235eb07eac037cde83bcf828", "src_port": null, "tcp_stream": null, "udp_stream": 78, "frame_number": 24659, "timestamp_epoch": "1550951415.023449000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-287169e45dd24cec630a8788", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 24669, "timestamp_epoch": "1550951415.663075000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-bc8e281fe3f911e966120146", "src_port": null, "tcp_stream": null, "udp_stream": 76, "frame_number": 24679, "timestamp_epoch": "1550951416.036797000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6923aed9fb995a77ebd0f47e", "src_port": null, "tcp_stream": null, "udp_stream": 78, "frame_number": 24680, "timestamp_epoch": "1550951416.036967000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0a5f93085dd4c97cad5d879e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 24681, "timestamp_epoch": "1550951416.427174000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d67ed97e45dc9cf358dfe1d4", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 24682, "timestamp_epoch": "1550951417.051678000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9f0391bda46990561e8bcf3b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 24687, "timestamp_epoch": "1550951417.815878000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e9cf5e19265f7c1436c172a3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 24688, "timestamp_epoch": "1550951418.580295000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-34bdecaeabb81361dda1e50f", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 24714, "timestamp_epoch": "1550951426.464040000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-d77b896aa6d2fbc0453c5756", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 24867, "timestamp_epoch": "1550951427.964637000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-086584bfb3155ce734526b94", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 25056, "timestamp_epoch": "1550951429.478624000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-8156f01c56b22164d10b0152", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 25220, "timestamp_epoch": "1550951431.023444000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ab13d88a78b2fe7adb5c0942", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 25272, "timestamp_epoch": "1550951431.787285000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ef56cdde1b1c4fa93e41b48c", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 25313, "timestamp_epoch": "1550951432.551577000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-02dbac0138f4f76f0e0711c3", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 25634, "timestamp_epoch": "1550951436.223415000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-731a9012c7af2539b48b8d6a", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 25769, "timestamp_epoch": "1550951437.736261000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-097d602ee3f2baf2348dd808", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 25910, "timestamp_epoch": "1550951439.249730000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2a58bb42d8014b3932f6b1fc", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26297, "timestamp_epoch": "1550951444.023932000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-30fd7e5376d64bd958e19f19", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26299, "timestamp_epoch": "1550951444.024467000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4a2db579d6fe40fc371cd595", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26300, "timestamp_epoch": "1550951444.024821000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5002585d2abddbaff7c6fa28", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26324, "timestamp_epoch": "1550951444.038984000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6e2dad3e53503b30321a1333", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26326, "timestamp_epoch": "1550951444.039621000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1c5e13f96fca112de78242fc", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26341, "timestamp_epoch": "1550951444.065564000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ee197afc825476a3252a256b", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26343, "timestamp_epoch": "1550951444.066229000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5273582f3d70126c05dee544", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 26548, "timestamp_epoch": "1550951444.116639000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-16bf0c61e43b47448dbdbc5e", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 26699, "timestamp_epoch": "1550951445.615333000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1262dfaa38313920d1f6159a", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 26840, "timestamp_epoch": "1550951447.127901000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9c07e0c13c53540b24b389b2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 26985, "timestamp_epoch": "1550951448.672272000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c6ed31457cb18b3fcf9e652d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 27026, "timestamp_epoch": "1550951449.436648000" }, { "kind": "identity", "dst_ip": "10.2.23.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a567c4ed588c5863fee230fd", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 27101, "timestamp_epoch": "1550951450.201112000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-f63b29b7098be8f307031e3c", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28226, "timestamp_epoch": "1550951474.453896000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-38c28a02abf9d99040f8dd89", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28227, "timestamp_epoch": "1550951475.966075000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-89cb75171fc5de2a9632a418", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28228, "timestamp_epoch": "1550951477.480128000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d4c7c7e4dd3d6ffcb6876c6d", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28267, "timestamp_epoch": "1550951556.234270000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0447ede0a1f839f6fa086b05", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28268, "timestamp_epoch": "1550951557.747287000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-cb972a3ce049807adc580e3e", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28269, "timestamp_epoch": "1550951559.260730000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-e45a7dba100dc8f5790e329c", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28284, "timestamp_epoch": "1550951594.465575000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-75c34d30eeb792b2bb5e5475", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28285, "timestamp_epoch": "1550951595.978755000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-585ff0a36cca432be1004dcd", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28286, "timestamp_epoch": "1550951597.491514000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-dbfd2441eb32d2e36d044137", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28314, "timestamp_epoch": "1550951676.246693000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-19fe7ca8d2a663bfbb991783", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28315, "timestamp_epoch": "1550951677.759782000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d465c32cce7b69e204a572fb", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28317, "timestamp_epoch": "1550951679.273704000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4246b579f943c64054748131", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28326, "timestamp_epoch": "1550951689.147286000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-af6ac831b2efb197387cff30", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28327, "timestamp_epoch": "1550951689.147534000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-429731950deb612cb6f96314", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28328, "timestamp_epoch": "1550951689.148092000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5b4dd752a65ed21178c4ce32", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28332, "timestamp_epoch": "1550951689.149756000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6a882cf56f7e409578548852", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28333, "timestamp_epoch": "1550951689.150331000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-22e759d2513ce0cde0c83b39", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28334, "timestamp_epoch": "1550951689.150843000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b1d36e105f95eb94a4bd35a2", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28335, "timestamp_epoch": "1550951689.150994000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-390309c1c55e96079cd7137f", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28336, "timestamp_epoch": "1550951689.151449000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cd8881e08329843ec58c9731", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28337, "timestamp_epoch": "1550951689.151710000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-767313ee86bfd289bcdd8198", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28341, "timestamp_epoch": "1550951701.519187000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2747eefefab658ca6e19b9d4", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28342, "timestamp_epoch": "1550951701.519420000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:0a:9f:c0:2d" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fc54e57d04b0a351fbef89b7", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28343, "timestamp_epoch": "1550951701.519727000" }, { "kind": "identity", "dst_ip": "10.2.23.231", "fields": { "eth.dst": "00:11:0a:9f:c0:2d", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-aa531febd15a68c38f5c00dd", "src_port": null, "tcp_stream": 242, "udp_stream": null, "frame_number": 28344, "timestamp_epoch": "1550951701.519870000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-6e215b2dd90ba88517fa75d0", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28346, "timestamp_epoch": "1550951714.477287000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-4f513b53b20351b4312569d3", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28347, "timestamp_epoch": "1550951715.989107000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-13da2d84e53df4352d268cee", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28348, "timestamp_epoch": "1550951717.502567000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5c5a9b02454875a6713463da", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28353, "timestamp_epoch": "1550951725.348230000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-db3b6d1dce91a073624eef80", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28354, "timestamp_epoch": "1550951725.348360000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4f5df7cefd98ba5db84f0f91", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28355, "timestamp_epoch": "1550951725.348541000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b", "kerberos.msg_type": "14" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-0cad1c594d3e55ff51634f6b", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28359, "timestamp_epoch": "1550951725.349632000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-188162642ca62e0c87e03948", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28360, "timestamp_epoch": "1550951725.350216000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-1ec1df4af9788c0e9c9ba221", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28361, "timestamp_epoch": "1550951725.350617000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-652c5ae67a2ce17e84cb871f", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28362, "timestamp_epoch": "1550951725.350771000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-5c549a544dfe07dca08086db", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28363, "timestamp_epoch": "1550951725.351113000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-98628bc3b89449bcc2126b9c", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28364, "timestamp_epoch": "1550951725.351358000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-be5185dbf42039f0e8e3442c", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28381, "timestamp_epoch": "1550951736.815671000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7fc47321dd8dbd960c139e5e", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28382, "timestamp_epoch": "1550951736.815993000" }, { "kind": "identity", "dst_ip": "10.2.23.2", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "20:cf:30:10:c7:2b" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-93d0fea63a387ae1e1beeb2e", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28383, "timestamp_epoch": "1550951736.816368000" }, { "kind": "identity", "dst_ip": "10.2.23.109", "fields": { "eth.dst": "20:cf:30:10:c7:2b", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fbc7222294b54ba5bb9badbf", "src_port": null, "tcp_stream": 243, "udp_stream": null, "frame_number": 28384, "timestamp_epoch": "1550951736.816631000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3a90ad660d75cebd5a82dc29", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28392, "timestamp_epoch": "1550951796.258091000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-99bd52f6de242eb9db0f1b9b", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28393, "timestamp_epoch": "1550951797.771584000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-228cc862afd419f78ef5aa1c", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28394, "timestamp_epoch": "1550951799.283990000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-78b82d961df631895340bb0b", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28410, "timestamp_epoch": "1550951834.488101000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-c188fd2f17e71db5d6a586e6", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28411, "timestamp_epoch": "1550951836.000429000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-3e85bb3945d9370842841d53", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28412, "timestamp_epoch": "1550951837.512440000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c82adf30efdeb45b0d57f094", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28421, "timestamp_epoch": "1550951916.267074000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-533a994729f699a93a506fcb", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28422, "timestamp_epoch": "1550951917.780339000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1886a335be471971b73fea93", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28430, "timestamp_epoch": "1550951919.293365000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-882adf1e2bfe4c8eee29106e", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28460, "timestamp_epoch": "1550951954.497443000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-b0820468c70087756b7b24ba", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28461, "timestamp_epoch": "1550951956.009984000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-754e1147a17454bf606e7d6f", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28462, "timestamp_epoch": "1550951957.524473000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-64ecabda97f02bfeabe8b6b9", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28481, "timestamp_epoch": "1550952036.277648000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-66e5e121d9cb3f38347dfe8a", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28482, "timestamp_epoch": "1550952037.790450000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c79df7aed48ab0afe1f49ee9", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28483, "timestamp_epoch": "1550952039.304571000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-30e3fa058b8fddff9df5052a", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28490, "timestamp_epoch": "1550952074.508474000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-b073e9b42d1ff9957c93ee6e", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28491, "timestamp_epoch": "1550952076.022467000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-a6337f2517070d3e5059bb4f", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28492, "timestamp_epoch": "1550952077.535828000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1e7b2879db1086318f5d57eb", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28514, "timestamp_epoch": "1550952156.288673000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3fb22901dcfad6fef51eee60", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28515, "timestamp_epoch": "1550952157.802392000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4dfba763d9bc0a1150fdcdfb", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28516, "timestamp_epoch": "1550952159.316119000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-08bdb4ef03aae0645b8bf62b", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28523, "timestamp_epoch": "1550952194.520786000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-aca7a105a501d64414fbb838", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28524, "timestamp_epoch": "1550952196.032888000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ace0b39aacff5e4cdda1d42a", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28525, "timestamp_epoch": "1550952197.546985000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6682b2071455aebff310b11e", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28554, "timestamp_epoch": "1550952276.300791000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7761ba34c4c8024432615e8f", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28555, "timestamp_epoch": "1550952277.812943000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c2f360bac9e1c6a39d685f2c", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28556, "timestamp_epoch": "1550952279.325859000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-d6be6a2afc1c8023ae8f4487", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28564, "timestamp_epoch": "1550952314.531861000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-f241bbc800f9dc70d72d6c9b", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28565, "timestamp_epoch": "1550952316.045014000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-66773e646c5311ce36545d33", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28566, "timestamp_epoch": "1550952317.557686000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5f4c4d8f30a367951ca41e70", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28818, "timestamp_epoch": "1550952396.310617000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3b983681858fb2af14ce3475", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28819, "timestamp_epoch": "1550952397.824592000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e17d1d5d39ae3dd1abf4c64c", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28820, "timestamp_epoch": "1550952399.336845000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-f222cdf6c0e4cdfe337f5006", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28827, "timestamp_epoch": "1550952434.541813000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-fb2e25bc984cdc84cf5ccb33", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28828, "timestamp_epoch": "1550952436.055170000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-081861d59f4d3208765f73bc", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28829, "timestamp_epoch": "1550952437.569229000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5f70497bdab90dacfa447e26", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28844, "timestamp_epoch": "1550952516.322847000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7a236a96db2b2c7d2f23e98f", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28845, "timestamp_epoch": "1550952517.834787000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "00:11:0a:9f:c0:2d", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-02bf682abf4fd02fa3fee47b", "src_port": null, "tcp_stream": null, "udp_stream": 59, "frame_number": 28846, "timestamp_epoch": "1550952519.347657000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-4e2802392d32a289fa3df88a", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28868, "timestamp_epoch": "1550952554.574633000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-d214affa1ed137f107601a20", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28869, "timestamp_epoch": "1550952556.080563000" }, { "kind": "identity", "dst_ip": "10.2.23.1", "fields": { "eth.dst": "00:04:c0:83:b4:1a", "eth.src": "20:cf:30:10:c7:2b", "nbns.name": "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-b3fedf904305a6930b7ef912", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 28870, "timestamp_epoch": "1550952557.594209000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "23.223.195.42", "fields": { "http.host": "www.msftncsi.com", "http.user_agent": "Microsoft NCSI", "http.request.uri": "/ncsi.txt", "http.response_in": "314", "http.request.method": "GET", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt" }, "src_ip": "10.2.23.231", "dst_port": 80, "event_id": "evt-e506daf3f9a8cb3f1a08528d", "src_port": 49176, "tcp_stream": 19, "udp_stream": null, "frame_number": 312, "timestamp_epoch": "1550949882.465719000" }, { "kind": "http_request", "dst_ip": "23.223.195.42", "fields": { "http.host": "www.msftncsi.com", "http.user_agent": "Microsoft NCSI", "http.request.uri": "/ncsi.txt", "http.response_in": "796", "http.request.method": "GET", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-03a267f4b8c17b485318cde6", "src_port": 49177, "tcp_stream": 45, "udp_stream": null, "frame_number": 752, "timestamp_epoch": "1550949924.873662000" }, { "kind": "http_request", "dst_ip": "198.185.159.136", "fields": { "http.host": "rootscafeslc.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/", "http.response_in": "1189", "http.request.method": "GET", "http.request.full_uri": "http://rootscafeslc.com/" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-b220cc333b821febf1ef92da", "src_port": 49194, "tcp_stream": 72, "udp_stream": null, "frame_number": 1185, "timestamp_epoch": "1550949984.295684000" }, { "kind": "http_request", "dst_ip": "198.185.159.135", "fields": { "http.host": "www.rootscafeslc.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/", "http.response_in": "1210", "http.request.method": "GET", "http.request.full_uri": "http://www.rootscafeslc.com/" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-d301a5b184f877df5b7c4e1b", "src_port": 49195, "tcp_stream": 74, "udp_stream": null, "frame_number": 1197, "timestamp_epoch": "1550949985.110142000" }, { "kind": "http_request", "dst_ip": "151.101.0.238", "fields": { "http.host": "static1.squarespace.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/static/53176ac0e4b0cc8a54026440/t/53597593e4b0bb8f10e2db9a/1503949442424/?format=1500w", "http.response_in": "1307", "http.request.method": "GET", "http.request.full_uri": "http://static1.squarespace.com/static/53176ac0e4b0cc8a54026440/t/53597593e4b0bb8f10e2db9a/1503949442424/?format=1500w" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-cd89b168ac2bb973fa15d11c", "src_port": 49197, "tcp_stream": 76, "udp_stream": null, "frame_number": 1219, "timestamp_epoch": "1550949986.299380000" }, { "kind": "http_request", "dst_ip": "151.101.0.238", "fields": { "http.host": "static1.squarespace.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/static/sitecss/53176ac0e4b0cc8a54026440/47/507c1fdf84ae362b5e7be44e/53176ac0e4b0cc8a54026444/2141-05142015/1418412276795/site.css?&filterFeatures=false", "http.response_in": "1415", "http.request.method": "GET", "http.request.full_uri": "http://static1.squarespace.com/static/sitecss/53176ac0e4b0cc8a54026440/47/507c1fdf84ae362b5e7be44e/53176ac0e4b0cc8a54026444/2141-05142015/1418412276795/site.css?&filterFeatures=false" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-c7bf9e9f783ed096ba359817", "src_port": 49197, "tcp_stream": 76, "udp_stream": null, "frame_number": 1309, "timestamp_epoch": "1550949988.157275000" }, { "kind": "http_request", "dst_ip": "204.79.197.200", "fields": { "http.host": "www.bing.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/favicon.ico", "http.response_in": "1368", "http.request.method": "GET", "http.request.full_uri": "http://www.bing.com/favicon.ico" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-483fa8b6e24131543748c98c", "src_port": 49200, "tcp_stream": 79, "udp_stream": null, "frame_number": 1357, "timestamp_epoch": "1550949989.086110000" }, { "kind": "http_request", "dst_ip": "151.101.64.238", "fields": { "http.host": "static.squarespace.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/universal/scripts-compressed/common-c2a92195cbc0a2d6aed1-min.en-US.js", "http.response_in": "2049", "http.request.method": "GET", "http.request.full_uri": "http://static.squarespace.com/universal/scripts-compressed/common-c2a92195cbc0a2d6aed1-min.en-US.js" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-f3a60d1479e13d0d1d77a1f4", "src_port": 49203, "tcp_stream": 82, "udp_stream": null, "frame_number": 1433, "timestamp_epoch": "1550949997.471468000" }, { "kind": "http_request", "dst_ip": "172.217.2.10", "fields": { "http.host": "fonts.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/css?family=Lato:100,400", "http.response_in": "1522", "http.request.method": "GET", "http.request.full_uri": "http://fonts.googleapis.com/css?family=Lato:100,400" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-da855df06229341ada822ebf", "src_port": 49202, "tcp_stream": 81, "udp_stream": null, "frame_number": 1438, "timestamp_epoch": "1550949997.768948000" }, { "kind": "http_request", "dst_ip": "23.63.25.226", "fields": { "http.host": "use.typekit.net", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/ik/qtSfIe0hWL1wtEbIsJFPUsITCi0N4DUQd5Tzt0wJ8s6feGw2fFHN4UJLFRbh52jhWD9DwQShjAw3ZQsKweFR5eIuF2MkFRbXwgTuiaiaO14zdasDjhBcZWFCjkoRdhXCScNziYFRjAZ8ShUROcFzdPUCiAoTdkuqZWZ8deN3dAm0ifuE-QJUO1FUiABkZWF3jAF8OcFzdP37OcUudc8zOAs8icmCdaglZAoXOWTTwRI0SaBujW48Sagyjh90jhNlJ6U3ScNt-AuyOAozicIKgcBqZAUCZPG4fHCgIMMjMPMfH6qJtKGbMg62JMJ7fbKzMsMMeMb6MKG4fHXgIMMjgKMfH6qJK3IbMg6YJMJ7fbKTMsMMeM66MKG4f5w7IMMj2PMfH6qJKbIbMg64JMJ7fbK3MsMMeMt6MKG4fHtgIMMjIfMfH6qJRMIbMg6sJMJ7fbK7MsMMegJ6MKG4fJGgIMMjIkMfH6qJXR9bMs62JMJ7fbR5FsMgeMb6MKG4fFIVIMIjgkMfH6qJXD9bMs6FJMJ7fbRVFsMgeMt6MKG4fFJVIMIjIPMf.js", "http.response_in": "1594", "http.request.method": "GET", "http.request.full_uri": "http://use.typekit.net/ik/qtSfIe0hWL1wtEbIsJFPUsITCi0N4DUQd5Tzt0wJ8s6feGw2fFHN4UJLFRbh52jhWD9DwQShjAw3ZQsKweFR5eIuF2MkFRbXwgTuiaiaO14zdasDjhBcZWFCjkoRdhXCScNziYFRjAZ8ShUROcFzdPUCiAoTdkuqZWZ8deN3dAm0ifuE-QJUO1FUiABkZWF3jAF8OcFzdP37OcUudc8zOAs8icmCdaglZAoXOWTTwRI0SaBujW48Sagyjh90jhNlJ6U3ScNt-AuyOAozicIKgcBqZAUCZPG4fHCgIMMjMPMfH6qJtKGbMg62JMJ7fbKzMsMMeMb6MKG4fHXgIMMjgKMfH6qJK3IbMg6YJMJ7fbKTMsMMeM66MKG4f5w7IMMj2PMfH6qJKbIbMg64JMJ7fbK3MsMMeMt6MKG4fHtgIMMjIfMfH6qJRMIbMg6sJMJ7fbK7MsMMegJ6MKG4fJGgIMMjIkMfH6qJXR9bMs62JMJ7fbR5FsMgeMb6MKG4fFIVIMIjgkMfH6qJXD9bMs6FJMJ7fbRVFsMgeMt6MKG4fFJVIMIjIPMf.js" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-1c7288ec833ebd886d25f89a", "src_port": 49204, "tcp_stream": 83, "udp_stream": null, "frame_number": 1526, "timestamp_epoch": "1550949999.780623000" }, { "kind": "http_request", "dst_ip": "198.185.159.135", "fields": { "http.host": "www.rootscafeslc.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/api/census/RecordHit?crumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi", "http.response_in": "3452", "http.content_length": "882", "http.request.method": "POST", "http.request.full_uri": "http://www.rootscafeslc.com/api/census/RecordHit?crumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-bfa858952cbaafe3a2a084db", "src_port": 49196, "tcp_stream": 75, "udp_stream": null, "body_sha256": "44373d4e4bea5c974656b41b630eae6519b62aeb4889277034ba7925c01bb60f", "frame_number": 2099, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 882, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 882, "timestamp_epoch": "1550950020.077660000" }, { "kind": "http_request", "dst_ip": "172.217.2.3", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/s/lato/v14/S6u8w4BMUTPHh30AXC-s.woff", "http.response_in": "2511", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/lato/v14/S6u8w4BMUTPHh30AXC-s.woff" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-02e9823539d91ae177cf076c", "src_port": 49216, "tcp_stream": 95, "udp_stream": null, "frame_number": 2105, "timestamp_epoch": "1550950020.078881000" }, { "kind": "http_request", "dst_ip": "172.217.2.3", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/s/lato/v14/S6uyw4BMUTPHjx4wWA.woff", "http.response_in": "2779", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/lato/v14/S6uyw4BMUTPHjx4wWA.woff" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-0d7759827f38dba466753f8f", "src_port": 49215, "tcp_stream": 94, "udp_stream": null, "frame_number": 2107, "timestamp_epoch": "1550950020.079078000" }, { "kind": "http_request", "dst_ip": "209.141.55.226", "fields": { "http.host": "209.141.55.226", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/troll1.jpg", "http.response_in": "3542", "http.request.method": "GET", "http.request.full_uri": "http://209.141.55.226/troll1.jpg" }, "src_ip": "10.2.23.231", "dst_port": 80, "event_id": "evt-9680ee6c5af4ed9efcdee5d9", "src_port": 49195, "tcp_stream": 105, "udp_stream": null, "frame_number": 3119, "timestamp_epoch": "1550950028.171418000" }, { "kind": "http_request", "dst_ip": "198.185.159.135", "fields": { "http.host": "www.rootscafeslc.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/api/census/RecordHit?crumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi", "http.response_in": "3468", "http.content_length": "882", "http.request.method": "POST", "http.request.full_uri": "http://www.rootscafeslc.com/api/census/RecordHit?crumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-25e4045a78b1a15196533618", "src_port": 49196, "tcp_stream": 75, "udp_stream": null, "body_sha256": "44373d4e4bea5c974656b41b630eae6519b62aeb4889277034ba7925c01bb60f", "frame_number": 3456, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 882, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 882, "timestamp_epoch": "1550950037.861633000" }, { "kind": "http_request", "dst_ip": "8.253.129.66", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "http.response_in": "6230", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" }, "src_ip": "10.2.23.231", "dst_port": 80, "event_id": "evt-8db607f9f5cb1dacb51b707f", "src_port": 49198, "tcp_stream": 108, "udp_stream": null, "frame_number": 6171, "timestamp_epoch": "1550950405.720515000" }, { "kind": "http_request", "dst_ip": "46.249.62.199", "fields": { "http.host": "46.249.62.199", "http.request.uri": "/Tinx86_14.exe", "http.response_in": "11971", "http.request.method": "GET", "http.request.full_uri": "http://46.249.62.199/Tinx86_14.exe" }, "src_ip": "10.2.23.231", "dst_port": 80, "event_id": "evt-96b0a3215f55ebf9013fef90", "src_port": 49200, "tcp_stream": 110, "udp_stream": null, "frame_number": 6249, "timestamp_epoch": "1550950410.137505000" }, { "kind": "http_request", "dst_ip": "46.249.62.199", "fields": { "http.host": "46.249.62.199", "http.request.uri": "/Sw9JKmXqaSj.exe", "http.response_in": "6800", "http.request.method": "GET", "http.request.full_uri": "http://46.249.62.199/Sw9JKmXqaSj.exe" }, "src_ip": "10.2.23.231", "dst_port": 80, "event_id": "evt-06763f44a72dec769d52aaf8", "src_port": 49199, "tcp_stream": 109, "udp_stream": null, "frame_number": 6262, "timestamp_epoch": "1550950411.127146000" }, { "kind": "http_request", "dst_ip": "87.236.22.142", "fields": { "http.host": "superhaps.pw", "http.request.uri": "/data2.php?C68FF38437D96CED", "http.response_in": "7528", "http.request.method": "GET", "http.request.full_uri": "http://superhaps.pw/data2.php?C68FF38437D96CED" }, "src_ip": "10.2.23.231", "dst_port": 80, "event_id": "evt-336d52921714679407be0989", "src_port": 49209, "tcp_stream": 119, "udp_stream": null, "frame_number": 7524, "timestamp_epoch": "1550950467.586401000" }, { "kind": "http_request", "dst_ip": "85.143.218.7", "fields": { "http.host": "85.143.218.7", "http.request.uri": "/win.png", "http.response_in": "12777", "http.request.method": "GET", "http.request.full_uri": "http://85.143.218.7/win.png" }, "src_ip": "10.2.23.231", "dst_port": 80, "event_id": "evt-c79de5d625c695acfd4b0e53", "src_port": 49262, "tcp_stream": 150, "udp_stream": null, "frame_number": 10966, "timestamp_epoch": "1550950711.324212000" }, { "kind": "http_request", "dst_ip": "85.143.218.7", "fields": { "http.host": "85.143.218.7", "http.user_agent": "WinHTTP loader/1.0", "http.request.uri": "/tin.png", "http.response_in": "13356", "http.request.method": "GET", "http.request.full_uri": "http://85.143.218.7/tin.png" }, "src_ip": "10.2.23.231", "dst_port": 80, "event_id": "evt-9c191824d69c5e28f0ded63b", "src_port": 49273, "tcp_stream": 161, "udp_stream": null, "frame_number": 11986, "timestamp_epoch": "1550950744.487874000" }, { "kind": "http_request", "dst_ip": "23.218.156.17", "fields": { "http.host": "crl.microsoft.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/pki/crl/products/CSPCA.crl", "http.response_in": "16115", "http.request.method": "GET", "http.request.full_uri": "http://crl.microsoft.com/pki/crl/products/CSPCA.crl" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-1b3a25899b93535194cb2b8a", "src_port": 49231, "tcp_stream": 184, "udp_stream": null, "frame_number": 16113, "timestamp_epoch": "1550950846.604756000" }, { "kind": "http_request", "dst_ip": "72.21.81.240", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "http.response_in": "20132", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" }, "src_ip": "10.2.23.231", "dst_port": 80, "event_id": "evt-84ef9c17c89f7a239f2e1093", "src_port": 49553, "tcp_stream": 195, "udp_stream": null, "frame_number": 19578, "timestamp_epoch": "1550950926.328163000" }, { "kind": "http_request", "dst_ip": "216.239.32.21", "fields": { "http.host": "ipecho.net", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2228.0 Safari/537.36", "http.request.uri": "/plain", "http.response_in": "19797", "http.request.method": "GET", "http.request.full_uri": "http://ipecho.net/plain" }, "src_ip": "10.2.23.231", "dst_port": 80, "event_id": "evt-08ae064ac67ee6bb3003da1b", "src_port": 49554, "tcp_stream": 196, "udp_stream": null, "frame_number": 19795, "timestamp_epoch": "1550950931.858061000" }, { "kind": "http_request", "dst_ip": "85.143.218.7", "fields": { "http.host": "85.143.218.7", "http.user_agent": "WinHTTP loader/1.0", "http.request.uri": "/sin.png", "http.response_in": "20903", "http.request.method": "GET", "http.request.full_uri": "http://85.143.218.7/sin.png" }, "src_ip": "10.2.23.231", "dst_port": 80, "event_id": "evt-761d0fd37aef9d958ed544ef", "src_port": 49558, "tcp_stream": 200, "udp_stream": null, "frame_number": 20146, "timestamp_epoch": "1550950940.188912000" }, { "kind": "http_request", "dst_ip": "190.146.112.216", "fields": { "http.host": "190.146.112.216", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/83/", "http.response_in": "23796", "http.content_length": "286", "http.request.method": "POST", "http.request.full_uri": "http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/83/" }, "src_ip": "10.2.23.231", "dst_port": 8082, "event_id": "evt-4e8239ab6efa86fe7e87b431", "src_port": 49565, "tcp_stream": 207, "udp_stream": null, "body_sha256": "360daaf74aa6a7e36952e66764a76de6b6a1a48bcbbad611288396ead6f733bb", "frame_number": 23794, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 286, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 286, "timestamp_epoch": "1550951353.371777000" }, { "kind": "http_request", "dst_ip": "190.146.112.216", "fields": { "http.host": "190.146.112.216", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/81/", "http.response_in": "23819", "http.content_length": "262", "http.request.method": "POST", "http.request.full_uri": "http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/81/" }, "src_ip": "10.2.23.231", "dst_port": 8082, "event_id": "evt-283589e910481d4a9551eaca", "src_port": 49566, "tcp_stream": 208, "udp_stream": null, "body_sha256": "d95a35fac8425ed6c010066a81b4330ade8dd325713e077d67fcfd33e7cafcac", "frame_number": 23816, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 262, "credential_record_present": true, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 262, "timestamp_epoch": "1550951355.921398000" }, { "kind": "http_request", "dst_ip": "190.146.112.216", "fields": { "http.host": "190.146.112.216:8082", "http.user_agent": "test", "http.request.uri": "/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/90", "http.response_in": "24670", "http.content_length": "2105", "http.request.method": "POST", "http.request.full_uri": "http://190.146.112.216:8082/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/90" }, "src_ip": "10.2.23.231", "dst_port": 8082, "event_id": "evt-4349e7baa4053b880b166cdd", "src_port": 49570, "tcp_stream": 212, "udp_stream": null, "body_sha256": "de799971c904cfabc587484202b8d4bd4b40414ac6b23d1e51b16196bf100013", "frame_number": 24666, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2105, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2105, "timestamp_epoch": "1550951415.192699000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/", "http.response_in": "25048", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-69dfbb662364ed39cde08ed5", "src_port": 49232, "tcp_stream": 215, "udp_stream": null, "frame_number": 24724, "timestamp_epoch": "1550951426.570470000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/css/bootstrap.css", "http.response_in": "26006", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/bootstrap.css" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-80ba4359ddf4cff3be799f2d", "src_port": 49233, "tcp_stream": 216, "udp_stream": null, "frame_number": 24734, "timestamp_epoch": "1550951426.966829000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/style.css", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/style.css" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-4d90596be351253aaf64f12c", "src_port": 49234, "tcp_stream": 217, "udp_stream": null, "frame_number": 24753, "timestamp_epoch": "1550951427.031893000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/css/animate.css", "http.response_in": "25448", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/animate.css" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-f42797865b755b1989a0e580", "src_port": 49240, "tcp_stream": 223, "udp_stream": null, "frame_number": 24828, "timestamp_epoch": "1550951427.595681000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/css/responsive.css", "http.response_in": "25568", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/responsive.css" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-1df6d998ed64cf8a2aea6c27", "src_port": 49241, "tcp_stream": 224, "udp_stream": null, "frame_number": 24829, "timestamp_epoch": "1550951427.595969000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/css/swiper.css", "http.response_in": "25166", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/swiper.css" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-5922ef461f1e17b3a492aaa0", "src_port": 49232, "tcp_stream": 215, "udp_stream": null, "frame_number": 25050, "timestamp_epoch": "1550951429.285375000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/css/dark.css", "http.response_in": "25411", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/dark.css" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-d882e31731233c2b60f746a7", "src_port": 49236, "tcp_stream": 219, "udp_stream": null, "frame_number": 25099, "timestamp_epoch": "1550951430.033640000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/css/font-icons.css", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/font-icons.css" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-b53ea0ab03bf2094102bf488", "src_port": 49237, "tcp_stream": 220, "udp_stream": null, "frame_number": 25103, "timestamp_epoch": "1550951430.057131000" }, { "kind": "http_request", "dst_ip": "172.217.2.10", "fields": { "http.host": "fonts.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/css?family=Lato:300,400,400italic,600,700|Raleway:300,400,500,600,700|Crete+Round:400italic", "http.response_in": "25159", "http.request.method": "GET", "http.request.full_uri": "http://fonts.googleapis.com/css?family=Lato:300,400,400italic,600,700|Raleway:300,400,500,600,700|Crete+Round:400italic" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-772688d90064bb5b7b20646e", "src_port": 49244, "tcp_stream": 227, "udp_stream": null, "frame_number": 25114, "timestamp_epoch": "1550951430.317878000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/images/logo1.png", "http.response_in": "25232", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/logo1.png" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-77936d5c594c4525c804e988", "src_port": 49247, "tcp_stream": 229, "udp_stream": null, "frame_number": 25144, "timestamp_epoch": "1550951430.455912000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/js/functions.js", "http.response_in": "27968", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/functions.js" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-12a4287baa9536275528ddad", "src_port": 49246, "tcp_stream": 230, "udp_stream": null, "frame_number": 25149, "timestamp_epoch": "1550951430.456252000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/Images1/custom/Opiate_ProvoTownHall.jpg", "http.response_in": "26101", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/Images1/custom/Opiate_ProvoTownHall.jpg" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-5a5a1ce4404e7f1f56042e05", "src_port": 49232, "tcp_stream": 215, "udp_stream": null, "frame_number": 25168, "timestamp_epoch": "1550951430.605082000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/Dept/COMMISH/Data/WNData/default.jpg", "http.response_in": "25503", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/Dept/COMMISH/Data/WNData/default.jpg" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-39339a7a6a0592de29871b04", "src_port": 49247, "tcp_stream": 229, "udp_stream": null, "frame_number": 25234, "timestamp_epoch": "1550951431.173776000" }, { "kind": "http_request", "dst_ip": "204.79.197.200", "fields": { "http.host": "www.bing.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/favicon.ico", "http.response_in": "25264", "http.request.method": "GET", "http.request.full_uri": "http://www.bing.com/favicon.ico" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-0c2cb8a3a69fe0cf26637b87", "src_port": 49248, "tcp_stream": 232, "udp_stream": null, "frame_number": 25256, "timestamp_epoch": "1550951431.532822000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/Dept/SHERIFF/Data/WNData/OUR_Adobe_Jon_Lines_Award.jpg", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/OUR_Adobe_Jon_Lines_Award.jpg" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-fe798c9e77d0308261200b08", "src_port": 49236, "tcp_stream": 219, "udp_stream": null, "frame_number": 25413, "timestamp_epoch": "1550951433.296277000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/Dept/SHERIFF/Data/WNData/Martin_Richard.jpg", "http.response_in": "25567", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/Martin_Richard.jpg" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-f18a30a065b28e0c70553c08", "src_port": 49240, "tcp_stream": 223, "udp_stream": null, "frame_number": 25450, "timestamp_epoch": "1550951433.801767000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/Dept/SHERIFF/Data/WNData/JerikaTimpCaveTrail1.JPG", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/JerikaTimpCaveTrail1.JPG" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-ae2ff5f6dbb8dc425533a71b", "src_port": 49247, "tcp_stream": 229, "udp_stream": null, "frame_number": 25505, "timestamp_epoch": "1550951434.213427000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/Dept/SHERIFF/Data/WNData/IMG_1047.JPG", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/IMG_1047.JPG" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-0f2c510914409d405ab7b432", "src_port": 49241, "tcp_stream": 224, "udp_stream": null, "frame_number": 25571, "timestamp_epoch": "1550951434.984633000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/Dept/SHERIFF/Data/WNData/TanyaandJenna.jpg", "http.response_in": "28116", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/TanyaandJenna.jpg" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-82f24e9d261603af4b610fc7", "src_port": 49240, "tcp_stream": 223, "udp_stream": null, "frame_number": 25573, "timestamp_epoch": "1550951434.984812000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/js/jquery.js", "http.response_in": "26841", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/jquery.js" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-aeab1f9c96d3456de23f2b8e", "src_port": 49242, "tcp_stream": 226, "udp_stream": null, "frame_number": 25868, "timestamp_epoch": "1550951438.897816000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/js/plugins.js", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/plugins.js" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-004561778142d97c060f3af2", "src_port": 49243, "tcp_stream": 225, "udp_stream": null, "frame_number": 25880, "timestamp_epoch": "1550951438.932666000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tick.png", "http.response_in": "26022", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tick.png" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-1a12c8e3da043d580159a81d", "src_port": 49233, "tcp_stream": 216, "udp_stream": null, "frame_number": 26008, "timestamp_epoch": "1550951440.093034000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tools.png", "http.response_in": "26241", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tools.png" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-7b9d0a7b15b175776f6312f9", "src_port": 49233, "tcp_stream": 216, "udp_stream": null, "frame_number": 26024, "timestamp_epoch": "1550951440.217419000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/map.png", "http.response_in": "26145", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/map.png" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-af94ba872246bf6a858af0f8", "src_port": 49232, "tcp_stream": 215, "udp_stream": null, "frame_number": 26103, "timestamp_epoch": "1550951441.282788000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/performance.png", "http.response_in": "26235", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/performance.png" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-3f3a98dfd5f620375a838ff7", "src_port": 49232, "tcp_stream": 215, "udp_stream": null, "frame_number": 26147, "timestamp_epoch": "1550951442.235477000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/images/clients/1A1.png", "http.response_in": "27118", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/1A1.png" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-f91a6daba4d5595611e27d45", "src_port": 49232, "tcp_stream": 215, "udp_stream": null, "frame_number": 26237, "timestamp_epoch": "1550951443.195589000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/images/clients/2A1.png", "http.response_in": "26865", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/2A1.png" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-617ad36002e46f2176c285a5", "src_port": 49233, "tcp_stream": 216, "udp_stream": null, "frame_number": 26243, "timestamp_epoch": "1550951443.363937000" }, { "kind": "http_request", "dst_ip": "190.146.112.216", "fields": { "http.host": "190.146.112.216:8082", "http.user_agent": "test", "http.request.uri": "/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/90", "http.response_in": "26802", "http.content_length": "4678", "http.request.method": "POST", "http.request.full_uri": "http://190.146.112.216:8082/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/90" }, "src_ip": "10.2.23.231", "dst_port": 8082, "event_id": "evt-ccc6321779f740a50c802452", "src_port": 49577, "tcp_stream": 237, "udp_stream": null, "body_sha256": "77ab5e18a4c52fe1b402ca8907ad3315c19e1fb7ed19aaa03f1fb3070cd286b1", "frame_number": 26591, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [ { "type": "hostname", "value": "Ferguson-Win-PC", "source": "explicit-body-label" }, { "type": "account", "value": "ruby.ferguson", "source": "explicit-body-label" } ], "inspected_bytes": 4678, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": true }, "body_size_bytes": 4678, "timestamp_epoch": "1550951444.371220000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/images/clients/3A1.png", "http.response_in": "27683", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/3A1.png" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-54a6bea46919e530fa214069", "src_port": 49242, "tcp_stream": 226, "udp_stream": null, "frame_number": 26843, "timestamp_epoch": "1550951447.135555000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/images/clients/6A1.png", "http.response_in": "27155", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/6A1.png" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-78fd5d87cf20dc184bf65247", "src_port": 49233, "tcp_stream": 216, "udp_stream": null, "frame_number": 26868, "timestamp_epoch": "1550951447.371722000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/images/clients/7ABurn1.png", "http.response_in": "27070", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/7ABurn1.png" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-ec559c55290221235494a42e", "src_port": 49250, "tcp_stream": 238, "udp_stream": null, "frame_number": 26945, "timestamp_epoch": "1550951448.057698000" }, { "kind": "http_request", "dst_ip": "161.119.42.22", "fields": { "http.host": "www.co.utah.ut.us", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/apps/LeenaCanvas/Package-HTML/HTML/images/clients/StormWater1.png", "http.response_in": "27246", "http.request.method": "GET", "http.request.full_uri": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/StormWater1.png" }, "src_ip": "10.2.23.109", "dst_port": 80, "event_id": "evt-f9542199b8babe1ca2f370e1", "src_port": 49250, "tcp_stream": 238, "udp_stream": null, "frame_number": 27072, "timestamp_epoch": "1550951449.806280000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "312", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "23.223.195.42", "dst_port": 49176, "event_id": "evt-d4168e95a356defc0a096791", "src_port": 80, "tcp_stream": 19, "udp_stream": null, "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "frame_number": 314, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1550949882.793932000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "752", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "23.223.195.42", "dst_port": 49177, "event_id": "evt-93e1f44dfb36d76827fccf4a", "src_port": 80, "tcp_stream": 45, "udp_stream": null, "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "frame_number": 796, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1550949925.621152000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "1185", "http.response.code": "301", "http.transfer_encoding": "chunked" }, "src_ip": "198.185.159.136", "dst_port": 49194, "event_id": "evt-03967b77477c01696b9bcaf9", "src_port": 80, "tcp_stream": 72, "udp_stream": null, "frame_number": 1189, "timestamp_epoch": "1550949984.830126000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "1197", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.content_length": "7343", "http.content_encoding": "gzip" }, "src_ip": "198.185.159.135", "dst_port": 49195, "event_id": "evt-ebe2f5a142b5ad399dd8d9d6", "src_port": 80, "tcp_stream": 74, "udp_stream": null, "body_sha256": "6ee67e7ec3881929e6d6f2bf4e761fb44d04b84b5e77f1df7ef3c05a698484ee", "frame_number": 1210, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 27975, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 27975, "timestamp_epoch": "1550949986.103590000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "1219", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "47031" }, "src_ip": "151.101.0.238", "dst_port": 49197, "event_id": "evt-09902bdc150d0415ddcf5946", "src_port": 80, "tcp_stream": 76, "udp_stream": null, "body_sha256": "152f05b79c5f8ae61dce111c5415be105396ad820f3fc3cd537b0aaa2acd8d58", "frame_number": 1307, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 47031, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 47031, "timestamp_epoch": "1550949988.156805000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "1357", "http.content_type": "image/x-icon", "http.response.code": "200", "http.content_length": "237" }, "src_ip": "204.79.197.200", "dst_port": 49200, "event_id": "evt-b45c3c54ca8d6f1233d089f3", "src_port": 80, "tcp_stream": 79, "udp_stream": null, "body_sha256": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914", "frame_number": 1368, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 237, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 237, "timestamp_epoch": "1550949989.443394000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "1309", "http.content_type": "text/css; charset=UTF-8", "http.response.code": "200", "http.content_length": "57572", "http.content_encoding": "gzip" }, "src_ip": "151.101.0.238", "dst_port": 49197, "event_id": "evt-0eb87927c24fd8eb504eb8cf", "src_port": 80, "tcp_stream": 76, "udp_stream": null, "body_sha256": "810151e2aa23d212c5105db84e9eb16a76bb589eacfd4bc5a287a092c2ef71fa", "frame_number": 1415, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 548880, "timestamp_epoch": "1550949990.600699000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "1438", "http.content_type": "text/css; charset=utf-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "172.217.2.10", "dst_port": 49202, "event_id": "evt-28bf84d266d52832a69bbcd3", "src_port": 80, "tcp_stream": 81, "udp_stream": null, "body_sha256": "ec0a5627751851db7afed684f83dde6178c3e6b2114adc24a1294fb2bb1d40e8", "frame_number": 1522, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 432, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 432, "timestamp_epoch": "1550949999.760145000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "1526", "http.content_type": "text/javascript;charset=utf-8", "http.response.code": "200", "http.content_length": "7843", "http.content_encoding": "gzip" }, "src_ip": "23.63.25.226", "dst_port": 49204, "event_id": "evt-11547df09ed20d613547cbd8", "src_port": 80, "tcp_stream": 83, "udp_stream": null, "body_sha256": "640994b0bf9615de96e00f0344d84c56ff04eff2f47e99ebf0c9ea7fa6ba3502", "frame_number": 1594, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23159, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 23159, "timestamp_epoch": "1550950001.311240000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "1433", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "357021", "http.content_encoding": "gzip" }, "src_ip": "151.101.64.238", "dst_port": 49203, "event_id": "evt-679c0a61d203950f02e95a1f", "src_port": 80, "tcp_stream": 82, "udp_stream": null, "body_sha256": "63e2dc2b85defb87378e12ecd7d0f4631d37fcf42152acf2a28ae7453b40633c", "frame_number": 2049, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1841388, "timestamp_epoch": "1550950018.735133000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "2105", "http.content_type": "font/woff", "http.response.code": "200", "http.content_length": "26860" }, "src_ip": "172.217.2.3", "dst_port": 49216, "event_id": "evt-c0b29d7c85c29e339a4265b6", "src_port": 80, "tcp_stream": 95, "udp_stream": null, "body_sha256": "6281f4b88789d78a3520cea62298a5d76562a5ac5a265c915f58ab46e90773bf", "frame_number": 2511, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 26860, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 26860, "timestamp_epoch": "1550950022.640892000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "2107", "http.content_type": "font/woff", "http.response.code": "200", "http.content_length": "28412" }, "src_ip": "172.217.2.3", "dst_port": 49215, "event_id": "evt-fec728fa2c1329f89584c72c", "src_port": 80, "tcp_stream": 94, "udp_stream": null, "body_sha256": "5aeb07f9980663c2501c9620371e11ae7aa6e320d94dd753d0ef56d8308c74b3", "frame_number": 2779, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 28412, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 28412, "timestamp_epoch": "1550950024.656101000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "2099", "http.content_type": "application/json; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "198.185.159.135", "dst_port": 49196, "event_id": "evt-b2ca9b6adb482cf3c35d4c14", "src_port": 80, "tcp_stream": 75, "udp_stream": null, "body_sha256": "71a22598eedbbdedd0ba95f9fbf4a19726abf69681462f56cf535f4fd505a079", "frame_number": 3452, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 151, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 151, "timestamp_epoch": "1550950037.839308000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "3456", "http.content_type": "application/json; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "198.185.159.135", "dst_port": 49196, "event_id": "evt-04e79502f374728708f1ba61", "src_port": 80, "tcp_stream": 75, "udp_stream": null, "body_sha256": "e32d0b53c63fe1a6b0759ebc8824b97661d369004213853438faaa34134967e6", "frame_number": 3468, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 151, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 151, "timestamp_epoch": "1550950038.050329000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "3119", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "122880" }, "src_ip": "209.141.55.226", "dst_port": 49195, "event_id": "evt-f33633ddee8fd3ba29e8df05", "src_port": 80, "tcp_stream": 105, "udp_stream": null, "body_sha256": "8cf2cddda8522975a22da3da429339be471234eacc0e11c099d6dcb732cf3cbb", "frame_number": 3542, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 122880, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 122880, "timestamp_epoch": "1550950040.342832000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "6171", "http.content_type": "application/vnd.ms-cab-compressed", "http.response.code": "200", "http.content_length": "56560" }, "src_ip": "8.253.129.66", "dst_port": 49198, "event_id": "evt-71c48e613d4bef1aed4316cd", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "3c4ec495f17d21cc236bc7238bc02728bd945c07157fbf875cac340269afc207", "frame_number": 6230, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 56560, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 56560, "timestamp_epoch": "1550950409.157698000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "6262", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "168448" }, "src_ip": "46.249.62.199", "dst_port": 49199, "event_id": "evt-bf58f04eb00745def649720d", "src_port": 80, "tcp_stream": 109, "udp_stream": null, "body_sha256": "d43159c8bf2e1bd866abdbb1687911e2282b1f98a7c063f85ffd53a7f51efed4", "frame_number": 6800, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 168448, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 168448, "timestamp_epoch": "1550950432.567344000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "7524", "http.response.code": "101" }, "src_ip": "87.236.22.142", "dst_port": 49209, "event_id": "evt-4ffb9acf1e857840c720cf26", "src_port": 80, "tcp_stream": 119, "udp_stream": null, "frame_number": 7528, "timestamp_epoch": "1550950467.897616000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "6249", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "2818560" }, "src_ip": "46.249.62.199", "dst_port": 49200, "event_id": "evt-7b4cb5a716e14b9c0eda3e92", "src_port": 80, "tcp_stream": 110, "udp_stream": null, "body_sha256": "f1b789be1126b557240dd0dfe98fc5f3ad6341bb1a5d8be0a954f65b486ad32a", "frame_number": 11971, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2818560, "timestamp_epoch": "1550950744.087696000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "10966", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "270336" }, "src_ip": "85.143.218.7", "dst_port": 49262, "event_id": "evt-ef5304267b794eabc76ddd66", "src_port": 80, "tcp_stream": 150, "udp_stream": null, "body_sha256": "38c6c5b8d6fa71d9856758a5c0c2ac9d0a0a1450f75bb1004dd988e23d73a312", "frame_number": 12777, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 270336, "timestamp_epoch": "1550950769.154035000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "11986", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "270336" }, "src_ip": "85.143.218.7", "dst_port": 49273, "event_id": "evt-c4c1ee9bb982fa0b794e05c2", "src_port": 80, "tcp_stream": 161, "udp_stream": null, "body_sha256": "4c957072ab097d3474039f432466cd251d1dc7d91559b76d4e5ead4a8bd499d5", "frame_number": 13356, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 270336, "timestamp_epoch": "1550950790.090739000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "16113", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "506" }, "src_ip": "23.218.156.17", "dst_port": 49231, "event_id": "evt-6cef6dff22f6a916f4c87247", "src_port": 80, "tcp_stream": 184, "udp_stream": null, "body_sha256": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "frame_number": 16115, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 506, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 506, "timestamp_epoch": "1550950846.686257000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "19795", "http.content_type": "text/plain; charset=utf-8", "http.response.code": "302", "http.content_length": "46" }, "src_ip": "216.239.32.21", "dst_port": 49554, "event_id": "evt-d32bea6428bcbd136a4d5620", "src_port": 80, "tcp_stream": 196, "udp_stream": null, "body_sha256": "1fee1ef37060734fe38728af41fad66a827abb34151a3658ceee6000d4df40b2", "frame_number": 19797, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 46, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 46, "timestamp_epoch": "1550950932.270052000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "19578", "http.content_type": "application/vnd.ms-cab-compressed", "http.response.code": "200", "http.content_length": "56560" }, "src_ip": "72.21.81.240", "dst_port": 49553, "event_id": "evt-a683d9aef0aca77f8d9f7ad7", "src_port": 80, "tcp_stream": 195, "udp_stream": null, "body_sha256": "3c4ec495f17d21cc236bc7238bc02728bd945c07157fbf875cac340269afc207", "frame_number": 20132, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 56560, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 56560, "timestamp_epoch": "1550950939.798540000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "20146", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "270336" }, "src_ip": "85.143.218.7", "dst_port": 49558, "event_id": "evt-2e1f7c1d33f14bd0127fbf5e", "src_port": 80, "tcp_stream": 200, "udp_stream": null, "body_sha256": "3abae6dd2ddae23b2de2ccbcc160a4a5773bef8934d0e6896d50197c3d3c417f", "frame_number": 20903, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 270336, "timestamp_epoch": "1550950987.637616000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "23794", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "190.146.112.216", "dst_port": 49565, "event_id": "evt-e588e85619f57d5150c7ff4c", "src_port": 8082, "tcp_stream": 207, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 23796, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1550951353.957116000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "23816", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "190.146.112.216", "dst_port": 49566, "event_id": "evt-d0871ba957d9e9712d848dda", "src_port": 8082, "tcp_stream": 208, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 23819, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1550951356.418447000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "24666", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "190.146.112.216", "dst_port": 49570, "event_id": "evt-b672af11f8261eff6421005f", "src_port": 8082, "tcp_stream": 212, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 24670, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1550951415.807159000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "24724", "http.content_type": "text/html", "http.response.code": "200", "http.content_length": "61931" }, "src_ip": "161.119.42.22", "dst_port": 49232, "event_id": "evt-28c365642a5f7737081095dd", "src_port": 80, "tcp_stream": 215, "udp_stream": null, "body_sha256": "6736e7a0746fbcfef21feae864dda1ae4e888d3ea1d5cea115c71849e47e787a", "frame_number": 25048, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 61931, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 61931, "timestamp_epoch": "1550951429.284563000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "25114", "http.content_type": "text/css; charset=utf-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "172.217.2.10", "dst_port": 49244, "event_id": "evt-d5828bf8e3dc02947a323a8c", "src_port": 80, "tcp_stream": 227, "udp_stream": null, "body_sha256": "33c2fde7c0162c50e4450e874c99a13a086a56db266d8962bd7d31bdb08956f3", "frame_number": 25159, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2251, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2251, "timestamp_epoch": "1550951430.561445000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "25050", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "17216" }, "src_ip": "161.119.42.22", "dst_port": 49232, "event_id": "evt-2e87031b21c59c8cda26f400", "src_port": 80, "tcp_stream": 215, "udp_stream": null, "body_sha256": "6b6bf68b59a71f79863bf3b342b6dba38c2dbb76814deea82250c513517ddb19", "frame_number": 25166, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 17216, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 17216, "timestamp_epoch": "1550951430.604451000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "25144", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "9666" }, "src_ip": "161.119.42.22", "dst_port": 49247, "event_id": "evt-8b3bfa04667a7ef4dcf7eb9f", "src_port": 80, "tcp_stream": 229, "udp_stream": null, "body_sha256": "9a9eef92488fae7c9199a57abe8fe52dfbabfd4884a150cde674f86304748c84", "frame_number": 25232, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 9666, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 9666, "timestamp_epoch": "1550951431.173059000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "25256", "http.content_type": "image/x-icon", "http.response.code": "200", "http.content_length": "237" }, "src_ip": "204.79.197.200", "dst_port": 49248, "event_id": "evt-8725517946319fba06e39b0a", "src_port": 80, "tcp_stream": 232, "udp_stream": null, "body_sha256": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914", "frame_number": 25264, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 237, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 237, "timestamp_epoch": "1550951431.602730000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "25099", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "55948" }, "src_ip": "161.119.42.22", "dst_port": 49236, "event_id": "evt-048c0e9bfb18c22759ebe670", "src_port": 80, "tcp_stream": 219, "udp_stream": null, "body_sha256": "51cd2200fde479b2d57db744c846f9c83dbefe967e10efa510a0eecf644ac2ac", "frame_number": 25411, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 55948, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 55948, "timestamp_epoch": "1550951433.295385000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "24828", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "70788" }, "src_ip": "161.119.42.22", "dst_port": 49240, "event_id": "evt-ed8375cdf53f741345955891", "src_port": 80, "tcp_stream": 223, "udp_stream": null, "body_sha256": "ce3a22f1ccba5bbeebb0a9fd49c3e72fbde9e1816959b67e5b1fb248c1e1041a", "frame_number": 25448, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 70788, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 70788, "timestamp_epoch": "1550951433.800967000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "25234", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "25595" }, "src_ip": "161.119.42.22", "dst_port": 49247, "event_id": "evt-c62d1b63f8179a8d34b9fc37", "src_port": 80, "tcp_stream": 229, "udp_stream": null, "body_sha256": "df5f5ce34c9cf3edd665586295e356d6b56d9ef3e54614001f4b178217ec92fe", "frame_number": 25503, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 25595, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 25595, "timestamp_epoch": "1550951434.212345000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "25450", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "10185" }, "src_ip": "161.119.42.22", "dst_port": 49240, "event_id": "evt-1ae1077707cf85b3e36a3478", "src_port": 80, "tcp_stream": 223, "udp_stream": null, "body_sha256": "aaa1afd7ae3a37dd93a8b19408e2770eaee666932366bf4e1703533148914076", "frame_number": 25567, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 10185, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 10185, "timestamp_epoch": "1550951434.983996000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "24829", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "43468" }, "src_ip": "161.119.42.22", "dst_port": 49241, "event_id": "evt-4cb341d202dfc2cd54c930ef", "src_port": 80, "tcp_stream": 224, "udp_stream": null, "body_sha256": "f0c4a8877fe0d8ed1f7350d20d476d37601fb6c6119eb986fce4d8ae2852061c", "frame_number": 25568, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 43468, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 43468, "timestamp_epoch": "1550951434.984084000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "24734", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "128190" }, "src_ip": "161.119.42.22", "dst_port": 49233, "event_id": "evt-7167753554478da85cd398f7", "src_port": 80, "tcp_stream": 216, "udp_stream": null, "body_sha256": "d7c9595737524bc5febd4507cbe47457dbd59ce733315f1ada59a91c6754c193", "frame_number": 26006, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 128190, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 128190, "timestamp_epoch": "1550951440.092420000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "26008", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "6046" }, "src_ip": "161.119.42.22", "dst_port": 49233, "event_id": "evt-d2c328ce9be304d2fc4093fb", "src_port": 80, "tcp_stream": 216, "udp_stream": null, "body_sha256": "6bb03471d2a729fd037bb0f8b42854c3b9d14e87e7bc9b337ed2274a74a0a3c4", "frame_number": 26022, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6046, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 6046, "timestamp_epoch": "1550951440.216997000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "25168", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "24715" }, "src_ip": "161.119.42.22", "dst_port": 49232, "event_id": "evt-a9ff0f28ea2e2fb6d19d9330", "src_port": 80, "tcp_stream": 215, "udp_stream": null, "body_sha256": "ed001f8b45a9191508e79be37b5a0003faaf3bc356eb241fe11f2b56ab9f60ae", "frame_number": 26101, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 24715, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 24715, "timestamp_epoch": "1550951441.282231000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "26103", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "5595" }, "src_ip": "161.119.42.22", "dst_port": 49232, "event_id": "evt-e59a887fe2b9bbe719d02476", "src_port": 80, "tcp_stream": 215, "udp_stream": null, "body_sha256": "d7b2de7a314f64ab62777494d3f9587dd679d637fd8e68783b68977bbb3df29e", "frame_number": 26145, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5595, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5595, "timestamp_epoch": "1550951442.234915000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "26147", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "4680" }, "src_ip": "161.119.42.22", "dst_port": 49232, "event_id": "evt-dfe7e0a8d51a84b5ed271f8e", "src_port": 80, "tcp_stream": 215, "udp_stream": null, "body_sha256": "592e7fa07596b36f577e4a703c8614d98c6602b3fbafd6cf94026aadc109ee42", "frame_number": 26235, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4680, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 4680, "timestamp_epoch": "1550951443.194829000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "26024", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "5968" }, "src_ip": "161.119.42.22", "dst_port": 49233, "event_id": "evt-f3346b61b31d4b848325b4e1", "src_port": 80, "tcp_stream": 216, "udp_stream": null, "body_sha256": "f7b0061ce2ceec8a73a0957dc975d2dde0f4de8c0b63c041cd78a29414d2645c", "frame_number": 26241, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5968, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5968, "timestamp_epoch": "1550951443.363403000" }, { "kind": "http_response", "dst_ip": "10.2.23.231", "fields": { "http.request_in": "26591", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "190.146.112.216", "dst_port": 49577, "event_id": "evt-8af3138c49761292bf5cd1d5", "src_port": 8082, "tcp_stream": 237, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 26802, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1550951446.619091000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "25868", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "95954" }, "src_ip": "161.119.42.22", "dst_port": 49242, "event_id": "evt-38f4d6645eaa9e5ea0807e28", "src_port": 80, "tcp_stream": 226, "udp_stream": null, "body_sha256": "9801c1c9ecc18a5361fbb2188614518c84837fd23cdcc5dafde214c7efc5ba61", "frame_number": 26841, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 95954, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 95954, "timestamp_epoch": "1550951447.134923000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "26243", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "9151" }, "src_ip": "161.119.42.22", "dst_port": 49233, "event_id": "evt-bd2cd7400a8f7bcb93ff51a8", "src_port": 80, "tcp_stream": 216, "udp_stream": null, "body_sha256": "7898a2dbfd52591cf085b2743c0f2eaa750143b77a8cfebfbbf23d692bc4d846", "frame_number": 26865, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 9151, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 9151, "timestamp_epoch": "1550951447.370546000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "26945", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "32241" }, "src_ip": "161.119.42.22", "dst_port": 49250, "event_id": "evt-d9cce9a082ac415556ef57e4", "src_port": 80, "tcp_stream": 238, "udp_stream": null, "body_sha256": "fbf3439d0eb209ab2bdf6794da01485836e5bb0910c4624ac2d43dead3ff10d9", "frame_number": 27070, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 32241, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 32241, "timestamp_epoch": "1550951449.805659000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "26237", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "61552" }, "src_ip": "161.119.42.22", "dst_port": 49232, "event_id": "evt-410fe04f73320f4484b96020", "src_port": 80, "tcp_stream": 215, "udp_stream": null, "body_sha256": "adc225a50d7a314341a7c857f092b962e3967d4addb7d2b48ff335c7bedad350", "frame_number": 27118, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 61552, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 61552, "timestamp_epoch": "1550951450.581148000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "26868", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "10536" }, "src_ip": "161.119.42.22", "dst_port": 49233, "event_id": "evt-6a2fd7d76bea47dadac0b4e0", "src_port": 80, "tcp_stream": 216, "udp_stream": null, "body_sha256": "a7325536819e47e298d38720b60ecb4c6ca63ebf07df04e768ee95d92c854e17", "frame_number": 27155, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 10536, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 10536, "timestamp_epoch": "1550951451.114407000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "27072", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "34595" }, "src_ip": "161.119.42.22", "dst_port": 49250, "event_id": "evt-3b2ac332532ed9af412124dc", "src_port": 80, "tcp_stream": 238, "udp_stream": null, "body_sha256": "17ef1c0ff8515ab325b5976632264553118a2618e5e8dcf3ff058dee515ab738", "frame_number": 27246, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 34595, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 34595, "timestamp_epoch": "1550951452.196595000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "26843", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "83761" }, "src_ip": "161.119.42.22", "dst_port": 49242, "event_id": "evt-b91c6ef3d43fa26d547030f7", "src_port": 80, "tcp_stream": 226, "udp_stream": null, "body_sha256": "3362bbc3aeca0b9a3e74c27568033c566350d30214cfa383b470327ec2ac8c07", "frame_number": 27683, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 83761, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 83761, "timestamp_epoch": "1550951457.461120000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "25149", "http.content_type": "application/javascript", "http.response.code": "200", "http.content_length": "126945" }, "src_ip": "161.119.42.22", "dst_port": 49246, "event_id": "evt-4c60a8231e909d5d8fc6e57d", "src_port": 80, "tcp_stream": 230, "udp_stream": null, "body_sha256": "b577d12d1f8eaacf060db96a7b2bcc0009d0c3fd8d4842bd85175a50b2a1f972", "frame_number": 27968, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 126945, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 126945, "timestamp_epoch": "1550951460.239749000" }, { "kind": "http_response", "dst_ip": "10.2.23.109", "fields": { "http.request_in": "25573", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "227673" }, "src_ip": "161.119.42.22", "dst_port": 49240, "event_id": "evt-dc02c8dc7e0abccfe5b3c8d1", "src_port": 80, "tcp_stream": 223, "udp_stream": null, "body_sha256": "351e3c9dadd0128ea718633173e073a6f7a3d9bf6a1ce173bff2221cb3b0afae", "frame_number": 28116, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 227673, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 227673, "timestamp_epoch": "1550951462.411859000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "151.101.0.238", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static1.squarespace.com" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-69b0496751690473d45054ff", "src_port": 49199, "tcp_stream": 78, "udp_stream": null, "frame_number": 1279, "timestamp_epoch": "1550949987.324811000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-5c7935d612aef5c9df6fa018", "src_port": 49205, "tcp_stream": 84, "udp_stream": null, "frame_number": 1851, "timestamp_epoch": "1550950014.113030000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-d6791af85f99c03a53521813", "src_port": 49206, "tcp_stream": 85, "udp_stream": null, "frame_number": 1894, "timestamp_epoch": "1550950015.124585000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-44da0c3224062f33992cb9bd", "src_port": 49208, "tcp_stream": 87, "udp_stream": null, "frame_number": 2072, "timestamp_epoch": "1550950019.948062000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-6049070da0d44ed329e6db2c", "src_port": 49210, "tcp_stream": 89, "udp_stream": null, "frame_number": 2074, "timestamp_epoch": "1550950019.948370000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-7dda4bf8cf4d22f8938c79cd", "src_port": 49211, "tcp_stream": 90, "udp_stream": null, "frame_number": 2076, "timestamp_epoch": "1550950019.948506000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-3c1d3f07ffc7bc4f611da324", "src_port": 49212, "tcp_stream": 91, "udp_stream": null, "frame_number": 2078, "timestamp_epoch": "1550950019.948761000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-1c443ea13993137db3403c4d", "src_port": 49209, "tcp_stream": 88, "udp_stream": null, "frame_number": 2080, "timestamp_epoch": "1550950019.948922000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-3ee02490ed5ceaf112e7c452", "src_port": 49207, "tcp_stream": 86, "udp_stream": null, "frame_number": 2082, "timestamp_epoch": "1550950019.949113000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.64.238", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static.squarespace.com" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-c1dc52fd27456aa68e9106ad", "src_port": 49213, "tcp_stream": 92, "udp_stream": null, "frame_number": 2097, "timestamp_epoch": "1550950020.040042000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-f41a29d797438d462fe013c6", "src_port": 49218, "tcp_stream": 96, "udp_stream": null, "frame_number": 2208, "timestamp_epoch": "1550950020.677958000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-ce904d3e9eabaac3d21fcd5f", "src_port": 49217, "tcp_stream": 97, "udp_stream": null, "frame_number": 2381, "timestamp_epoch": "1550950021.703192000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.64.238", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "static.squarespace.com" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-3de06ff6282226722af00858", "src_port": 49214, "tcp_stream": 93, "udp_stream": null, "frame_number": 2441, "timestamp_epoch": "1550950022.110604000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-452d93c3f0338af486bf5f32", "src_port": 49220, "tcp_stream": 99, "udp_stream": null, "frame_number": 2545, "timestamp_epoch": "1550950022.959876000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-0ae3ca926da8f37be161ccc8", "src_port": 49221, "tcp_stream": 101, "udp_stream": null, "frame_number": 2551, "timestamp_epoch": "1550950022.978231000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-d484fc36cc004962b26d0a42", "src_port": 49222, "tcp_stream": 100, "udp_stream": null, "frame_number": 2552, "timestamp_epoch": "1550950022.978311000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-7fb319f7f02002292a31dde9", "src_port": 49219, "tcp_stream": 98, "udp_stream": null, "frame_number": 2664, "timestamp_epoch": "1550950023.985041000" }, { "kind": "tls_client_hello", "dst_ip": "23.63.25.226", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-2961878c508001f89b551ecd", "src_port": 49223, "tcp_stream": 102, "udp_stream": null, "frame_number": 2709, "timestamp_epoch": "1550950024.296158000" }, { "kind": "tls_client_hello", "dst_ip": "185.246.116.239", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "cranetisti.com" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-b9857ba8e82b5bb05b81707a", "src_port": 49197, "tcp_stream": 107, "udp_stream": null, "frame_number": 6159, "timestamp_epoch": "1550950403.574744000" }, { "kind": "tls_client_hello", "dst_ip": "185.246.116.239", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "cranetisti.com" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-28f54f236f9a4e764fba3e08", "src_port": 49203, "tcp_stream": 113, "udp_stream": null, "frame_number": 6270, "timestamp_epoch": "1550950411.285747000" }, { "kind": "tls_client_hello", "dst_ip": "185.246.116.239", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "cranetisti.com" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-54728da7db26e07471f166b6", "src_port": 49206, "tcp_stream": 115, "udp_stream": null, "frame_number": 6272, "timestamp_epoch": "1550950411.286900000" }, { "kind": "tls_client_hello", "dst_ip": "185.246.116.239", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "cranetisti.com" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-a25379be602c8340e5a55b13", "src_port": 49204, "tcp_stream": 114, "udp_stream": null, "frame_number": 6274, "timestamp_epoch": "1550950411.287923000" }, { "kind": "tls_client_hello", "dst_ip": "185.246.116.239", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "cranetisti.com" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-040e4618939a5cc3a5315e22", "src_port": 49205, "tcp_stream": 116, "udp_stream": null, "frame_number": 6319, "timestamp_epoch": "1550950412.293531000" }, { "kind": "tls_client_hello", "dst_ip": "185.246.116.239", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "cranetisti.com" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-6046d300a2e8462537351572", "src_port": 49201, "tcp_stream": 111, "udp_stream": null, "frame_number": 6321, "timestamp_epoch": "1550950412.293907000" }, { "kind": "tls_client_hello", "dst_ip": "185.246.116.239", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "cranetisti.com" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-c3b6c76c0bf9af21da3f9f4f", "src_port": 49202, "tcp_stream": 112, "udp_stream": null, "frame_number": 6325, "timestamp_epoch": "1550950412.305579000" }, { "kind": "tls_client_hello", "dst_ip": "87.236.22.142", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "superhaps.pw" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-4ebba49371fc9beb73db2322", "src_port": 49216, "tcp_stream": 126, "udp_stream": null, "frame_number": 10375, "timestamp_epoch": "1550950710.265164000" }, { "kind": "tls_client_hello", "dst_ip": "87.236.22.142", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "superhaps.pw" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-b4e4e29d2b899d245e95b2a6", "src_port": 49265, "tcp_stream": 152, "udp_stream": null, "frame_number": 10992, "timestamp_epoch": "1550950712.340467000" }, { "kind": "tls_client_hello", "dst_ip": "87.236.22.142", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "superhaps.pw" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-5052a1b68b28c6f2f6fff75d", "src_port": 49264, "tcp_stream": 153, "udp_stream": null, "frame_number": 11017, "timestamp_epoch": "1550950713.344469000" }, { "kind": "tls_client_hello", "dst_ip": "87.236.22.142", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "superhaps.pw" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-e774045f00bae3f49788aa2b", "src_port": 49266, "tcp_stream": 154, "udp_stream": null, "frame_number": 11019, "timestamp_epoch": "1550950713.344870000" }, { "kind": "tls_client_hello", "dst_ip": "213.226.68.112", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-072e8c4c798ab6f40b10b11a", "src_port": 49550, "tcp_stream": 192, "udp_stream": null, "frame_number": 19095, "timestamp_epoch": "1550950914.026542000" }, { "kind": "tls_client_hello", "dst_ip": "216.239.32.21", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "ipecho.net" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-9a2b08e4a1822e0c1ea5df7c", "src_port": 49555, "tcp_stream": 197, "udp_stream": null, "frame_number": 19926, "timestamp_epoch": "1550950933.352228000" }, { "kind": "tls_client_hello", "dst_ip": "195.123.246.99", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.2.23.231", "dst_port": 447, "event_id": "evt-07f0768dca42c29c7937ff75", "src_port": 49556, "tcp_stream": 198, "udp_stream": null, "frame_number": 19961, "timestamp_epoch": "1550950935.540528000" }, { "kind": "tls_client_hello", "dst_ip": "87.236.22.142", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "superhaps.pw" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-1bd265eeef9baf29db1ceb33", "src_port": 49559, "tcp_stream": 201, "udp_stream": null, "frame_number": 21130, "timestamp_epoch": "1550951012.339404000" }, { "kind": "tls_client_hello", "dst_ip": "213.226.68.112", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-11aa38d89575ec8f7c25a646", "src_port": 49560, "tcp_stream": 202, "udp_stream": null, "frame_number": 21841, "timestamp_epoch": "1550951099.148760000" }, { "kind": "tls_client_hello", "dst_ip": "213.226.68.112", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-a158fdd0d42cf732c898893b", "src_port": 49562, "tcp_stream": 204, "udp_stream": null, "frame_number": 23651, "timestamp_epoch": "1550951299.251853000" }, { "kind": "tls_client_hello", "dst_ip": "213.226.68.112", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-b59d37086a80173eca5a4020", "src_port": 49563, "tcp_stream": 205, "udp_stream": null, "frame_number": 23667, "timestamp_epoch": "1550951301.629976000" }, { "kind": "tls_client_hello", "dst_ip": "87.236.22.142", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "superhaps.pw" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-279a38d25c67bbc593d15db7", "src_port": 49564, "tcp_stream": 206, "udp_stream": null, "frame_number": 23730, "timestamp_epoch": "1550951314.626672000" }, { "kind": "tls_client_hello", "dst_ip": "195.123.246.99", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.2.23.231", "dst_port": 447, "event_id": "evt-3bfdc3f92ada6118c1857165", "src_port": 49567, "tcp_stream": 209, "udp_stream": null, "frame_number": 23864, "timestamp_epoch": "1550951379.114063000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.googletagmanager.com" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-04567c16eb381a920175b6cc", "src_port": 49238, "tcp_stream": 221, "udp_stream": null, "frame_number": 24769, "timestamp_epoch": "1550951427.112102000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.googletagmanager.com" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-e414854964158f246f3209d1", "src_port": 49239, "tcp_stream": 222, "udp_stream": null, "frame_number": 24771, "timestamp_epoch": "1550951427.112412000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-554cb9873c75a2d688b8147e", "src_port": 49251, "tcp_stream": 240, "udp_stream": null, "frame_number": 27607, "timestamp_epoch": "1550951456.564916000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "10.2.23.109", "dst_port": 443, "event_id": "evt-fada303d37dc25a7a45bb1b4", "src_port": 49252, "tcp_stream": 239, "udp_stream": null, "frame_number": 27609, "timestamp_epoch": "1550951456.565048000" }, { "kind": "tls_client_hello", "dst_ip": "87.236.22.142", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "superhaps.pw" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-140b618bd72afd4c48b06924", "src_port": 49578, "tcp_stream": 241, "udp_stream": null, "frame_number": 28298, "timestamp_epoch": "1550951616.116842000" }, { "kind": "tls_client_hello", "dst_ip": "213.226.68.112", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-3e40c31538ddcba95327f01e", "src_port": 49580, "tcp_stream": 244, "udp_stream": null, "frame_number": 28371, "timestamp_epoch": "1550951733.552861000" }, { "kind": "tls_client_hello", "dst_ip": "87.236.22.142", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "superhaps.pw" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-bb9b67e4d55fb932cda89797", "src_port": 49581, "tcp_stream": 245, "udp_stream": null, "frame_number": 28428, "timestamp_epoch": "1550951919.190239000" }, { "kind": "tls_client_hello", "dst_ip": "213.226.68.112", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-1ca27e176834101e3cfc3266", "src_port": 49582, "tcp_stream": 246, "udp_stream": null, "frame_number": 28446, "timestamp_epoch": "1550951936.050671000" }, { "kind": "tls_client_hello", "dst_ip": "213.226.68.112", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-d79ec31cb86adc0df731d755", "src_port": 49583, "tcp_stream": 247, "udp_stream": null, "frame_number": 28504, "timestamp_epoch": "1550952138.813188000" }, { "kind": "tls_client_hello", "dst_ip": "87.236.22.142", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "superhaps.pw" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-fcbaeb90912d0def9ea76350", "src_port": 49584, "tcp_stream": 248, "udp_stream": null, "frame_number": 28538, "timestamp_epoch": "1550952224.317550000" }, { "kind": "tls_client_hello", "dst_ip": "213.226.68.112", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-c762bac9eba8135632456a13", "src_port": 49585, "tcp_stream": 249, "udp_stream": null, "frame_number": 28573, "timestamp_epoch": "1550952341.405205000" }, { "kind": "tls_client_hello", "dst_ip": "87.236.22.142", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "superhaps.pw" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-09edd8fc98bea82e00da059c", "src_port": 49586, "tcp_stream": 250, "udp_stream": null, "frame_number": 28852, "timestamp_epoch": "1550952526.737606000" }, { "kind": "tls_client_hello", "dst_ip": "213.226.68.112", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.2.23.231", "dst_port": 443, "event_id": "evt-7cf3fe487bfa5c8318cfc500", "src_port": 49587, "tcp_stream": 251, "udp_stream": null, "frame_number": 28876, "timestamp_epoch": "1550952581.016068000" } ], "unclassified_tcp": [ { "kind": "unclassified_tcp", "dst_ip": "10.2.23.109", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49168, "event_id": "evt-33edf3ffe97f5c44d6297e21", "src_port": 445, "tcp_stream": 34, "udp_stream": null, "frame_number": 3796, "timestamp_epoch": "1550950051.020538000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49171, "event_id": "evt-5c14f1d4697e61233e5f5b49", "src_port": 445, "tcp_stream": 14, "udp_stream": null, "frame_number": 5402, "timestamp_epoch": "1550950129.690963000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.109", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49168, "event_id": "evt-6ca135f22e576a31c73cd9df", "src_port": 445, "tcp_stream": 34, "udp_stream": null, "frame_number": 6125, "timestamp_epoch": "1550950171.030832000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49171, "event_id": "evt-f381cf4fac94d4aa723b1cea", "src_port": 445, "tcp_stream": 14, "udp_stream": null, "frame_number": 6130, "timestamp_epoch": "1550950249.702615000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.109", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49168, "event_id": "evt-c7c931c0f9e73262949ce6ca", "src_port": 445, "tcp_stream": 34, "udp_stream": null, "frame_number": 6135, "timestamp_epoch": "1550950291.042856000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49171, "event_id": "evt-e6cb52a14925a7775b1d4948", "src_port": 445, "tcp_stream": 14, "udp_stream": null, "frame_number": 6140, "timestamp_epoch": "1550950369.712937000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.109", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49168, "event_id": "evt-4fa7a6d0f7f2768811dd9ddf", "src_port": 445, "tcp_stream": 34, "udp_stream": null, "frame_number": 6258, "timestamp_epoch": "1550950411.053598000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49171, "event_id": "evt-3ee664bbf4ace0d2dcf7ed85", "src_port": 445, "tcp_stream": 14, "udp_stream": null, "frame_number": 7784, "timestamp_epoch": "1550950489.724124000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.109", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49168, "event_id": "evt-554a06092373be7c318cea4d", "src_port": 445, "tcp_stream": 34, "udp_stream": null, "frame_number": 8256, "timestamp_epoch": "1550950531.064401000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49171, "event_id": "evt-1af501ae54853040ddeffd0d", "src_port": 445, "tcp_stream": 14, "udp_stream": null, "frame_number": 9128, "timestamp_epoch": "1550950609.735758000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.109", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49168, "event_id": "evt-f0532a98c7e33a3ffcb050bd", "src_port": 445, "tcp_stream": 34, "udp_stream": null, "frame_number": 9674, "timestamp_epoch": "1550950651.075025000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49171, "event_id": "evt-7cdd01bfbb8eaa9e90cbde60", "src_port": 445, "tcp_stream": 14, "udp_stream": null, "frame_number": 11484, "timestamp_epoch": "1550950729.745325000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.109", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49168, "event_id": "evt-bc30fd13545451c592ee5a4b", "src_port": 445, "tcp_stream": 34, "udp_stream": null, "frame_number": 12826, "timestamp_epoch": "1550950771.085919000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49171, "event_id": "evt-a4002c69afa8d22e817dd5b4", "src_port": 445, "tcp_stream": 14, "udp_stream": null, "frame_number": 16167, "timestamp_epoch": "1550950849.740760000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49561, "event_id": "evt-8a8b08a0d8c61d3aab534ce3", "src_port": 445, "tcp_stream": 203, "udp_stream": null, "frame_number": 23840, "timestamp_epoch": "1550951371.733400000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49561, "event_id": "evt-841795e6555a3f384e431608", "src_port": 445, "tcp_stream": 203, "udp_stream": null, "frame_number": 28241, "timestamp_epoch": "1550951491.744947000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49561, "event_id": "evt-a2e211e4fbbce1e36fd0c9c4", "src_port": 445, "tcp_stream": 203, "udp_stream": null, "frame_number": 28293, "timestamp_epoch": "1550951611.756218000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49561, "event_id": "evt-ebf4e591e171a49c945e97bf", "src_port": 445, "tcp_stream": 203, "udp_stream": null, "frame_number": 28366, "timestamp_epoch": "1550951731.767184000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49561, "event_id": "evt-38737c774c7a57f6380cb784", "src_port": 445, "tcp_stream": 203, "udp_stream": null, "frame_number": 28413, "timestamp_epoch": "1550951851.778280000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49561, "event_id": "evt-645d94a844c8fd79553ed969", "src_port": 445, "tcp_stream": 203, "udp_stream": null, "frame_number": 28465, "timestamp_epoch": "1550951971.789524000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49561, "event_id": "evt-321af03ddc5f9c7b7e72274d", "src_port": 445, "tcp_stream": 203, "udp_stream": null, "frame_number": 28493, "timestamp_epoch": "1550952091.783958000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49561, "event_id": "evt-0f0bf496148407aa60a038b9", "src_port": 445, "tcp_stream": 203, "udp_stream": null, "frame_number": 28533, "timestamp_epoch": "1550952211.794957000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49561, "event_id": "evt-f2578bf48d5614388d8a43a5", "src_port": 445, "tcp_stream": 203, "udp_stream": null, "frame_number": 28567, "timestamp_epoch": "1550952331.806305000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49561, "event_id": "evt-bb1dfed02fbc447a3a9fd73b", "src_port": 445, "tcp_stream": 203, "udp_stream": null, "frame_number": 28836, "timestamp_epoch": "1550952451.816967000" }, { "kind": "unclassified_tcp", "dst_ip": "10.2.23.231", "fields": { "tcp.payload": "00" }, "src_ip": "10.2.23.2", "dst_port": 49561, "event_id": "evt-3acb867f3343c19978070b0d", "src_port": 445, "tcp_stream": 203, "udp_stream": null, "frame_number": 28871, "timestamp_epoch": "1550952571.828501000" } ], "directory_service": [ { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-bfb9b26f78f610c663703ad7", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 17, "timestamp_epoch": "1550949876.658499000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d2b61640f3c8b6d8246b23bd", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 19, "timestamp_epoch": "1550949876.658946000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-278f1570c15867137cc0d889", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 52, "timestamp_epoch": "1550949876.702314000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0015cabb65a6163feea19447", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 54, "timestamp_epoch": "1550949876.702943000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-61200903318760a3c58ea3ce", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 55, "timestamp_epoch": "1550949876.704189000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c808c399e01934efac2bf19b", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 129, "timestamp_epoch": "1550949877.428527000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5b4308575a6201d5c0bb621b", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 130, "timestamp_epoch": "1550949877.428756000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-149bf912b57aeb7a0ae643df", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 131, "timestamp_epoch": "1550949877.432273000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ff1c7e163de276735b2087f2", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 132, "timestamp_epoch": "1550949877.433257000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6b93376279fd32565b06c40f", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 133, "timestamp_epoch": "1550949877.434941000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6105ddbd7936fade83643950", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 134, "timestamp_epoch": "1550949877.435272000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-706ac0918feea8d515d4e878", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 135, "timestamp_epoch": "1550949877.436366000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b4e66396ba218bf4dc078cda", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 136, "timestamp_epoch": "1550949877.436552000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3e3b6c9fe6ba4badc9d98168", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 144, "timestamp_epoch": "1550949877.469989000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2acdaf9f335e85bef89996c5", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 146, "timestamp_epoch": "1550949877.470590000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e2b2d73a94203dcf35817ecf", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 161, "timestamp_epoch": "1550949877.474293000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0349daa5e0fbce9a55c28aab", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 163, "timestamp_epoch": "1550949877.474857000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-63e990d94aae83ff1f4554f0", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 164, "timestamp_epoch": "1550949877.478675000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-37558b83a3656ac89143a58f", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 165, "timestamp_epoch": "1550949877.479032000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-674150651813621583fdf7b7", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 170, "timestamp_epoch": "1550949877.485116000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e0180027f427c947674adbb7", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 172, "timestamp_epoch": "1550949877.486118000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d6b5a1e02117315d6ab18547", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 173, "timestamp_epoch": "1550949877.486566000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f42103d35e4fb52eaa6331b8", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 174, "timestamp_epoch": "1550949877.486817000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d565985949514e6d8efafc1d", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 175, "timestamp_epoch": "1550949877.487027000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-637b4d6b101de8b69c3ea854", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 176, "timestamp_epoch": "1550949877.487724000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-22c45561c02c8512ba38e332", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 177, "timestamp_epoch": "1550949877.488245000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-17a0f7967d5b002bdbf54065", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 178, "timestamp_epoch": "1550949877.489417000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c5d73b45e6be45b6f2dcdeac", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 263, "timestamp_epoch": "1550949877.580211000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-06d5c808789c5fe672bb94a2", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 282, "timestamp_epoch": "1550949878.111695000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-126a6f8925de46c126d6ba5e", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 418, "timestamp_epoch": "1550949914.818867000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-98963cadf908f255fb90a4a4", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 420, "timestamp_epoch": "1550949914.819176000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-15186e3933fae8dbde67554f", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 453, "timestamp_epoch": "1550949914.848560000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-07cdd6621c25f152cc6e7316", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 455, "timestamp_epoch": "1550949914.849135000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-e8ed918d8a6316e1d80985ee", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 456, "timestamp_epoch": "1550949914.850352000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-5d95c991d0d931cf37215032", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 568, "timestamp_epoch": "1550949919.929342000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-44a51706c852d76715861878", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 569, "timestamp_epoch": "1550949919.929563000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-54c10a2d93d9285ce104bb87", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 570, "timestamp_epoch": "1550949919.930809000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d6258b5402d8cf2ede8ad595", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 571, "timestamp_epoch": "1550949919.931538000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-507a8733ca940c8f613a92d2", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 572, "timestamp_epoch": "1550949919.931744000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c408117e9e1c42c6b7c8a6e0", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 573, "timestamp_epoch": "1550949919.932163000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-a1b0ed6b32898e43d78f5c7e", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 574, "timestamp_epoch": "1550949919.932540000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1eb85945845c09b732860479", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 575, "timestamp_epoch": "1550949919.932720000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-427c277b7ac441f64e5bc23d", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 626, "timestamp_epoch": "1550949920.122582000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b2bdf8ad0698781cd52b8c05", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 628, "timestamp_epoch": "1550949920.122786000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-56b65a0e49e1b79ea1fb77e6", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 643, "timestamp_epoch": "1550949920.127670000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fd50e6ef624e6a9651858cba", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 645, "timestamp_epoch": "1550949920.128325000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-83d9b23ba5ecce3606bf27cc", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 646, "timestamp_epoch": "1550949920.133553000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3f76b0bb62ad40b52f2cb728", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 647, "timestamp_epoch": "1550949920.133955000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-9da6c5870d869f90c17c17cb", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 653, "timestamp_epoch": "1550949920.137467000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-bddb4efdc27facd52d3263e1", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 655, "timestamp_epoch": "1550949920.138197000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-51ae3c292061675d6d1add1e", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 656, "timestamp_epoch": "1550949920.138681000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-00d4a873b49afebdfccf047e", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 657, "timestamp_epoch": "1550949920.138838000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-abd002212c4306cdfa189866", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 658, "timestamp_epoch": "1550949920.139018000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9eda9366ca55df435b20f6e4", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 659, "timestamp_epoch": "1550949920.139207000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-4255a4d1eb09465fa3ad00d7", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 660, "timestamp_epoch": "1550949920.139434000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6c7e1d4342ea367885db0242", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 661, "timestamp_epoch": "1550949920.140177000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-1aa7ccad9410456cb301ee60", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 707, "timestamp_epoch": "1550949920.167200000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-0d29493d6533d4e987de308c", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 716, "timestamp_epoch": "1550949920.625923000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9b713fc776799857d5ed337f", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 857, "timestamp_epoch": "1550949937.320392000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3d23600417fe7ec81c8de363", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 858, "timestamp_epoch": "1550949937.320607000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c6470e6fcb6b357be3c44330", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 859, "timestamp_epoch": "1550949937.320801000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7729a37f77e9dcdd41c57d0a", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 860, "timestamp_epoch": "1550949937.321515000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6cf75869a9057aa3dc735920", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 861, "timestamp_epoch": "1550949937.321703000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ed40eefdaad5a8d0760a7ac0", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 862, "timestamp_epoch": "1550949937.321994000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d7bff38acbea7dd165ed59b5", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 863, "timestamp_epoch": "1550949937.322185000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-de618bbf4ecdc20028f6f6e8", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 864, "timestamp_epoch": "1550949937.322372000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3db0cfafb0913fe10e317963", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 875, "timestamp_epoch": "1550949937.846826000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-da1928557c8ed83fc0fa5350", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 877, "timestamp_epoch": "1550949937.847436000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2b2f70f4c213f63d87238fef", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 890, "timestamp_epoch": "1550949937.864696000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7df5dbf334ae76abf2ad6e19", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 891, "timestamp_epoch": "1550949937.865260000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-520c7ac90f8d8ddc3fa8fea3", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 897, "timestamp_epoch": "1550949937.869770000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3e64c846a13525a7d4324aab", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 900, "timestamp_epoch": "1550949937.870555000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6115cf5ab0eea7705d8006e3", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 902, "timestamp_epoch": "1550949937.871074000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-adbda53fde9521631ae846c8", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 903, "timestamp_epoch": "1550949937.871310000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-16ef79825943edcdedf65ac2", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 907, "timestamp_epoch": "1550949937.871658000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ef4a630d1a0e951d46d0082e", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 908, "timestamp_epoch": "1550949937.871990000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fccabd7af7cdca4d4e2e20b1", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 909, "timestamp_epoch": "1550949937.872306000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-95ac7f7fce38055207144035", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 926, "timestamp_epoch": "1550949937.889646000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6ddfef271137e6dc3be3e43f", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 969, "timestamp_epoch": "1550949937.901822000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7d38a7ea3322ff5c3d03fe9f", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 973, "timestamp_epoch": "1550949938.417995000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-30561eac5785b464dbf58686", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 1060, "timestamp_epoch": "1550949975.154174000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6bbdb0b2da48686b8a0da556", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 1061, "timestamp_epoch": "1550949975.154369000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-ceb9b2e3c19f50f3cf4c487e", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 1062, "timestamp_epoch": "1550949975.154662000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-bb633c336c5efe72db194c03", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 1063, "timestamp_epoch": "1550949975.155379000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-b51c08a179e0ee5aa5051f9d", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 1064, "timestamp_epoch": "1550949975.155671000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3e58212d497afbbfd4fbb976", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 1065, "timestamp_epoch": "1550949975.156003000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-a19f10b0da8a10b574cc4edc", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 1066, "timestamp_epoch": "1550949975.156274000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d43d9397115b0254aa3573ac", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 1067, "timestamp_epoch": "1550949975.156416000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-dd16d037850cd6534f5a6264", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1074, "timestamp_epoch": "1550949975.677202000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2ab7ccd3ac78d5df50eb773b", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1076, "timestamp_epoch": "1550949975.677926000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-d4d6f78f389ce3d9b16e9d30", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1089, "timestamp_epoch": "1550949975.685552000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b4a16b5d12234662c8b68a2d", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1095, "timestamp_epoch": "1550949975.685966000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-7fb71862ffeaacaa98bb52e7", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 1117, "timestamp_epoch": "1550949975.690069000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6b9e8d6f9199c63eb699b25a", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 1119, "timestamp_epoch": "1550949975.690548000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-db8d79f35ff3983aa2b91885", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 1120, "timestamp_epoch": "1550949975.690954000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-86087416919b8c6e53902df8", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 1121, "timestamp_epoch": "1550949975.691166000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-e6b4af64f3c002f25cca269a", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 1122, "timestamp_epoch": "1550949975.691364000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c92b770811f09aa443552822", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 1123, "timestamp_epoch": "1550949975.691554000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-7af2bbfac10591a0a136ce72", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1124, "timestamp_epoch": "1550949975.691772000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9684fa013c8dc588d221778e", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1125, "timestamp_epoch": "1550949975.692337000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-654997b09b68c782c523477c", "src_port": null, "tcp_stream": 68, "udp_stream": null, "frame_number": 1168, "timestamp_epoch": "1550949975.701414000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-f2bfc803aa09731b4c5db678", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1172, "timestamp_epoch": "1550949976.220041000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9a2b6f41405061a655f25086", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10400, "timestamp_epoch": "1550950710.954530000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ac7beb7226189ed197a3df6b", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10402, "timestamp_epoch": "1550950710.955268000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-72306bcae33e13aa9df1d90b", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10405, "timestamp_epoch": "1550950710.960943000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-500faed84f74fd607a3ebf45", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10407, "timestamp_epoch": "1550950710.961636000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8c86afb93a7b47c0915e33b4", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10408, "timestamp_epoch": "1550950710.978235000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-26906f6c31e81e7f2e9de200", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10409, "timestamp_epoch": "1550950710.978601000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-60b01cdebe9b9a01fd10b6fa", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10410, "timestamp_epoch": "1550950710.979760000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0e0a4033901b8366085eef82", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10411, "timestamp_epoch": "1550950710.981161000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e269e2e7dc9375415f19935d", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10412, "timestamp_epoch": "1550950710.981504000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-183e9f65b866c8f563aea0b0", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10413, "timestamp_epoch": "1550950710.981731000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0277552aeff988ed62752821", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10414, "timestamp_epoch": "1550950710.982082000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-dabe7783ba24b21e1968a5ee", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10614, "timestamp_epoch": "1550950711.006673000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "3", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9320484348705010fab1b9ed", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10619, "timestamp_epoch": "1550950711.059166000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-896d2339c3e76cfd019a2216", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 10620, "timestamp_epoch": "1550950711.059677000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-946feee574ba32f5b584dc53", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 11101, "timestamp_epoch": "1550950716.106342000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5297279b4f441c81cd9347a0", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11266, "timestamp_epoch": "1550950724.594943000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-37e19dc9d99fb4727ce3bee5", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11268, "timestamp_epoch": "1550950724.595381000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-70396fac414c3d9d047ed779", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11283, "timestamp_epoch": "1550950724.599570000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b06a74a254a2112b3e1b63b7", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11285, "timestamp_epoch": "1550950724.600058000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d382bb624265cfa882fccd87", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11286, "timestamp_epoch": "1550950724.600293000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ad0cebaa07416d09173ecb26", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11287, "timestamp_epoch": "1550950724.600424000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f9a7f871090a420c487372c0", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11288, "timestamp_epoch": "1550950724.600604000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4286141efcecec4cad07ac69", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11289, "timestamp_epoch": "1550950724.600974000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-597502a8f07ce55589a4b652", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11299, "timestamp_epoch": "1550950724.704722000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3bdfc7d0d11ae8dd9823857d", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11301, "timestamp_epoch": "1550950724.705226000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2e994a897bfcd21af8629527", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11310, "timestamp_epoch": "1550950724.813345000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7d824d8493af7619523f3f94", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11313, "timestamp_epoch": "1550950724.814012000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7e92a6dd6f0a1f146fcb5dd9", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11318, "timestamp_epoch": "1550950724.815360000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-377d9c5be7704f51f4891baf", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11321, "timestamp_epoch": "1550950724.816014000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3ddc3cd94aebd828fd6e86e9", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11327, "timestamp_epoch": "1550950724.817949000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c958d74be4437f85946c2bda", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11329, "timestamp_epoch": "1550950724.818223000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0838250b597702894cd34da9", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11330, "timestamp_epoch": "1550950724.818459000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ea78f68464eb48bcb5a45221", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11331, "timestamp_epoch": "1550950724.818985000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7e8f59711b4a15dbd3e98b6b", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 11332, "timestamp_epoch": "1550950724.819211000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-c299bb92042d9d1c1f58ad89", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12420, "timestamp_epoch": "1550950760.044160000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3e428d40614f688a5dd536d6", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12422, "timestamp_epoch": "1550950760.044579000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-a87bfe3b2f338b2356413b5a", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12437, "timestamp_epoch": "1550950760.048703000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-102d266008d4bbd71581f0dc", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12439, "timestamp_epoch": "1550950760.049410000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-cbfc1ff38e5f68972adbdacd", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12440, "timestamp_epoch": "1550950760.049659000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f17af71f250b799592220e50", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12441, "timestamp_epoch": "1550950760.049845000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-cf73c1ba5a07e6c92345a200", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12442, "timestamp_epoch": "1550950760.050069000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f7ade706e29b35660f18c365", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12443, "timestamp_epoch": "1550950760.050522000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-201ef2d53c7879da609a7f88", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12453, "timestamp_epoch": "1550950760.158780000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-de6b384e90b224f873e7ee22", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12456, "timestamp_epoch": "1550950760.159406000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-751a61ef79030025e59dd8ce", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12472, "timestamp_epoch": "1550950760.261011000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-07336d132e9a9698ae692a50", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12474, "timestamp_epoch": "1550950760.261644000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-1e8fa3b7f160ae656e359046", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12479, "timestamp_epoch": "1550950760.267689000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-22e42be6edbd1843e861a4d7", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12482, "timestamp_epoch": "1550950760.268298000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-a564615dd4b3b9176bb931db", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12488, "timestamp_epoch": "1550950760.271459000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b2270830809dfc551bcead8d", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12490, "timestamp_epoch": "1550950760.271844000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-0c24d9a4f861125bdba6311d", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12491, "timestamp_epoch": "1550950760.272678000" }, { "kind": "directory_service", "dst_ip": "10.2.23.109", "fields": {}, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1db88f524d02dfef5910710f", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12492, "timestamp_epoch": "1550950760.273198000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": {}, "src_ip": "10.2.23.109", "dst_port": null, "event_id": "evt-aa7bfd3edea7d79986995507", "src_port": null, "tcp_stream": 162, "udp_stream": null, "frame_number": 12493, "timestamp_epoch": "1550950760.273451000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fa4bf16b5d81db94efb3c5a2", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24020, "timestamp_epoch": "1550951414.633128000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-baec2b62b03f8941bc92c6aa", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24022, "timestamp_epoch": "1550951414.633666000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2fcd8830dc2d71d14ef736da", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24025, "timestamp_epoch": "1550951414.636529000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a6b4637e3e5f63e21c0796ea", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24027, "timestamp_epoch": "1550951414.637421000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-546590c5a8a2712e829efbc7", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24028, "timestamp_epoch": "1550951414.640672000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-387a934863bad77514ef06ed", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24029, "timestamp_epoch": "1550951414.640914000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f168388cdcbb9f0ce50bbd88", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24030, "timestamp_epoch": "1550951414.645255000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6500ed769f4ea3df2b951000", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24031, "timestamp_epoch": "1550951414.646370000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-208afacaa5a8eb7acb3fa3c3", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24032, "timestamp_epoch": "1550951414.648403000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-00a56a2fc8f34e6e89c1be10", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24033, "timestamp_epoch": "1550951414.648823000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a585fec360ee359c0278a1f3", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24034, "timestamp_epoch": "1550951414.649897000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cc11667ba8ae73ffef32b5c7", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24035, "timestamp_epoch": "1550951414.650088000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5e672fa5cabdc324d38f058e", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24036, "timestamp_epoch": "1550951414.651148000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b1fab1c74338131b465e7d6a", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24037, "timestamp_epoch": "1550951414.651335000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4b848faae839c2a979ee0b4c", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24038, "timestamp_epoch": "1550951414.652294000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-45815bc88ef13e3fc978f446", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24039, "timestamp_epoch": "1550951414.652491000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-451cea5a1355ce86c170842a", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24040, "timestamp_epoch": "1550951414.653403000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0dd357bb2af3098c618e883c", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24041, "timestamp_epoch": "1550951414.653592000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-844cf5260a9009a7654b806e", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24042, "timestamp_epoch": "1550951414.654530000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5f74afe8326fd91a7c5c95e2", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24043, "timestamp_epoch": "1550951414.654757000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6dcc602436c258b07498eb71", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24044, "timestamp_epoch": "1550951414.655745000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0c8245ab656a814ebda8d65c", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24045, "timestamp_epoch": "1550951414.655975000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e38731b793553b13b2f2cba2", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24046, "timestamp_epoch": "1550951414.657102000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f60342e2df980a7e1ced093a", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24047, "timestamp_epoch": "1550951414.657335000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c2066886a870a1508fe63de1", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24048, "timestamp_epoch": "1550951414.658222000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-bc5d973b605c7221e2cdddb8", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24049, "timestamp_epoch": "1550951414.658456000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4df7015741b11f6302416c59", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24050, "timestamp_epoch": "1550951414.659212000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ff61909e9a8dc4ce60b65eff", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24051, "timestamp_epoch": "1550951414.660459000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-407550e19f2acba49e26f57f", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24052, "timestamp_epoch": "1550951414.661931000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ee7e6dd051dac7c3c52c5e94", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24053, "timestamp_epoch": "1550951414.662207000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-63d1a4c99e718804903a3035", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24054, "timestamp_epoch": "1550951414.663580000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4bc0ca83c09289a26bd1d060", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24055, "timestamp_epoch": "1550951414.663911000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-aa844a7cb3a54873ea169dea", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24056, "timestamp_epoch": "1550951414.665089000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b9ced6dff407b696bb747609", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24057, "timestamp_epoch": "1550951414.665348000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b95956d29889ff9b675d37ad", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24058, "timestamp_epoch": "1550951414.666489000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f4b6ef46d1ed2742c6956fad", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24059, "timestamp_epoch": "1550951414.666759000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f29369eb61955b12874fb932", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24060, "timestamp_epoch": "1550951414.668397000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-87886bfabb1d78f2c76a825d", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24061, "timestamp_epoch": "1550951414.668766000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-dc189a1b796292bc467ec298", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24062, "timestamp_epoch": "1550951414.669712000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4b26a593cdf28fb8145bc519", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24063, "timestamp_epoch": "1550951414.669937000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a87189bced26dd453c8335d4", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24064, "timestamp_epoch": "1550951414.670888000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fb138800f6fc651f08f0013d", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24065, "timestamp_epoch": "1550951414.671112000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3bae49fc88a05dece5a38d09", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24066, "timestamp_epoch": "1550951414.672175000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f02bff5986a9c111a252ce92", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24067, "timestamp_epoch": "1550951414.672478000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-dceb28f3f3c96452a3dbf35d", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24068, "timestamp_epoch": "1550951414.673525000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f7fe9363790770d262f5fd07", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24069, "timestamp_epoch": "1550951414.673809000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6eb4b3e3297c31abd893b834", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24070, "timestamp_epoch": "1550951414.674964000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3f383f2b956e710b5ddf3d19", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24071, "timestamp_epoch": "1550951414.678022000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7c2629a3ac90f51992a0e508", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24072, "timestamp_epoch": "1550951414.678998000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-025afa1304e7ca053fd83dc0", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24073, "timestamp_epoch": "1550951414.679378000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e25056d72c70b424a0dfd46f", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24074, "timestamp_epoch": "1550951414.680197000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d679b2d6c174e89e7064f5ef", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24075, "timestamp_epoch": "1550951414.680580000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8ae7a6bd46153dea561741dd", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24076, "timestamp_epoch": "1550951414.681335000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-21b07e54d71f655bb5c12653", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24077, "timestamp_epoch": "1550951414.681689000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-52b7a43a236d9269a61f6eb0", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24078, "timestamp_epoch": "1550951414.682451000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3c8c92b594311fa5f91689ca", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24079, "timestamp_epoch": "1550951414.682842000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-76bcbcb308f8426b6ad8ef9d", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24080, "timestamp_epoch": "1550951414.683999000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fbf7c5c190e0f909ec2be8fa", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24082, "timestamp_epoch": "1550951414.684520000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ff951abd423171b660ec70ee", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24083, "timestamp_epoch": "1550951414.685714000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4e27ae955076322761220449", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24084, "timestamp_epoch": "1550951414.686054000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-40f1ccd101569a27f6ddb34b", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24085, "timestamp_epoch": "1550951414.687108000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-88190d6419b206adc54b9c5d", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24086, "timestamp_epoch": "1550951414.687475000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-caac5fa2261672c5abf314da", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24087, "timestamp_epoch": "1550951414.688623000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2c0b602d4ab49645553bcd31", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24088, "timestamp_epoch": "1550951414.689122000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-413c1fb900a17c960a95caa1", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24089, "timestamp_epoch": "1550951414.691215000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-917bf790278788e96750d3e6", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24090, "timestamp_epoch": "1550951414.691763000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-933d3e6bc43b6ce672759af8", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24091, "timestamp_epoch": "1550951414.693237000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-994c99c02c34c19fe1e7686a", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24092, "timestamp_epoch": "1550951414.693472000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1524feeb2cd11c90eb821955", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24093, "timestamp_epoch": "1550951414.694565000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-feb3a4d81a8fbe608fd7c343", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24094, "timestamp_epoch": "1550951414.694759000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0915b4afa49d625017b5cefe", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24095, "timestamp_epoch": "1550951414.695779000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cb6c39a6de0117ce7da1c435", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24096, "timestamp_epoch": "1550951414.695963000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-54f42a04471bede9f9d4fb12", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24097, "timestamp_epoch": "1550951414.696903000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-658386399efcb492ab413657", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24098, "timestamp_epoch": "1550951414.697062000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-562aebdb84df17aa16a4badd", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24099, "timestamp_epoch": "1550951414.698186000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-64e6b40220aef333f7162ccd", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24100, "timestamp_epoch": "1550951414.698389000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c5d30534f1302e16c63e577f", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24101, "timestamp_epoch": "1550951414.699267000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f379781110f2e73638e1880f", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24102, "timestamp_epoch": "1550951414.699452000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-32e8d3d3cc0d4a5ce11886a3", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24103, "timestamp_epoch": "1550951414.700262000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ec7fb72ad6fe0d400f5733f2", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24104, "timestamp_epoch": "1550951414.700421000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d97f2be48f0cd60d79bcf975", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24105, "timestamp_epoch": "1550951414.701311000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-def427edf32c7ccb21877f6c", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24106, "timestamp_epoch": "1550951414.701469000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9c11f4a58c7f50862d219ebd", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24107, "timestamp_epoch": "1550951414.702448000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a9226fd6a2d83073f5284134", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24108, "timestamp_epoch": "1550951414.702597000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-27f496a923b18655b6dd26c0", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24109, "timestamp_epoch": "1550951414.703473000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-40d9f229079ebae16ed20c0a", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24110, "timestamp_epoch": "1550951414.703618000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d46b1ce5d45fb6d70427fadc", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24111, "timestamp_epoch": "1550951414.704398000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-45c2b6814554f51ac0ee3427", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24112, "timestamp_epoch": "1550951414.705153000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5f79acbdded66c555ddfce15", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24113, "timestamp_epoch": "1550951414.705955000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c880b05a1be66c4ad0401dd9", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24114, "timestamp_epoch": "1550951414.706132000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c82bcb7b5ff5be3bc39195be", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24115, "timestamp_epoch": "1550951414.706992000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-eadc1829c9ea9cad2af6e5ee", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24116, "timestamp_epoch": "1550951414.707168000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e3ddba43d8e746574991eebb", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24117, "timestamp_epoch": "1550951414.708061000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-60a4495157fa6a753eaf7919", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24118, "timestamp_epoch": "1550951414.708263000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9c7aa5dc5c41e44ce06b0b40", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24119, "timestamp_epoch": "1550951414.709133000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a28f227b16f63e184a0a1bc6", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24120, "timestamp_epoch": "1550951414.709352000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1539afb9d72b0cb7badf76ff", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24121, "timestamp_epoch": "1550951414.710403000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-62560d2e5a5a29ea88685065", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24122, "timestamp_epoch": "1550951414.710591000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8f27b9d2a4801037d311bdff", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24123, "timestamp_epoch": "1550951414.711483000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-14755bd5b811b03fc9b967a1", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24124, "timestamp_epoch": "1550951414.711662000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ff291826062b90c94d6a0844", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24125, "timestamp_epoch": "1550951414.712454000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e7564a90f92de11358e65703", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24126, "timestamp_epoch": "1550951414.712609000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f17ee2e395ec58738f563e08", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24127, "timestamp_epoch": "1550951414.713497000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6a89140a4d6eaa64e69e06da", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24128, "timestamp_epoch": "1550951414.713680000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fe78d6665ea3772bbe660710", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24129, "timestamp_epoch": "1550951414.714528000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5f0306a92b9632bc35adbebd", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24130, "timestamp_epoch": "1550951414.714731000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7174be059773c6fa57af49e3", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24131, "timestamp_epoch": "1550951414.714909000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-98ff72cf3323ae27953dcaa9", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24132, "timestamp_epoch": "1550951414.715124000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-830aef0ea3d84d38c84b027b", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24133, "timestamp_epoch": "1550951414.715319000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-525c1cea65827c160d45332a", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24134, "timestamp_epoch": "1550951414.715473000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8fcb8f6562715b228b6607a7", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24142, "timestamp_epoch": "1550951414.751756000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-67335babb7744527957545f8", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24144, "timestamp_epoch": "1550951414.751946000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7a2dcb3a2856a0effbbcc448", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24147, "timestamp_epoch": "1550951414.752929000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2483f1c4cd1eb6893fd1f1f9", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24149, "timestamp_epoch": "1550951414.753529000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2715ec0245bc65ac80f9b021", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24150, "timestamp_epoch": "1550951414.753869000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ecc5fcc9410769cc755dde72", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24151, "timestamp_epoch": "1550951414.754024000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6828dd727936410ad40cf2ba", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24152, "timestamp_epoch": "1550951414.754192000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f1de291631d9d69df382ae80", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24153, "timestamp_epoch": "1550951414.754367000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-89d354eebb65ae061e1cde29", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24154, "timestamp_epoch": "1550951414.754576000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cd0dda325cd8de9f82a78ae4", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24155, "timestamp_epoch": "1550951414.754705000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ed5d9c7832fe8d3f696a0cea", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24156, "timestamp_epoch": "1550951414.754878000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-107c13acb08129e36f3a0d99", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24158, "timestamp_epoch": "1550951414.756088000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-329b4f9e6cabe9dd0fe60c97", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24160, "timestamp_epoch": "1550951414.757907000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9785fe3398e420970ee4fafb", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24161, "timestamp_epoch": "1550951414.758710000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b26e7a392f7d9586da0189ae", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24162, "timestamp_epoch": "1550951414.758932000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e1b4128ab854622f50f14d76", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24163, "timestamp_epoch": "1550951414.759048000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7b88d1ceeb848d6908527e24", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24164, "timestamp_epoch": "1550951414.759217000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6e57f60405fe9ee18649eede", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24165, "timestamp_epoch": "1550951414.759358000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b84ac410fe4a4d20e7a7608b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24166, "timestamp_epoch": "1550951414.759535000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4d991860d2df1958e269b249", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24168, "timestamp_epoch": "1550951414.759892000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6a65788f24d3ec0a23176aa7", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24170, "timestamp_epoch": "1550951414.760316000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e2a0a0763f794adcc077d624", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24171, "timestamp_epoch": "1550951414.760478000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-018f1b28fa9ebe29908330ab", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24172, "timestamp_epoch": "1550951414.760654000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ba3d62f4813510832dc8599a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24173, "timestamp_epoch": "1550951414.760760000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-79b55c587d09663610ebdc1e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24174, "timestamp_epoch": "1550951414.760907000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7b120e5fca2fabbdabf5f1de", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24175, "timestamp_epoch": "1550951414.761036000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7be44ee6225de7befdc0ba8b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24176, "timestamp_epoch": "1550951414.761208000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f9c1b219299fd45277b000c3", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24178, "timestamp_epoch": "1550951414.761542000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5c0b7efcee781a543e2213f3", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24180, "timestamp_epoch": "1550951414.761932000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ab3ad3e558f253bfd66a91ac", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24181, "timestamp_epoch": "1550951414.762098000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9439743705171367653490a9", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24182, "timestamp_epoch": "1550951414.762273000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-8eb26965fabc7033ee40e454", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24183, "timestamp_epoch": "1550951414.762402000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7028805fa27cd2a35f915a36", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24184, "timestamp_epoch": "1550951414.762571000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cf53004e349b9724dc5ee83c", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24185, "timestamp_epoch": "1550951414.762716000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-731c0ae887a25108cf24390f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24186, "timestamp_epoch": "1550951414.762889000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-361d1b4fc4afed4183fcd938", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24188, "timestamp_epoch": "1550951414.763197000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-59722899e626a9936b3bdb9a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24190, "timestamp_epoch": "1550951414.763587000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0fbce1c4da384e72e0a81d46", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24191, "timestamp_epoch": "1550951414.763770000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-bab6578565813ea67162ab43", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24192, "timestamp_epoch": "1550951414.763934000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6d93359d6472fbdd928d9545", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24193, "timestamp_epoch": "1550951414.764045000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-23edc8a04c36c151f6b44d8a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24194, "timestamp_epoch": "1550951414.764360000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-47f9509ca567ac1f3e301583", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24195, "timestamp_epoch": "1550951414.764502000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5564051da4cb944157adc6e8", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24196, "timestamp_epoch": "1550951414.764707000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a73f05dfb19797e1b450f0a6", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24198, "timestamp_epoch": "1550951414.765045000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ded09f5ede77ac3e1f58e65a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24200, "timestamp_epoch": "1550951414.765572000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-27a19ed0795ae57d4d91710f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24201, "timestamp_epoch": "1550951414.765746000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ea5ffb86420ca78b1c7a5cc0", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24202, "timestamp_epoch": "1550951414.765905000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-8ee7a853e0ec9be7898953fb", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24203, "timestamp_epoch": "1550951414.766028000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6fa29fa1f013e919303becb8", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24204, "timestamp_epoch": "1550951414.766158000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2209ed1da2ea784b3b883195", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24205, "timestamp_epoch": "1550951414.766295000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2a01e72684a1bcaf9c7638fb", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24206, "timestamp_epoch": "1550951414.766451000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-909c615b98749fee9c51066d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24208, "timestamp_epoch": "1550951414.766750000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-78978fa5a3a884868a565fe7", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24210, "timestamp_epoch": "1550951414.767155000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-eafcfc94070efd8846e96da8", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24211, "timestamp_epoch": "1550951414.767352000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-14f2337bf0a7fed4c89299ae", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24212, "timestamp_epoch": "1550951414.767517000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-01add0f937dc75e528727b5b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24213, "timestamp_epoch": "1550951414.767637000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-05703863dd32c610751b376e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24214, "timestamp_epoch": "1550951414.767771000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-db64c3f1b5eb30997ad78863", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24215, "timestamp_epoch": "1550951414.767913000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-69445246e84d22f3b45a5a86", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24216, "timestamp_epoch": "1550951414.768079000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cb518bd1279fa7062b2b1048", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24218, "timestamp_epoch": "1550951414.768403000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-abd07af3acbd4206db3ee588", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24220, "timestamp_epoch": "1550951414.768784000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9028e8e148056582d192ee62", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24221, "timestamp_epoch": "1550951414.768942000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-910af286496c778e418bf635", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24222, "timestamp_epoch": "1550951414.769104000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1c3af95a142bffef88c4c267", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24223, "timestamp_epoch": "1550951414.769218000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e11b487d54d81ff5412fefae", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24224, "timestamp_epoch": "1550951414.769579000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b8a8af4e6a42b1ebe76db83d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24225, "timestamp_epoch": "1550951414.769751000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-08524d63177519672bcf0ef2", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24226, "timestamp_epoch": "1550951414.769916000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-48781f8e38ae2a79eb024717", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24228, "timestamp_epoch": "1550951414.770253000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4059fb37e6a05f755372af6d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24230, "timestamp_epoch": "1550951414.770810000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5bb303b3e7b667de619226bc", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24231, "timestamp_epoch": "1550951414.770992000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-48fefdbf8fb6a62ee3058e85", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24232, "timestamp_epoch": "1550951414.771157000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3e42b6a95b174ac8ea9f8517", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24233, "timestamp_epoch": "1550951414.771269000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0bab481baed02339c3758223", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24234, "timestamp_epoch": "1550951414.771557000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-97107dc19ba3422ef067f6db", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24235, "timestamp_epoch": "1550951414.771684000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-06abd0ac6e409b2879e1b19b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24236, "timestamp_epoch": "1550951414.771839000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b89886c4e7c3850635e2ae4b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24238, "timestamp_epoch": "1550951414.772138000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d68a34bb4f03277db49bd7df", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24240, "timestamp_epoch": "1550951414.772721000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c8b9700d4d997fc7d2d5d67e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24241, "timestamp_epoch": "1550951414.772883000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-50dbe7f3798cb67c3a950c9e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24242, "timestamp_epoch": "1550951414.773071000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-84a9baeb72ef9d7c8c8c263c", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24243, "timestamp_epoch": "1550951414.773172000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f2c0982dd6b2f8f50d9774c4", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24244, "timestamp_epoch": "1550951414.773320000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5e210e17149e41df37dd2a9b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24245, "timestamp_epoch": "1550951414.773614000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-973156a586074ba8834226bc", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24246, "timestamp_epoch": "1550951414.773774000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d1f043758a8e482c21383205", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24248, "timestamp_epoch": "1550951414.774071000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7b4e99ceb6fad9159aea60e1", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24250, "timestamp_epoch": "1550951414.774475000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-09e809c726e7b5d52b7e418d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24251, "timestamp_epoch": "1550951414.774647000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-50866a9a6aedc90a96133f83", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24252, "timestamp_epoch": "1550951414.774830000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c551c9f16a6ff836c24d9073", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24253, "timestamp_epoch": "1550951414.774944000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-026aba76069df93d1b9f797e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24254, "timestamp_epoch": "1550951414.775076000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b2353efc46c350c22aebe86a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24255, "timestamp_epoch": "1550951414.775208000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c4be56969b539f2ca88370a8", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24256, "timestamp_epoch": "1550951414.775364000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-70d50244edc1e59009bd3b21", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24258, "timestamp_epoch": "1550951414.775671000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-65d8d30d1c2141e123118191", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24260, "timestamp_epoch": "1550951414.776057000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3a72def1118592552798d818", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24261, "timestamp_epoch": "1550951414.776275000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-64bac8833b6000b26857e4e1", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24262, "timestamp_epoch": "1550951414.776506000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1217737f52098f8bcf12f660", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24263, "timestamp_epoch": "1550951414.776622000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a3146e3255275c04986537ba", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24264, "timestamp_epoch": "1550951414.776760000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-61dbc4c14625184cbeed8c5b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24265, "timestamp_epoch": "1550951414.776905000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a98e998d5734afb5d9fb4e32", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24266, "timestamp_epoch": "1550951414.777076000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0d3e27719ae6efe5157c4a38", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24268, "timestamp_epoch": "1550951414.777388000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-110c02fc97d9fd175230e729", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24270, "timestamp_epoch": "1550951414.777820000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cce8ce8008f9b17e56e95990", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24271, "timestamp_epoch": "1550951414.778044000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7e9ced62831b9d0cc22849b6", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24272, "timestamp_epoch": "1550951414.778280000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9cd60fa635c6fca7c938ea43", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24273, "timestamp_epoch": "1550951414.778393000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ecd4c07f3ed35774d5dadc8b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24274, "timestamp_epoch": "1550951414.778532000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a16dab43214a7e09ddfd9f35", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24275, "timestamp_epoch": "1550951414.778677000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b4d52a3f71cada4c6d37e549", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24276, "timestamp_epoch": "1550951414.778844000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-660126c2ea599258ac05fc1f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24278, "timestamp_epoch": "1550951414.779151000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6842b002efc45a8d8923b246", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24280, "timestamp_epoch": "1550951414.779946000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ac4b5e7b19fdad96f4f7a300", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24281, "timestamp_epoch": "1550951414.780216000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8d3090435297ebcd1b79097d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24282, "timestamp_epoch": "1550951414.780447000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-486683d49b937c79a1087961", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24283, "timestamp_epoch": "1550951414.780564000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6194479ab602f4f9f735db6a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24284, "timestamp_epoch": "1550951414.780697000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-be49b1b67a9265a098a97218", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24285, "timestamp_epoch": "1550951414.780832000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-97d6f42455173df97ba04ec7", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24286, "timestamp_epoch": "1550951414.780983000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-df89dc1de29da947c45ce344", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24288, "timestamp_epoch": "1550951414.781303000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-47d51086da818f7b255cc364", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24290, "timestamp_epoch": "1550951414.781892000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b8b5c237ebc38dfb923be2f3", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24291, "timestamp_epoch": "1550951414.782115000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9b70661dbc98bc0aac2a287e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24292, "timestamp_epoch": "1550951414.782346000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9c6b8640c950af8f2ee8de0b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24293, "timestamp_epoch": "1550951414.782457000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-17c9afcda8be73fd8fc36107", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24294, "timestamp_epoch": "1550951414.782595000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ac49ef06eb21e4cf5d5aa8b6", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24295, "timestamp_epoch": "1550951414.782757000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c4c86bc8d42981aecbbb9b9a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24296, "timestamp_epoch": "1550951414.782911000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a3ac3945719ee45d43d9393b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24298, "timestamp_epoch": "1550951414.783225000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e12e99e6bdcb53879d6f89ca", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24300, "timestamp_epoch": "1550951414.783886000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cfb9ce1becd76ea7ae0b3fda", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24301, "timestamp_epoch": "1550951414.784147000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-12ef19f067a68a308ed2745b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24302, "timestamp_epoch": "1550951414.784369000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0852d9f35fc5428a112498c1", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24303, "timestamp_epoch": "1550951414.784480000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1519779cb59661f704dd3222", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24304, "timestamp_epoch": "1550951414.784623000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5b5dbc6ff17e77a88703fb11", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24305, "timestamp_epoch": "1550951414.784761000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b75c91a0afb4cb7020675e6b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24306, "timestamp_epoch": "1550951414.784918000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1f041d64c03ed59cacc1799b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24308, "timestamp_epoch": "1550951414.785208000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d8768bab80864621764c6573", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24310, "timestamp_epoch": "1550951414.785926000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b02808f11e5cfebf7b2d6176", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24311, "timestamp_epoch": "1550951414.786133000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b2f5de8b4f8f7f3395e2bcac", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24312, "timestamp_epoch": "1550951414.786353000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2e89cef655a15fe8bd4fbe73", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24313, "timestamp_epoch": "1550951414.786452000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-052f063c1fb49853cd53b452", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24314, "timestamp_epoch": "1550951414.786588000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2e9be8b0bab61510ef4a8122", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24315, "timestamp_epoch": "1550951414.786715000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f1ea71d002b6e8f5820e66d4", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24316, "timestamp_epoch": "1550951414.786874000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0839e92a6706ee9d0a89b76b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24318, "timestamp_epoch": "1550951414.787168000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-682b7b85b0f83a2d51ee8668", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24320, "timestamp_epoch": "1550951414.787621000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-83d3c9e4b7e834902a63fa46", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24321, "timestamp_epoch": "1550951414.787822000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5471c5c3c13e1a4565b62b89", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24322, "timestamp_epoch": "1550951414.788032000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d9520a883aab5a95d017b5b2", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24323, "timestamp_epoch": "1550951414.788147000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-72516ea55428c19aa8c00354", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24324, "timestamp_epoch": "1550951414.788289000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-26c825f02bf0f166dec08d10", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24325, "timestamp_epoch": "1550951414.788432000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f36998a81668fb8e0ce2e499", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24326, "timestamp_epoch": "1550951414.788772000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9c8c95c661eaf175268b6824", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24328, "timestamp_epoch": "1550951414.789118000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-453acbc3a10c69a7c99112ca", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24330, "timestamp_epoch": "1550951414.789644000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6c9063901db0c97059556d07", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24331, "timestamp_epoch": "1550951414.789858000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-50d256d929db55808592e09f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24332, "timestamp_epoch": "1550951414.790065000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-209a97ef2f0dc888788b59af", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24333, "timestamp_epoch": "1550951414.790169000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1bd58c66ebbf4385fcc13ab1", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24334, "timestamp_epoch": "1550951414.790298000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fe132d45b7d3695cada1304c", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24335, "timestamp_epoch": "1550951414.790441000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-790c723caa18614d8c855c19", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24336, "timestamp_epoch": "1550951414.790729000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a2b85817d5e08973c1b69a5f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24338, "timestamp_epoch": "1550951414.791352000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-443fd984396cf63122e41b04", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24340, "timestamp_epoch": "1550951414.792218000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e228116f8096d3fe28387455", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24341, "timestamp_epoch": "1550951414.792503000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-696a72816d23742194d5b63f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24342, "timestamp_epoch": "1550951414.792874000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-758f17f42b5cbce182553d34", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24343, "timestamp_epoch": "1550951414.792990000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-26b1ce73ae6f970f5d267a11", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24344, "timestamp_epoch": "1550951414.793137000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ee01a4ea81ec8db0dd9bff3c", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24345, "timestamp_epoch": "1550951414.793270000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b1f97dd8812f62c426f907a6", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24346, "timestamp_epoch": "1550951414.793427000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2c9f46c169ec31895f3736bb", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24348, "timestamp_epoch": "1550951414.793729000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-807388cc296bcfad75f4fdf0", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24350, "timestamp_epoch": "1550951414.794323000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-35747af2eb0e88490f6721c9", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24351, "timestamp_epoch": "1550951414.794555000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ea82ba74d329723f0174ea04", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24352, "timestamp_epoch": "1550951414.794797000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-37e9fcba57329ea0c70de6bc", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24353, "timestamp_epoch": "1550951414.794953000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9ae04241d6d21e7f1a85db29", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24354, "timestamp_epoch": "1550951414.795120000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-aea501177b34dc39a07d538c", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24355, "timestamp_epoch": "1550951414.795328000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f258efbcd204fd9f5d122c3f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24356, "timestamp_epoch": "1550951414.795616000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-70b8fbde61a5c92090faeb17", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24358, "timestamp_epoch": "1550951414.796002000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ee094d11202771a3ef42b39e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24360, "timestamp_epoch": "1550951414.796433000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5118786e67e814bcd4b8e6a2", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24361, "timestamp_epoch": "1550951414.796762000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d87a7945143e93a41b747aff", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24362, "timestamp_epoch": "1550951414.796994000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-980fddf08438366e353d65ba", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24363, "timestamp_epoch": "1550951414.797112000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b48c20c7fd45c14745e7d8c7", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24364, "timestamp_epoch": "1550951414.797258000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-bd08d56630053d122db56c9e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24365, "timestamp_epoch": "1550951414.797402000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-dab7860fa25cba943e5b2c9a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24366, "timestamp_epoch": "1550951414.797572000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fe8597e9a36a03fcd8e6deae", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24368, "timestamp_epoch": "1550951414.797908000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a294a122134c927c6c638b9e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24370, "timestamp_epoch": "1550951414.798878000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-640c1d0766055600eacabd58", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24371, "timestamp_epoch": "1550951414.799184000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-85ba27f2096bcb7980a5920a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24372, "timestamp_epoch": "1550951414.799398000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-35cb3555b02e04705cd441cf", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24373, "timestamp_epoch": "1550951414.799513000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-eb29fed1cc321853d94952ce", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24374, "timestamp_epoch": "1550951414.799703000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-58c240ae7a00189446c6451d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24375, "timestamp_epoch": "1550951414.799842000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7d37dfcf9f11e99879a7177f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24376, "timestamp_epoch": "1550951414.800004000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a1882667506ddebcf705355a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24378, "timestamp_epoch": "1550951414.800312000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3ffdfa44001501054df77609", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24380, "timestamp_epoch": "1550951414.800870000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-52184a304263415d3de24b94", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24381, "timestamp_epoch": "1550951414.801163000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ab13d9eca9a14eaa030b5839", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24382, "timestamp_epoch": "1550951414.801369000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-41be6c1777168210fe97d779", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24383, "timestamp_epoch": "1550951414.801486000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-71d0528a6f5d7cbd8442189d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24384, "timestamp_epoch": "1550951414.801716000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-eb29fdac4e67f5ef3fa42587", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24385, "timestamp_epoch": "1550951414.801855000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-70b4c98ea73ee06d7d8b37cd", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24386, "timestamp_epoch": "1550951414.802030000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d14a18c007776d4e0abdac26", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24388, "timestamp_epoch": "1550951414.802326000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fddc3a82d13e98d17be4ccc1", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24390, "timestamp_epoch": "1550951414.803033000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-95f75e5d6402e2880551e507", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24391, "timestamp_epoch": "1550951414.803344000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c3b70bd5a6f77403bbdd0c01", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24392, "timestamp_epoch": "1550951414.803512000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-aa8d4fe94c1bc4dfdc2cda7f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24393, "timestamp_epoch": "1550951414.803627000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9b057b9d14d1f4e821d8a4b6", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24394, "timestamp_epoch": "1550951414.803857000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1eeb7ca4e3cd3cef023e05bc", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24395, "timestamp_epoch": "1550951414.804032000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-73bf9ce33c29aaabd87aafa3", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24396, "timestamp_epoch": "1550951414.804367000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d9769ffdecce39791eca2f2e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24398, "timestamp_epoch": "1550951414.804993000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9f6b47e796fc858bf56514fd", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24400, "timestamp_epoch": "1550951414.805399000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c50988065dec52dc9a5a66de", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24401, "timestamp_epoch": "1550951414.805773000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8bf470a4517da3d834ab7692", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24402, "timestamp_epoch": "1550951414.806076000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-877eac694c5216ab9638e530", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24403, "timestamp_epoch": "1550951414.806197000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0c9b67946b4480cd57c2e8a6", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24404, "timestamp_epoch": "1550951414.806520000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ba2c934468e67e32954928e3", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24405, "timestamp_epoch": "1550951414.806684000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-942baa747026e4c6b72a9d8c", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24406, "timestamp_epoch": "1550951414.806848000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3a6bfbf5abe8a1ef31c99ad3", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24408, "timestamp_epoch": "1550951414.807133000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d892cf32c9d29bc72e29952a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24410, "timestamp_epoch": "1550951414.807962000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c816d016d6762f6b9c3cfa1d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24411, "timestamp_epoch": "1550951414.808269000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8729547ff10433916743033c", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24412, "timestamp_epoch": "1550951414.808548000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e25ec52aab2dac12d7c3da24", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24413, "timestamp_epoch": "1550951414.808663000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a05f636c6d6be4579877bf75", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24414, "timestamp_epoch": "1550951414.808808000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-838ae8b976e3291655cd1628", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24415, "timestamp_epoch": "1550951414.808961000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ff49a06d5a6b6497a70607c4", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24416, "timestamp_epoch": "1550951414.809132000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6ba493271c8a0443462e3d50", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24418, "timestamp_epoch": "1550951414.809445000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8ba6272efbb4dd4abc816084", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24420, "timestamp_epoch": "1550951414.810162000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-35edf8ca72e10f1c07b7e01f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24421, "timestamp_epoch": "1550951414.810565000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b959c3e3bd23f287e19d5c76", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24422, "timestamp_epoch": "1550951414.811956000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-667c68151552d419e5d5be54", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24423, "timestamp_epoch": "1550951414.812090000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d5c0cb53615dd2194ec4f035", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24424, "timestamp_epoch": "1550951414.814219000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b7f17565497eb1cfb38597c4", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24425, "timestamp_epoch": "1550951414.814423000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6f3e469584a9d7b53d3163b5", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24426, "timestamp_epoch": "1550951414.816365000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f14e7bf0bcf7f04d4f5d1806", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24428, "timestamp_epoch": "1550951414.816861000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0ffc3a98932f1054cf517ab7", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24430, "timestamp_epoch": "1550951414.817332000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-09f1c48da4a388c06893821a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24431, "timestamp_epoch": "1550951414.817690000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f058eda214f999ce21b28eb9", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24432, "timestamp_epoch": "1550951414.819886000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-8ea8e7dde79be288e1ef7701", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24433, "timestamp_epoch": "1550951414.820233000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d3a8f3b6c0c14e7fa6d14425", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24434, "timestamp_epoch": "1550951414.822283000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3256ded9f9745c94df4466e3", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24435, "timestamp_epoch": "1550951414.823148000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7f64b264a0af4fed4b5031bf", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24436, "timestamp_epoch": "1550951414.824399000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-90096711f5278add5c3672fe", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24438, "timestamp_epoch": "1550951414.824822000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5a3b39182b778a8d542b2d90", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24440, "timestamp_epoch": "1550951414.825664000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f107cb90fe0bf5eee1626812", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24441, "timestamp_epoch": "1550951414.826186000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9e1b3b10786fea2689f9b843", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24442, "timestamp_epoch": "1550951414.827530000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6c206ee15514365538838cb9", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24443, "timestamp_epoch": "1550951414.827699000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-93f3a5866d834c97ba06c9b1", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24444, "timestamp_epoch": "1550951414.829962000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-33f7f5eb0513a77db78bf3d9", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24445, "timestamp_epoch": "1550951414.830159000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-38e3678fb750cc6da0247a57", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24446, "timestamp_epoch": "1550951414.832278000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2f95a3e1747620a15d6976a3", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24448, "timestamp_epoch": "1550951414.832677000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e9512cfe7178d3618efff085", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24450, "timestamp_epoch": "1550951414.833420000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a4513820b18815022a642895", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24451, "timestamp_epoch": "1550951414.833857000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c1fc8844cfd8b72c6e2dcb86", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24452, "timestamp_epoch": "1550951414.834378000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-abb6e3ceb3d0f89212127580", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24453, "timestamp_epoch": "1550951414.834546000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-033c62a79a4e5868385f88e3", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24454, "timestamp_epoch": "1550951414.834744000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d4ee57a47f0725ee693ca2b7", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24455, "timestamp_epoch": "1550951414.834937000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3c790dda8833452a0f3c3ff5", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24456, "timestamp_epoch": "1550951414.835402000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-72902c68567210a9e44d7dbe", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24458, "timestamp_epoch": "1550951414.836020000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d81303050f38f471458d4972", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24460, "timestamp_epoch": "1550951414.836736000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3e9a53750f90868fe8625ddd", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24461, "timestamp_epoch": "1550951414.836945000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-30ecd5f58365002c3619f06c", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24462, "timestamp_epoch": "1550951414.837170000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3e3791b96154a1c8e836bf80", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24463, "timestamp_epoch": "1550951414.837368000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-574389caeace285460a97e03", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24464, "timestamp_epoch": "1550951414.837666000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fcd139612092fabc475b814a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24465, "timestamp_epoch": "1550951414.837859000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-049cc56f34e4aa435b7e55da", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24466, "timestamp_epoch": "1550951414.838070000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e4edd0c387ead06405a529d1", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24468, "timestamp_epoch": "1550951414.838437000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d68fcc3e55c59aa3d10f1588", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24470, "timestamp_epoch": "1550951414.839100000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5a0dd635557129a133d3cf6b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24471, "timestamp_epoch": "1550951414.839299000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7ef3f5ee9b20e5c5093d8dcf", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24472, "timestamp_epoch": "1550951414.839521000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f1b42bbda4d856aa8a1208a5", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24473, "timestamp_epoch": "1550951414.839652000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-19e1d5e32e42ba2c9b43e19a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24474, "timestamp_epoch": "1550951414.839898000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-943be60297bfaf539032470f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24475, "timestamp_epoch": "1550951414.840050000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-cb97f114195f357ab170865c", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24476, "timestamp_epoch": "1550951414.840232000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-46a7fc70abd8a38e2d335168", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24478, "timestamp_epoch": "1550951414.840559000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e643d61d7821a48b5edcddf4", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24480, "timestamp_epoch": "1550951414.841218000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-01b48e820a02b98d0f60b291", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24481, "timestamp_epoch": "1550951414.841442000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2fa4b9e73de0cc508721d668", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24482, "timestamp_epoch": "1550951414.841825000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1491c90d1fb0050fde68b9b6", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24483, "timestamp_epoch": "1550951414.841955000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1012221a80780185ec4677be", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24484, "timestamp_epoch": "1550951414.842125000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-8030d0cd16498820e11be78b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24485, "timestamp_epoch": "1550951414.842277000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0c36758e5690d8e543943ba0", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24486, "timestamp_epoch": "1550951414.842470000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-387b9d10ba1c115afa20b830", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24488, "timestamp_epoch": "1550951414.842826000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7cd6a5b967bd26e9c53ee71a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24490, "timestamp_epoch": "1550951414.843481000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c2ea7bbbc81d6fc1d722e863", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24491, "timestamp_epoch": "1550951414.843749000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-96a747296b451e004e0aba4d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24492, "timestamp_epoch": "1550951414.843989000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ccb9c7340a86b6b7a27a0194", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24493, "timestamp_epoch": "1550951414.844134000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-58f407081919b7d51d53ad91", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24494, "timestamp_epoch": "1550951414.844350000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f2b778ef0cfcd9472fa97479", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24495, "timestamp_epoch": "1550951414.844539000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3b2ac00cbd1b49a899654928", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24496, "timestamp_epoch": "1550951414.844711000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-aba9e6570687135ee67e090e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24498, "timestamp_epoch": "1550951414.845067000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b2ba8bcac0fe497edd2c485f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24500, "timestamp_epoch": "1550951414.845586000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6df80a2a94507d572d962c50", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24501, "timestamp_epoch": "1550951414.845756000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d37c2575492361259003b8d9", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24502, "timestamp_epoch": "1550951414.846076000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-030771f15d97cb71970e30cc", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24503, "timestamp_epoch": "1550951414.846185000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d9a1886b26d0b34d45ba3819", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24504, "timestamp_epoch": "1550951414.846330000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6b92090a661b7416efa77dc4", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24505, "timestamp_epoch": "1550951414.846486000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3c15c8f9cef816b36716888f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24506, "timestamp_epoch": "1550951414.846701000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1b3ef31abfdfe4eba5826305", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24508, "timestamp_epoch": "1550951414.848009000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-bbe84e6579beb900f4e99aff", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24510, "timestamp_epoch": "1550951414.849187000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7bca086f56f1c4efb98d2b97", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24511, "timestamp_epoch": "1550951414.849423000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b7668770a2ad53dc7195ac02", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24512, "timestamp_epoch": "1550951414.849692000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d9d0c218e40544c4fe103079", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24513, "timestamp_epoch": "1550951414.849840000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9b6fbe0edeb00964b9d8b00b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24514, "timestamp_epoch": "1550951414.850033000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-da60768e0745816e84ebe9e8", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24515, "timestamp_epoch": "1550951414.850200000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c8c33feb5f0356810505c23d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24516, "timestamp_epoch": "1550951414.850401000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7cc0288b6e7c231034012e53", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24518, "timestamp_epoch": "1550951414.850724000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ba786df1c2edaf5599fca0a5", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24520, "timestamp_epoch": "1550951414.851203000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-46d5a6a8d5eaa978ea82c31c", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24521, "timestamp_epoch": "1550951414.851387000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-226e5fe1e2f83d15aea3250d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24522, "timestamp_epoch": "1550951414.851730000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2c6f53739f24851232baa36e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24523, "timestamp_epoch": "1550951414.851840000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8db733cef25fa7ba1666cb51", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24524, "timestamp_epoch": "1550951414.852011000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9a342430e1f712d2aeec042b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24525, "timestamp_epoch": "1550951414.852178000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ea53355fdf572b2e086e6bd5", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24526, "timestamp_epoch": "1550951414.852365000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b299ba9d97798ffd59e2b02c", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24528, "timestamp_epoch": "1550951414.852713000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2a9f023403d4c6894f6c7443", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24530, "timestamp_epoch": "1550951414.853339000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-21a50e0a90a4dc78dce5254e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24531, "timestamp_epoch": "1550951414.853545000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2246a954533c4152ab60c2a0", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24532, "timestamp_epoch": "1550951414.853740000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1ffe6a112e51379d7a5b8edb", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24533, "timestamp_epoch": "1550951414.853865000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0957d029a67fda6d0a1b3022", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24534, "timestamp_epoch": "1550951414.854091000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-bb3fa352f3fbd8c9c223fa60", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24535, "timestamp_epoch": "1550951414.854239000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6eb9af4081178e6d81c8db75", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24536, "timestamp_epoch": "1550951414.854439000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a9da8fba1f3aa71b541136be", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24538, "timestamp_epoch": "1550951414.854747000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ceeb341d14bab79748a293c4", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24540, "timestamp_epoch": "1550951414.855428000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-2512c3a39f2a44b17bc17eb1", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24541, "timestamp_epoch": "1550951414.855610000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1fc5795dcdef129b25803801", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24542, "timestamp_epoch": "1550951414.855788000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b8ed3659852dd22fbeff1aab", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24543, "timestamp_epoch": "1550951414.855906000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-eda35f3692b06e4940257299", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24544, "timestamp_epoch": "1550951414.856134000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-965a590cf7c79ba04afd0b9a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24545, "timestamp_epoch": "1550951414.856278000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c330a807e9bff9e7a177191f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24546, "timestamp_epoch": "1550951414.856460000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f22437eb268b27e91a6fbde2", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24548, "timestamp_epoch": "1550951414.856829000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-18f409dedf7990a58f417c99", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24550, "timestamp_epoch": "1550951414.857587000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ba770eb644edeebc86aad55f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24551, "timestamp_epoch": "1550951414.857760000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d5040b651efcd497c7164fff", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24552, "timestamp_epoch": "1550951414.858016000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-8f56cb29e1a94af44f49f323", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24553, "timestamp_epoch": "1550951414.858121000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-99997b335686d8c504bf83ff", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24554, "timestamp_epoch": "1550951414.858257000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-02cf87862a9f5a01dd2bf50d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24555, "timestamp_epoch": "1550951414.858394000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ebc2a4098209156b65eaf8ad", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24556, "timestamp_epoch": "1550951414.858556000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ad75614fe27cf0adbfb43f48", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24558, "timestamp_epoch": "1550951414.858847000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-97c62dea2d64d5784b3d36cb", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24560, "timestamp_epoch": "1550951414.859315000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b8a4935b051db1228305ad61", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24561, "timestamp_epoch": "1550951414.859497000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a32f1c77073c7af14d57af8a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24562, "timestamp_epoch": "1550951414.859763000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7759f1db87b48d375ed64766", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24563, "timestamp_epoch": "1550951414.859874000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-bce983c92aceb130f0f2304a", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24564, "timestamp_epoch": "1550951414.860012000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d9e5dff1214fd8eb34c0e5dc", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24565, "timestamp_epoch": "1550951414.860151000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-21ead23cfac9c1a7c202c12f", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24566, "timestamp_epoch": "1550951414.860317000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fa9643168384f3c8924a9515", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24568, "timestamp_epoch": "1550951414.860655000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e17ff58b13156a76e5b66d02", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24570, "timestamp_epoch": "1550951414.861338000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ad697c55ab75cf8714222348", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24571, "timestamp_epoch": "1550951414.861516000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-afb4ba6c3989fda4c66e4a5d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24572, "timestamp_epoch": "1550951414.861713000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c122a6dd5ad1ca6f67a108a5", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24573, "timestamp_epoch": "1550951414.861824000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c48727f8a0bdfd17c1f6d088", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24574, "timestamp_epoch": "1550951414.862118000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-95c9086c2976a369f4002460", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24575, "timestamp_epoch": "1550951414.862251000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3d00dbcf637397ae3d10f3aa", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24576, "timestamp_epoch": "1550951414.862415000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-348c0874834685b4e6737d94", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24578, "timestamp_epoch": "1550951414.862748000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-eb00cbe6f9e7aa27c6575700", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24580, "timestamp_epoch": "1550951414.863429000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a9a678b430527b43acf10cc2", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24581, "timestamp_epoch": "1550951414.863608000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-6e849e65ad1b8935995c7f1d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24582, "timestamp_epoch": "1550951414.863880000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d8b508d208501d7d11c91fe8", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24583, "timestamp_epoch": "1550951414.863986000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fcdda1eb1e9e6f5aee22aa45", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24584, "timestamp_epoch": "1550951414.864123000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0e169c8b36ba967413389dc0", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24585, "timestamp_epoch": "1550951414.864265000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-daf11ff1789daf65d2c44990", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24586, "timestamp_epoch": "1550951414.864432000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-542b35bb15f648678a3b60a0", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24588, "timestamp_epoch": "1550951414.864740000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3d8262cd4776f95683b0c668", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24590, "timestamp_epoch": "1550951414.865455000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-05db13152aca67a940240f96", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24591, "timestamp_epoch": "1550951414.865689000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c94171c1442ec3d9b357efe7", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24592, "timestamp_epoch": "1550951414.866100000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-54530bc6a014b8eccaf6c064", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24593, "timestamp_epoch": "1550951414.866252000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e5eea85f1d3fdc48039b631e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24594, "timestamp_epoch": "1550951414.866554000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f441cb147956faf1cfe356c6", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24595, "timestamp_epoch": "1550951414.866740000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-70f1ff8c11f9100b16c6acf7", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24596, "timestamp_epoch": "1550951414.867142000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3195075e2f44c00e22caf1da", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24598, "timestamp_epoch": "1550951414.868587000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-501084d86fff4eef17710e2d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24600, "timestamp_epoch": "1550951414.869390000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cca51ea959d675935e5f2702", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24601, "timestamp_epoch": "1550951414.871229000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b3587e3052f38f163846b7e1", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24602, "timestamp_epoch": "1550951414.871905000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ca1d66ffa9834a57617a2e3b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24603, "timestamp_epoch": "1550951414.872058000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1c75b5ad9a4f194dc97b8bf9", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24604, "timestamp_epoch": "1550951414.872235000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4907664368897a0d27b61966", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24605, "timestamp_epoch": "1550951414.872415000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-be721770d618b40911cfb92d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24606, "timestamp_epoch": "1550951414.872593000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6f39ce161f97f233e4bccb98", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24608, "timestamp_epoch": "1550951414.872951000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-72d82e01ebc6e450289b14b2", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24610, "timestamp_epoch": "1550951414.873933000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-be7e6b6670788b42a5a3e83b", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24611, "timestamp_epoch": "1550951414.874120000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ba68afdebffdd45143e57501", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24612, "timestamp_epoch": "1550951414.874309000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-85ccd6e1f9aa4a28065aa0f2", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24613, "timestamp_epoch": "1550951414.874434000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-73ff8a1f5613161f62e24352", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24614, "timestamp_epoch": "1550951414.874730000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4c3d3d9c4b8032d1f649f982", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24615, "timestamp_epoch": "1550951414.874871000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-418baa8eb17f3516d428d6ce", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24616, "timestamp_epoch": "1550951414.875033000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-0ba30236af1a1c0b101b7fbf", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24618, "timestamp_epoch": "1550951414.875342000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-921ba3b1c03fd4984ad3403d", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24620, "timestamp_epoch": "1550951414.875881000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a0bed0192759b7d591c3c345", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24621, "timestamp_epoch": "1550951414.876038000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fc23ae0ec99802aa2f91dd15", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24622, "timestamp_epoch": "1550951414.876199000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-87c8622b49c02efd93cc6e9e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24623, "timestamp_epoch": "1550951414.876310000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-cbeeb2ef49d89e069ab43bcc", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24624, "timestamp_epoch": "1550951414.876558000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-568530de9a6ea920f24c92fd", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24625, "timestamp_epoch": "1550951414.876690000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-68b9f6afb7020520b60df630", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24626, "timestamp_epoch": "1550951414.876890000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-dd6bdfed64366ec7e1ef38ea", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24628, "timestamp_epoch": "1550951414.877253000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-874d896d8b00d1969d0d7999", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24630, "timestamp_epoch": "1550951414.877767000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6965afd670f357664d5309f7", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24631, "timestamp_epoch": "1550951414.877937000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-29f21823d330e951d16b6cae", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24632, "timestamp_epoch": "1550951414.878205000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ab6bd9489bcfb55b7ce05472", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24633, "timestamp_epoch": "1550951414.878310000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-00c34edaeb78bc5f22ef4d0e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24634, "timestamp_epoch": "1550951414.878437000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e9a2aac77cb031c4e1769e1c", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24635, "timestamp_epoch": "1550951414.878591000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0ec8e8c5d7730ce8a0443201", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24636, "timestamp_epoch": "1550951414.878742000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1f3dea92d8b1ded9ac07b453", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24638, "timestamp_epoch": "1550951414.879051000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b424854bf58130157d102cb6", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24640, "timestamp_epoch": "1550951414.880166000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-44c7159c38b48b86e36c692e", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24641, "timestamp_epoch": "1550951414.880385000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5f9e445b57c4867db714a701", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24642, "timestamp_epoch": "1550951414.880550000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3288f2f95693bfb379d3a903", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24643, "timestamp_epoch": "1550951414.880667000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-dc95bc1a55d7cac5bc34c654", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24644, "timestamp_epoch": "1550951414.880868000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-17221e906c1ca1340fb57fd7", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24645, "timestamp_epoch": "1550951414.881015000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7e64fc239c487682e1e3a094", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24646, "timestamp_epoch": "1550951414.881182000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-46974c6138378a8f97efab25", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24648, "timestamp_epoch": "1550951414.881499000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-78b81a2c6d401dd7f1d81b49", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24650, "timestamp_epoch": "1550951414.881951000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-35843ed5fc3dd9759acb0647", "src_port": null, "tcp_stream": 211, "udp_stream": null, "frame_number": 24651, "timestamp_epoch": "1550951414.882110000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d37018234d86c3fcf9b92c5d", "src_port": null, "tcp_stream": 210, "udp_stream": null, "frame_number": 24652, "timestamp_epoch": "1550951414.882358000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-be8aea2137e40a4403aa83fd", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26302, "timestamp_epoch": "1550951444.026428000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-81a0dff19be6b6a5fcf5bd1b", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26303, "timestamp_epoch": "1550951444.026680000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-bf21c4d790d6fca50ec39a8b", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26304, "timestamp_epoch": "1550951444.026852000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6a722aaa3e4ff1788cbf6c58", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26305, "timestamp_epoch": "1550951444.027774000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-87d28768b7caa6b6e12ec568", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26306, "timestamp_epoch": "1550951444.027943000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-98295fdd223d8063ed0b8788", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26307, "timestamp_epoch": "1550951444.028107000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ba3dae892c9234f51e60a7cc", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26310, "timestamp_epoch": "1550951444.029901000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-de5b92ac63bcafc8fff2ffdc", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26311, "timestamp_epoch": "1550951444.030083000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7cf21e9dd3afdfcf02cf451c", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26312, "timestamp_epoch": "1550951444.030230000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-78ed8d20c7b306dd8d8ff9be", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26313, "timestamp_epoch": "1550951444.030464000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3e8de15dd1145c47c6a55079", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26314, "timestamp_epoch": "1550951444.030602000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-5ffc21424756403cca9f8efc", "src_port": null, "tcp_stream": 234, "udp_stream": null, "frame_number": 26315, "timestamp_epoch": "1550951444.030757000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9f580f1d3fec4cd61b42d795", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26319, "timestamp_epoch": "1550951444.038014000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d0032dcb60be1710b60a3ea1", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26321, "timestamp_epoch": "1550951444.038216000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-0f4d6c8a51ad9ea2a922aaa5", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26324, "timestamp_epoch": "1550951444.038984000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3a19c6fa55b122cc90faa74b", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26326, "timestamp_epoch": "1550951444.039621000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a7aa051f017f1f28ea059d00", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26327, "timestamp_epoch": "1550951444.040353000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-36a55f3ec2877d2ab2b2aeae", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26328, "timestamp_epoch": "1550951444.040480000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-60db8a434b77fbe6ad3c500e", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26329, "timestamp_epoch": "1550951444.040709000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-df27d1662139ee3b976dbec6", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26330, "timestamp_epoch": "1550951444.041488000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a44bf6f0cc722815523a4e80", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26331, "timestamp_epoch": "1550951444.041660000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-74fe65370b0bbe543416cf61", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26332, "timestamp_epoch": "1550951444.041816000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4cbfd90b88c10ec356a76325", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26336, "timestamp_epoch": "1550951444.064105000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-44531b4ad779facae8d9db01", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26338, "timestamp_epoch": "1550951444.064345000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-578a444bdd3a91367c2efeaf", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26341, "timestamp_epoch": "1550951444.065564000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1b6375ee70b04007fccb1277", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26343, "timestamp_epoch": "1550951444.066229000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7624469cf855ebadd1103c15", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26344, "timestamp_epoch": "1550951444.066654000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-80c76c1dbd035fec6e91d856", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26345, "timestamp_epoch": "1550951444.066829000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-23447361cf3d5ff54249d8ae", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26346, "timestamp_epoch": "1550951444.067088000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1ec0c0e9b06c665874f82bd9", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26347, "timestamp_epoch": "1550951444.067302000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-dd547e395b48801834669f16", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26348, "timestamp_epoch": "1550951444.067556000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-58482a0d3f6d0c2220afac43", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26349, "timestamp_epoch": "1550951444.067705000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7004c06c5217fbb3499193c8", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26350, "timestamp_epoch": "1550951444.067952000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f9bf4ff13702ae487f35c5e7", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26352, "timestamp_epoch": "1550951444.069109000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c89ff22c4d61b87adb36b104", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26354, "timestamp_epoch": "1550951444.069875000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d5ee6997bd322c6b4dc65dfa", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26355, "timestamp_epoch": "1550951444.071368000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ccda1be227568ec57c46d16d", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26356, "timestamp_epoch": "1550951444.071570000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a1801c546e7e1a8d47419c94", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26357, "timestamp_epoch": "1550951444.071682000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9c7653310e8996ee01d160ca", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26358, "timestamp_epoch": "1550951444.071827000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b0db86bf561f62f72cb5c144", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26359, "timestamp_epoch": "1550951444.072008000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-aa3a9af0084abb29ae67a307", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26360, "timestamp_epoch": "1550951444.072179000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-48cb26096048ebdbbc67a1b9", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26362, "timestamp_epoch": "1550951444.072507000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-022484c4f85c96d1bc316cca", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26364, "timestamp_epoch": "1550951444.072889000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-32f62c1c9054c75e04b8ca49", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26365, "timestamp_epoch": "1550951444.073093000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4b8cdf405da2dfb4b0aaef56", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26366, "timestamp_epoch": "1550951444.073252000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3698b0646b1d62aa89e3fa27", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26367, "timestamp_epoch": "1550951444.073364000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9b8b028f1cbbd06644a3f9a5", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26368, "timestamp_epoch": "1550951444.073502000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e211047af47d57555de26272", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26369, "timestamp_epoch": "1550951444.073631000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8da2d05c111fb316a39c715e", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26370, "timestamp_epoch": "1550951444.073788000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9260b988296b0f56becc5d99", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26372, "timestamp_epoch": "1550951444.074087000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-dd627c133d7c62eac4c3c5b1", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26374, "timestamp_epoch": "1550951444.074461000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-a68451b4f51095cd59de0f0c", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26375, "timestamp_epoch": "1550951444.074669000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-de4259bf4b9ed99606bc080a", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26376, "timestamp_epoch": "1550951444.074852000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-296383323098bd9264889b99", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26377, "timestamp_epoch": "1550951444.074965000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e9c6055402e14482bb8a011e", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26378, "timestamp_epoch": "1550951444.075104000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-fdcc83e1f0f69b6359348ab8", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26379, "timestamp_epoch": "1550951444.075242000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-25e1b81c69203a48b3aea642", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26380, "timestamp_epoch": "1550951444.075429000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4feea63648c3429779a430ac", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26382, "timestamp_epoch": "1550951444.075733000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-39c7eee162b95dc6752d0edb", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26384, "timestamp_epoch": "1550951444.076102000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-aee58c8d915acb10f429dd35", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26385, "timestamp_epoch": "1550951444.076298000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-db2129f1f08d265473760364", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26386, "timestamp_epoch": "1550951444.076439000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-471d560829f3b35330c2d490", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26387, "timestamp_epoch": "1550951444.076551000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-2d3a72b5a615813ec8c1f4ec", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26388, "timestamp_epoch": "1550951444.076689000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-36c0b993276da0ebd4c2d87e", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26389, "timestamp_epoch": "1550951444.076827000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ae5bcdce237def322987f96e", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26390, "timestamp_epoch": "1550951444.076983000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-77faf341eeb2b1a248f71e77", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26392, "timestamp_epoch": "1550951444.077281000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b86432d54cf00f0af0035faa", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26394, "timestamp_epoch": "1550951444.077650000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6f3341715440ecfd617a8085", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26395, "timestamp_epoch": "1550951444.077841000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-31170613f8970d86d3876180", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26396, "timestamp_epoch": "1550951444.077982000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-8ac466647df89ae6cad3c754", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26397, "timestamp_epoch": "1550951444.078093000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1861efb761cdafa427fc7c38", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26398, "timestamp_epoch": "1550951444.078235000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e54ce2dff37ef2ee60200893", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26399, "timestamp_epoch": "1550951444.078371000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b6e81bcbeb537fecf705926d", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26400, "timestamp_epoch": "1550951444.078548000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cb1eb873c62ad4d06b03c290", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26402, "timestamp_epoch": "1550951444.078865000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-534791cb43420e9295ec0b8d", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26404, "timestamp_epoch": "1550951444.079257000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-73d75d3ec97b3bc21501054a", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26405, "timestamp_epoch": "1550951444.079461000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7cd0f4c877aa21b87e2c0ef5", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26406, "timestamp_epoch": "1550951444.079630000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6f2c16161b65f35f478d7c80", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26407, "timestamp_epoch": "1550951444.079755000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-7e78ba267684bfa7be80ec41", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26408, "timestamp_epoch": "1550951444.079899000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-82423ae42fcabea4483b5e1b", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26409, "timestamp_epoch": "1550951444.080039000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-875970e214c14130b7b3e4d5", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26410, "timestamp_epoch": "1550951444.080194000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d383bfdf60b9e4213a565b88", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26412, "timestamp_epoch": "1550951444.080491000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-279267ab8e13f43c442e93e0", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26414, "timestamp_epoch": "1550951444.080928000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-eb333dbc835f191a01d9ca5c", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26415, "timestamp_epoch": "1550951444.081148000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-8469869f0991622b343a9621", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26416, "timestamp_epoch": "1550951444.081305000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d8c1a0f73f6674e777e058e5", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26417, "timestamp_epoch": "1550951444.081418000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c310bd01f29f09f6330e0a1b", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26418, "timestamp_epoch": "1550951444.081555000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c8f5b2fe2aa9dbdbccbf8014", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26419, "timestamp_epoch": "1550951444.081693000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-a006bd299a53fd72a265bfdd", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26420, "timestamp_epoch": "1550951444.081857000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9a53f807a2295c5e1e5b9c38", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26422, "timestamp_epoch": "1550951444.082158000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-1ef85d4331fdb037c337163f", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26424, "timestamp_epoch": "1550951444.082530000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d5486a43d0f5cebb966163ef", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26425, "timestamp_epoch": "1550951444.082723000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-cc953a5dbd5c05ac6f511dd4", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26426, "timestamp_epoch": "1550951444.082943000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c921758d16c5c2e989effac5", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26427, "timestamp_epoch": "1550951444.083054000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-10f1be37035f7c2ce9479c7f", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26428, "timestamp_epoch": "1550951444.083198000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-45e4d59dc69a7e6561ff515f", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26429, "timestamp_epoch": "1550951444.083336000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f9e4230de0cfc7a0336f6504", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26430, "timestamp_epoch": "1550951444.083495000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-38666a72e657d1a233daa8a7", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26432, "timestamp_epoch": "1550951444.083795000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-95696ac0b8fe617dfd1565ca", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26434, "timestamp_epoch": "1550951444.084163000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-8c789cf1bfb6f32c6885ed88", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26435, "timestamp_epoch": "1550951444.084375000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-217f70c4c8fff5c37b389ec4", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26436, "timestamp_epoch": "1550951444.084643000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f9ee141ba4abb8675b78ac4b", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26437, "timestamp_epoch": "1550951444.084756000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d5ff742922b5823b9268aafe", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26438, "timestamp_epoch": "1550951444.084897000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-42e47386de375706861f2d0e", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26439, "timestamp_epoch": "1550951444.085026000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b673d59d563a0ad9bdf7b665", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26440, "timestamp_epoch": "1550951444.085182000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1fe955b7e0a522f11c5c0f61", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26442, "timestamp_epoch": "1550951444.085477000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-89211b10df8e9c0c081a0c78", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26444, "timestamp_epoch": "1550951444.085936000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-550aa4a999f156f4474b6e19", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26445, "timestamp_epoch": "1550951444.086143000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-dfecf7db4f32e5204b38c30d", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26446, "timestamp_epoch": "1550951444.086300000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e5508d50396ad8d17265a7f5", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26447, "timestamp_epoch": "1550951444.086412000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-87ced876a020bfb1323e9a94", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26448, "timestamp_epoch": "1550951444.086549000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-8e2dde36a40f8f87ec0035c9", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26449, "timestamp_epoch": "1550951444.086680000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ffef53b0edd95076d8c615eb", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26450, "timestamp_epoch": "1550951444.086836000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d8908ed32ea3ad3d80c4c163", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26452, "timestamp_epoch": "1550951444.087159000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9b8ea2ba3809fed29febab98", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26454, "timestamp_epoch": "1550951444.087736000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-20c08770a70718ee1b57fec0", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26455, "timestamp_epoch": "1550951444.087936000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-3a052c675215e25f00b2359b", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26456, "timestamp_epoch": "1550951444.088088000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1d9ff6cf6bd1e44e0cf90950", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26457, "timestamp_epoch": "1550951444.088193000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b84fea0715e7b2367b0a5fe7", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26458, "timestamp_epoch": "1550951444.088326000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7d340846846f845f8d9148f2", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26459, "timestamp_epoch": "1550951444.088465000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-46b1a5c281aa9223d13ee79f", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26460, "timestamp_epoch": "1550951444.088627000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-9eb3079272b7075e9a178e4f", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26462, "timestamp_epoch": "1550951444.088933000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-23b3d3c50372ff45f9b6eac7", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26464, "timestamp_epoch": "1550951444.089280000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-b96cc02272a3df843f3dd162", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26465, "timestamp_epoch": "1550951444.089507000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-daebadb256c1560644c6ccca", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26466, "timestamp_epoch": "1550951444.089657000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c7fdf0e8eefd0790307e48a8", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26467, "timestamp_epoch": "1550951444.089769000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b6fed67f474d5a1fea50a109", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26468, "timestamp_epoch": "1550951444.089902000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-33d4c260bd624a5ed9331e48", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26469, "timestamp_epoch": "1550951444.090004000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-185b8bbdd14c81af138a17d6", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26470, "timestamp_epoch": "1550951444.090309000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-16d640ee63a465eb2bf119a5", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26472, "timestamp_epoch": "1550951444.090599000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9c7ee3a9c3e3214823e08324", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26474, "timestamp_epoch": "1550951444.090967000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e543b8bea22205b5a67fd678", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26475, "timestamp_epoch": "1550951444.091186000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9c3c9e8e97e5ed5f69cb5699", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26476, "timestamp_epoch": "1550951444.091420000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-608dec7c31f2e975372c68a5", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26477, "timestamp_epoch": "1550951444.091524000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-aeb5530954fb67aedb2d2221", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26478, "timestamp_epoch": "1550951444.091656000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-4f104c2c313d4aa12c5f1f8e", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26479, "timestamp_epoch": "1550951444.091798000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5c637e01fd9f87f15a02bee6", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26480, "timestamp_epoch": "1550951444.091959000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-37b62dc2318e8ade43f8e36c", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26482, "timestamp_epoch": "1550951444.092286000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-335a27905a3b0071c2c50673", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26484, "timestamp_epoch": "1550951444.092742000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-d85fc976c1f2ae26a8874c79", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26485, "timestamp_epoch": "1550951444.092955000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d63b639cf78937d80ca795a9", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26486, "timestamp_epoch": "1550951444.093144000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-cd4307483a8e1a24e5dae3df", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26487, "timestamp_epoch": "1550951444.093257000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-753d92d4f44fe3596eeb9ec8", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26488, "timestamp_epoch": "1550951444.093521000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-f44ef0de7e2a16fb80b4d37e", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26489, "timestamp_epoch": "1550951444.093662000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e42244a7fdac0f3354a39a39", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26490, "timestamp_epoch": "1550951444.093820000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-262b4e136680d4eab778d046", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26492, "timestamp_epoch": "1550951444.094133000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-c66838aa88342a2a89889f12", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26494, "timestamp_epoch": "1550951444.094707000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7056359372b1967885826b70", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26495, "timestamp_epoch": "1550951444.094907000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-fa2e1f887e331b1ece96aa97", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26496, "timestamp_epoch": "1550951444.095124000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-10dfdf27a25461b2d9fd43c5", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26497, "timestamp_epoch": "1550951444.095237000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-4df5cbe44ec2f2d0fc48d656", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26498, "timestamp_epoch": "1550951444.095374000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-301b9204812208a216071c94", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26499, "timestamp_epoch": "1550951444.095506000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-de4fe47f54ee535a21dc4ce8", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26500, "timestamp_epoch": "1550951444.095667000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-32005ac4e5958a89f094b561", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26502, "timestamp_epoch": "1550951444.095960000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-b749125d6cba9e6b2c4e0493", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26504, "timestamp_epoch": "1550951444.096489000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-180fdf0666771e375a699601", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26505, "timestamp_epoch": "1550951444.096688000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-357f9405c4e2738c31772fd2", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26506, "timestamp_epoch": "1550951444.096879000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6db0d59077e5f8aa3bfce5f3", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26507, "timestamp_epoch": "1550951444.096994000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-d63b948451881383daafc891", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26508, "timestamp_epoch": "1550951444.097138000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-7be94a89b9613abf44229104", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26509, "timestamp_epoch": "1550951444.097272000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-052d0b119efd245e0e08b490", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26510, "timestamp_epoch": "1550951444.097434000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-bd3183dfc42f6cf4964c227b", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26512, "timestamp_epoch": "1550951444.097724000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-9d5f50944db119cc45deb431", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26514, "timestamp_epoch": "1550951444.098088000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-120654e7c9d4a3819f5eca94", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26515, "timestamp_epoch": "1550951444.098288000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5d9509ae355264f4b1d12034", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26516, "timestamp_epoch": "1550951444.098437000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ef1728c6f68579e4cbce1711", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26517, "timestamp_epoch": "1550951444.098551000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ad43f3795c5e8d70d86362b7", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26518, "timestamp_epoch": "1550951444.098702000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c991042fe5025b1794f4baf4", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26519, "timestamp_epoch": "1550951444.098836000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-830c1f3e8ce3361940921e24", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26520, "timestamp_epoch": "1550951444.098994000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-6d3d0ee25d34fae3ba3801f1", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26522, "timestamp_epoch": "1550951444.099303000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-996871164661a76e700c2e08", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26524, "timestamp_epoch": "1550951444.100042000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-1a0849b568c24810cf8e347c", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26525, "timestamp_epoch": "1550951444.100327000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-42c86995e7cd05a072d9fa8d", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26526, "timestamp_epoch": "1550951444.100489000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-ab39624ca5e9f97e65c3a043", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26527, "timestamp_epoch": "1550951444.100595000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-f52027188bb0872057e6f491", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26528, "timestamp_epoch": "1550951444.100722000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-c798bd589d86242b2067db85", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26529, "timestamp_epoch": "1550951444.100848000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-675d81ee0209d7f67876d75b", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26530, "timestamp_epoch": "1550951444.101043000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-e1ca54f501b63c0afc669f87", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26532, "timestamp_epoch": "1550951444.101530000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-ce13e1c634cf10339660c6fa", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26534, "timestamp_epoch": "1550951444.101917000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-52437de8c0a67d6ac7cddc2c", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26535, "timestamp_epoch": "1550951444.102131000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-287c3e74dd93e74d52646ded", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26536, "timestamp_epoch": "1550951444.102280000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3eac283a6e5197a1ace49289", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26537, "timestamp_epoch": "1550951444.102389000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-5a0809d42b4d13e66f52f64e", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26538, "timestamp_epoch": "1550951444.102528000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-3d7660ba5aacf90732d5586e", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26539, "timestamp_epoch": "1550951444.102681000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-e2adf9bc191d9726288df7eb", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26540, "timestamp_epoch": "1550951444.102845000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-653151748b7b553cd0be4036", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26542, "timestamp_epoch": "1550951444.103150000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=stormtheory,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-97a0abb010bcfbe520a734e3", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26544, "timestamp_epoch": "1550951444.103593000" }, { "kind": "directory_service", "dst_ip": "10.2.23.231", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.2.23.2", "dst_port": null, "event_id": "evt-13cc699fcd67be6a313ad97c", "src_port": null, "tcp_stream": 236, "udp_stream": null, "frame_number": 26545, "timestamp_epoch": "1550951444.103809000" }, { "kind": "directory_service", "dst_ip": "10.2.23.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.2.23.231", "dst_port": null, "event_id": "evt-eb3c16897da0ca9ae87b1503", "src_port": null, "tcp_stream": 235, "udp_stream": null, "frame_number": 26546, "timestamp_epoch": "1550951444.104049000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 28884, "interface_ids": [], "source_sha256": "f6d740aeaac9e7d23843b481b7cbc179117cd21fab2f0d82c0e94fe8ba092775", "captured_bytes": 19284827, "protocol_counts": { "ip": 28884, "dns": 202, "eth": 28884, "ntp": 10, "png": 14, "smb": 3395, "tcp": 28326, "tls": 1562, "udp": 545, "data": 120, "dhcp": 16, "http": 184, "igmp": 26, "json": 2, "ldap": 1172, "nbns": 256, "nbss": 3636, "smb2": 265, "cldap": 22, "llmnr": 15, "media": 10, "nbdgm": 24, "dcerpc": 150, "spnego": 210, "x509ce": 339, "browser": 24, "gss-api": 926, "ntlmssp": 58, "x509sat": 596, "kerberos": 88, "ethertype": 28884, "websocket": 70, "image-jfif": 4, "spnego-krb5": 954, "pkix1explicit": 32, "pkix1implicit": 34, "mime_multipart": 4, "data-text-lines": 19, "urlencoded-form": 2 }, "duration_seconds": 2708.694353, "last_packet_epoch": "1550952584.866718", "source_size_bytes": 19746995, "first_packet_epoch": "1550949876.172365", "encapsulation_types": [ 1 ] }, "summary": "Decoded 28884 packets across 36 IP endpoints and 376 transport flows. Observed 202 DNS events, 60 HTTP requests, 51 TLS ClientHello events, and 52 recovered file/message object(s). Deterministic rules produced 16 finding(s): 1 high, 7 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 202, "truncated": false }, "dhcp": { "returned": 16, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 745, "truncated": false }, "http_request": { "returned": 60, "truncated": false }, "http_response": { "returned": 54, "truncated": false }, "tls_client_hello": { "returned": 51, "truncated": false }, "unclassified_tcp": { "returned": 25, "truncated": false }, "directory_service": { "returned": 861, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 7743266, "export_status": "completed", "unique_hashes": 52, "hashed_objects": 59, "compact_objects": 0, "detailed_objects": 52, "exported_objects": 59, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 52 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": true, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/universal/scripts-compressed/common-c2a92195cbc0a2d6aed1-min.en-US.js", "source": "151.101.64.238", "destination": "10.2.23.109", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 357021 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 82, "frame_number": 1433, "display_filter": "frame.number == 1433", "timestamp_epoch": "1550949997.471468000" }, { "tcp_stream": 82, "frame_number": 2049, "display_filter": "frame.number == 2049", "timestamp_epoch": "1550950018.735133000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-39056bda31707ecb669f20fb", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/ik/qtSfIe0hWL1wtEbIsJFPUsITCi0N4DUQd5Tzt0wJ8s6feGw2fFHN4UJLFRbh52jhWD9DwQShjAw3ZQsKweFR5eIuF2MkFRbXwgTuiaiaO14zdasDjhBcZWFCjkoRdhXCScNziYFRjAZ8ShUROcFzdPUCiAoTdkuqZWZ8deN3dAm0ifuE-QJUO1FUiABkZWF3jAF8OcFzdP37OcUudc8zOAs8icmCdaglZAoXOWTTwRI0SaBujW48Sagyjh90jhNlJ6U3ScNt-AuyOAozicIKgcBqZAUCZPG4fHCgIMMjMPMfH6qJtKGbMg62JMJ7fbKzMsMMeMb6MKG4fHXgIMMjgKMfH6qJK3IbMg6YJMJ7fbKTMsMMeM66MKG4f5w7IMMj2PMfH6qJKbIbMg64JMJ7fbK3MsMMeMt6MKG4fHtgIMMjIfMfH6qJRMIbMg6sJMJ7fbK7MsMMegJ6MKG4fJGgIMMjIkMfH6qJXR9bMs62JMJ7fbR5FsMgeMb6MKG4fFIVIMIjgkMfH6qJXD9bMs6FJMJ7fbRVFsMgeMt6MKG4fFJVIMIjIPMf.js", "source": "23.63.25.226", "destination": "10.2.23.109", "content_type": "text/javascript;charset=utf-8", "response_count": 1, "declared_body_bytes": 7843 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 83, "frame_number": 1526, "display_filter": "frame.number == 1526", "timestamp_epoch": "1550949999.780623000" }, { "tcp_stream": 83, "frame_number": 1594, "display_filter": "frame.number == 1594", "timestamp_epoch": "1550950001.311240000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-886929ab2082e4c59b408d4d", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Tinx86_14.exe", "source": "46.249.62.199", "destination": "10.2.23.231", "content_type": "application/octet-stream", "response_count": 1, "declared_body_bytes": 2818560 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 110, "frame_number": 6249, "display_filter": "frame.number == 6249", "timestamp_epoch": "1550950410.137505000" }, { "tcp_stream": 110, "frame_number": 11971, "display_filter": "frame.number == 11971", "timestamp_epoch": "1550950744.087696000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-23b318fe4b83043b05f23020", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/Sw9JKmXqaSj.exe", "source": "46.249.62.199", "destination": "10.2.23.231", "content_type": "application/octet-stream", "response_count": 1, "declared_body_bytes": 168448 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 109, "frame_number": 6262, "display_filter": "frame.number == 6262", "timestamp_epoch": "1550950411.127146000" }, { "tcp_stream": 109, "frame_number": 6800, "display_filter": "frame.number == 6800", "timestamp_epoch": "1550950432.567344000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-c4c6c2478918933011320016", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/apps/LeenaCanvas/Package-HTML/HTML/js/functions.js", "source": "161.119.42.22", "destination": "10.2.23.109", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 126945 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 230, "frame_number": 25149, "display_filter": "frame.number == 25149", "timestamp_epoch": "1550951430.456252000" }, { "tcp_stream": 230, "frame_number": 27968, "display_filter": "frame.number == 27968", "timestamp_epoch": "1550951460.239749000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-3385b4c8ffed4bb2b389ffab", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/apps/LeenaCanvas/Package-HTML/HTML/js/jquery.js", "source": "161.119.42.22", "destination": "10.2.23.109", "content_type": "application/javascript", "response_count": 1, "declared_body_bytes": 95954 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 226, "frame_number": 25868, "display_filter": "frame.number == 25868", "timestamp_epoch": "1550951438.897816000" }, { "tcp_stream": 226, "frame_number": 26841, "display_filter": "frame.number == 26841", "timestamp_epoch": "1550951447.134923000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-c80a70eba572e50f2498707a", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.2.23.109", "protocol": "drsuapi", "destination": "10.2.23.2", "event_count": 8, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 32, "frame_number": 568, "display_filter": "frame.number == 568", "timestamp_epoch": "1550949919.929342000" }, { "tcp_stream": 32, "frame_number": 570, "display_filter": "frame.number == 570", "timestamp_epoch": "1550949919.930809000" }, { "tcp_stream": 32, "frame_number": 572, "display_filter": "frame.number == 572", "timestamp_epoch": "1550949919.931744000" }, { "tcp_stream": 32, "frame_number": 574, "display_filter": "frame.number == 574", "timestamp_epoch": "1550949919.932540000" }, { "tcp_stream": 32, "frame_number": 1060, "display_filter": "frame.number == 1060", "timestamp_epoch": "1550949975.154174000" }, { "tcp_stream": 32, "frame_number": 1062, "display_filter": "frame.number == 1062", "timestamp_epoch": "1550949975.154662000" }, { "tcp_stream": 32, "frame_number": 1064, "display_filter": "frame.number == 1064", "timestamp_epoch": "1550949975.155671000" }, { "tcp_stream": 32, "frame_number": 1066, "display_filter": "frame.number == 1066", "timestamp_epoch": "1550949975.156274000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-8d38b4794f66c37bf95b8923", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.2.23.109", "protocol": "ldap", "destination": "10.2.23.2", "event_count": 30, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 23, "frame_number": 418, "display_filter": "frame.number == 418", "timestamp_epoch": "1550949914.818867000" }, { "tcp_stream": 23, "frame_number": 453, "display_filter": "frame.number == 453", "timestamp_epoch": "1550949914.848560000" }, { "tcp_stream": 23, "frame_number": 456, "display_filter": "frame.number == 456", "timestamp_epoch": "1550949914.850352000" }, { "tcp_stream": 37, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1550949920.122582000" }, { "tcp_stream": 37, "frame_number": 643, "display_filter": "frame.number == 643", "timestamp_epoch": "1550949920.127670000" }, { "tcp_stream": 37, "frame_number": 646, "display_filter": "frame.number == 646", "timestamp_epoch": "1550949920.133553000" }, { "tcp_stream": 39, "frame_number": 653, "display_filter": "frame.number == 653", "timestamp_epoch": "1550949920.137467000" }, { "tcp_stream": 39, "frame_number": 656, "display_filter": "frame.number == 656", "timestamp_epoch": "1550949920.138681000" }, { "tcp_stream": 39, "frame_number": 658, "display_filter": "frame.number == 658", "timestamp_epoch": "1550949920.139018000" }, { "tcp_stream": 37, "frame_number": 660, "display_filter": "frame.number == 660", "timestamp_epoch": "1550949920.139434000" }, { "tcp_stream": 39, "frame_number": 707, "display_filter": "frame.number == 707", "timestamp_epoch": "1550949920.167200000" }, { "tcp_stream": 37, "frame_number": 716, "display_filter": "frame.number == 716", "timestamp_epoch": "1550949920.625923000" }, { "tcp_stream": 64, "frame_number": 1074, "display_filter": "frame.number == 1074", "timestamp_epoch": "1550949975.677202000" }, { "tcp_stream": 64, "frame_number": 1089, "display_filter": "frame.number == 1089", "timestamp_epoch": "1550949975.685552000" }, { "tcp_stream": 68, "frame_number": 1117, "display_filter": "frame.number == 1117", "timestamp_epoch": "1550949975.690069000" }, { "tcp_stream": 68, "frame_number": 1120, "display_filter": "frame.number == 1120", "timestamp_epoch": "1550949975.690954000" }, { "tcp_stream": 68, "frame_number": 1122, "display_filter": "frame.number == 1122", "timestamp_epoch": "1550949975.691364000" }, { "tcp_stream": 64, "frame_number": 1124, "display_filter": "frame.number == 1124", "timestamp_epoch": "1550949975.691772000" }, { "tcp_stream": 68, "frame_number": 1168, "display_filter": "frame.number == 1168", "timestamp_epoch": "1550949975.701414000" }, { "tcp_stream": 64, "frame_number": 1172, "display_filter": "frame.number == 1172", "timestamp_epoch": "1550949976.220041000" }, { "tcp_stream": 162, "frame_number": 12420, "display_filter": "frame.number == 12420", "timestamp_epoch": "1550950760.044160000" }, { "tcp_stream": 162, "frame_number": 12437, "display_filter": "frame.number == 12437", "timestamp_epoch": "1550950760.048703000" }, { "tcp_stream": 162, "frame_number": 12440, "display_filter": "frame.number == 12440", "timestamp_epoch": "1550950760.049659000" }, { "tcp_stream": 162, "frame_number": 12442, "display_filter": "frame.number == 12442", "timestamp_epoch": "1550950760.050069000" }, { "tcp_stream": 162, "frame_number": 12453, "display_filter": "frame.number == 12453", "timestamp_epoch": "1550950760.158780000" }, { "tcp_stream": 162, "frame_number": 12472, "display_filter": "frame.number == 12472", "timestamp_epoch": "1550950760.261011000" }, { "tcp_stream": 162, "frame_number": 12479, "display_filter": "frame.number == 12479", "timestamp_epoch": "1550950760.267689000" }, { "tcp_stream": 162, "frame_number": 12488, "display_filter": "frame.number == 12488", "timestamp_epoch": "1550950760.271459000" }, { "tcp_stream": 162, "frame_number": 12491, "display_filter": "frame.number == 12491", "timestamp_epoch": "1550950760.272678000" }, { "tcp_stream": 162, "frame_number": 12493, "display_filter": "frame.number == 12493", "timestamp_epoch": "1550950760.273451000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-6cd6a3fd94ae1fb9712d71bf", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.2.23.2", "protocol": "drsuapi", "destination": "10.2.23.109", "event_count": 8, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 32, "frame_number": 569, "display_filter": "frame.number == 569", "timestamp_epoch": "1550949919.929563000" }, { "tcp_stream": 32, "frame_number": 571, "display_filter": "frame.number == 571", "timestamp_epoch": "1550949919.931538000" }, { "tcp_stream": 32, "frame_number": 573, "display_filter": "frame.number == 573", "timestamp_epoch": "1550949919.932163000" }, { "tcp_stream": 32, "frame_number": 575, "display_filter": "frame.number == 575", "timestamp_epoch": "1550949919.932720000" }, { "tcp_stream": 32, "frame_number": 1061, "display_filter": "frame.number == 1061", "timestamp_epoch": "1550949975.154369000" }, { "tcp_stream": 32, "frame_number": 1063, "display_filter": "frame.number == 1063", "timestamp_epoch": "1550949975.155379000" }, { "tcp_stream": 32, "frame_number": 1065, "display_filter": "frame.number == 1065", "timestamp_epoch": "1550949975.156003000" }, { "tcp_stream": 32, "frame_number": 1067, "display_filter": "frame.number == 1067", "timestamp_epoch": "1550949975.156416000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-8d565b865b6e3b4f91e8b3d9", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.2.23.2", "protocol": "ldap", "destination": "10.2.23.109", "event_count": 24, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 23, "frame_number": 420, "display_filter": "frame.number == 420", "timestamp_epoch": "1550949914.819176000" }, { "tcp_stream": 23, "frame_number": 455, "display_filter": "frame.number == 455", "timestamp_epoch": "1550949914.849135000" }, { "tcp_stream": 37, "frame_number": 628, "display_filter": "frame.number == 628", "timestamp_epoch": "1550949920.122786000" }, { "tcp_stream": 37, "frame_number": 645, "display_filter": "frame.number == 645", "timestamp_epoch": "1550949920.128325000" }, { "tcp_stream": 37, "frame_number": 647, "display_filter": "frame.number == 647", "timestamp_epoch": "1550949920.133955000" }, { "tcp_stream": 39, "frame_number": 655, "display_filter": "frame.number == 655", "timestamp_epoch": "1550949920.138197000" }, { "tcp_stream": 39, "frame_number": 657, "display_filter": "frame.number == 657", "timestamp_epoch": "1550949920.138838000" }, { "tcp_stream": 39, "frame_number": 659, "display_filter": "frame.number == 659", "timestamp_epoch": "1550949920.139207000" }, { "tcp_stream": 37, "frame_number": 661, "display_filter": "frame.number == 661", "timestamp_epoch": "1550949920.140177000" }, { "tcp_stream": 64, "frame_number": 1076, "display_filter": "frame.number == 1076", "timestamp_epoch": "1550949975.677926000" }, { "tcp_stream": 64, "frame_number": 1095, "display_filter": "frame.number == 1095", "timestamp_epoch": "1550949975.685966000" }, { "tcp_stream": 68, "frame_number": 1119, "display_filter": "frame.number == 1119", "timestamp_epoch": "1550949975.690548000" }, { "tcp_stream": 68, "frame_number": 1121, "display_filter": "frame.number == 1121", "timestamp_epoch": "1550949975.691166000" }, { "tcp_stream": 68, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1550949975.691554000" }, { "tcp_stream": 64, "frame_number": 1125, "display_filter": "frame.number == 1125", "timestamp_epoch": "1550949975.692337000" }, { "tcp_stream": 162, "frame_number": 12422, "display_filter": "frame.number == 12422", "timestamp_epoch": "1550950760.044579000" }, { "tcp_stream": 162, "frame_number": 12439, "display_filter": "frame.number == 12439", "timestamp_epoch": "1550950760.049410000" }, { "tcp_stream": 162, "frame_number": 12441, "display_filter": "frame.number == 12441", "timestamp_epoch": "1550950760.049845000" }, { "tcp_stream": 162, "frame_number": 12443, "display_filter": "frame.number == 12443", "timestamp_epoch": "1550950760.050522000" }, { "tcp_stream": 162, "frame_number": 12456, "display_filter": "frame.number == 12456", "timestamp_epoch": "1550950760.159406000" }, { "tcp_stream": 162, "frame_number": 12474, "display_filter": "frame.number == 12474", "timestamp_epoch": "1550950760.261644000" }, { "tcp_stream": 162, "frame_number": 12482, "display_filter": "frame.number == 12482", "timestamp_epoch": "1550950760.268298000" }, { "tcp_stream": 162, "frame_number": 12490, "display_filter": "frame.number == 12490", "timestamp_epoch": "1550950760.271844000" }, { "tcp_stream": 162, "frame_number": 12492, "display_filter": "frame.number == 12492", "timestamp_epoch": "1550950760.273198000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-4739d36b886723603541708b", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.2.23.2", "protocol": "drsuapi", "destination": "10.2.23.231", "event_count": 14, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 6, "frame_number": 130, "display_filter": "frame.number == 130", "timestamp_epoch": "1550949877.428756000" }, { "tcp_stream": 6, "frame_number": 132, "display_filter": "frame.number == 132", "timestamp_epoch": "1550949877.433257000" }, { "tcp_stream": 6, "frame_number": 134, "display_filter": "frame.number == 134", "timestamp_epoch": "1550949877.435272000" }, { "tcp_stream": 6, "frame_number": 136, "display_filter": "frame.number == 136", "timestamp_epoch": "1550949877.436552000" }, { "tcp_stream": 44, "frame_number": 858, "display_filter": "frame.number == 858", "timestamp_epoch": "1550949937.320607000" }, { "tcp_stream": 44, "frame_number": 860, "display_filter": "frame.number == 860", "timestamp_epoch": "1550949937.321515000" }, { "tcp_stream": 44, "frame_number": 862, "display_filter": "frame.number == 862", "timestamp_epoch": "1550949937.321994000" }, { "tcp_stream": 44, "frame_number": 864, "display_filter": "frame.number == 864", "timestamp_epoch": "1550949937.322372000" }, { "tcp_stream": 234, "frame_number": 26303, "display_filter": "frame.number == 26303", "timestamp_epoch": "1550951444.026680000" }, { "tcp_stream": 234, "frame_number": 26305, "display_filter": "frame.number == 26305", "timestamp_epoch": "1550951444.027774000" }, { "tcp_stream": 234, "frame_number": 26307, "display_filter": "frame.number == 26307", "timestamp_epoch": "1550951444.028107000" }, { "tcp_stream": 234, "frame_number": 26311, "display_filter": "frame.number == 26311", "timestamp_epoch": "1550951444.030083000" }, { "tcp_stream": 234, "frame_number": 26313, "display_filter": "frame.number == 26313", "timestamp_epoch": "1550951444.030464000" }, { "tcp_stream": 234, "frame_number": 26315, "display_filter": "frame.number == 26315", "timestamp_epoch": "1550951444.030757000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-17b627042509d0d603c57a68", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.2.23.2", "protocol": "ldap", "destination": "10.2.23.231", "event_count": 377, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5", "4,4,4,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 0, "frame_number": 19, "display_filter": "frame.number == 19", "timestamp_epoch": "1550949876.658946000" }, { "tcp_stream": 0, "frame_number": 54, "display_filter": "frame.number == 54", "timestamp_epoch": "1550949876.702943000" }, { "tcp_stream": 10, "frame_number": 146, "display_filter": "frame.number == 146", "timestamp_epoch": "1550949877.470590000" }, { "tcp_stream": 10, "frame_number": 163, "display_filter": "frame.number == 163", "timestamp_epoch": "1550949877.474857000" }, { "tcp_stream": 10, "frame_number": 165, "display_filter": "frame.number == 165", "timestamp_epoch": "1550949877.479032000" }, { "tcp_stream": 12, "frame_number": 172, "display_filter": "frame.number == 172", "timestamp_epoch": "1550949877.486118000" }, { "tcp_stream": 12, "frame_number": 174, "display_filter": "frame.number == 174", "timestamp_epoch": "1550949877.486817000" }, { "tcp_stream": 12, "frame_number": 176, "display_filter": "frame.number == 176", "timestamp_epoch": "1550949877.487724000" }, { "tcp_stream": 10, "frame_number": 178, "display_filter": "frame.number == 178", "timestamp_epoch": "1550949877.489417000" }, { "tcp_stream": 52, "frame_number": 877, "display_filter": "frame.number == 877", "timestamp_epoch": "1550949937.847436000" }, { "tcp_stream": 52, "frame_number": 891, "display_filter": "frame.number == 891", "timestamp_epoch": "1550949937.865260000" }, { "tcp_stream": 54, "frame_number": 900, "display_filter": "frame.number == 900", "timestamp_epoch": "1550949937.870555000" }, { "tcp_stream": 54, "frame_number": 903, "display_filter": "frame.number == 903", "timestamp_epoch": "1550949937.871310000" }, { "tcp_stream": 54, "frame_number": 908, "display_filter": "frame.number == 908", "timestamp_epoch": "1550949937.871990000" }, { "tcp_stream": 52, "frame_number": 926, "display_filter": "frame.number == 926", "timestamp_epoch": "1550949937.889646000" }, { "tcp_stream": 127, "frame_number": 10402, "display_filter": "frame.number == 10402", "timestamp_epoch": "1550950710.955268000" }, { "tcp_stream": 127, "frame_number": 10407, "display_filter": "frame.number == 10407", "timestamp_epoch": "1550950710.961636000" }, { "tcp_stream": 127, "frame_number": 10409, "display_filter": "frame.number == 10409", "timestamp_epoch": "1550950710.978601000" }, { "tcp_stream": 127, "frame_number": 10411, "display_filter": "frame.number == 10411", "timestamp_epoch": "1550950710.981161000" }, { "tcp_stream": 127, "frame_number": 10413, "display_filter": "frame.number == 10413", "timestamp_epoch": "1550950710.981731000" }, { "tcp_stream": 127, "frame_number": 10614, "display_filter": "frame.number == 10614", "timestamp_epoch": "1550950711.006673000" }, { "tcp_stream": 127, "frame_number": 10620, "display_filter": "frame.number == 10620", "timestamp_epoch": "1550950711.059677000" }, { "tcp_stream": 155, "frame_number": 11268, "display_filter": "frame.number == 11268", "timestamp_epoch": "1550950724.595381000" }, { "tcp_stream": 155, "frame_number": 11285, "display_filter": "frame.number == 11285", "timestamp_epoch": "1550950724.600058000" }, { "tcp_stream": 155, "frame_number": 11287, "display_filter": "frame.number == 11287", "timestamp_epoch": "1550950724.600424000" }, { "tcp_stream": 155, "frame_number": 11289, "display_filter": "frame.number == 11289", "timestamp_epoch": "1550950724.600974000" }, { "tcp_stream": 155, "frame_number": 11301, "display_filter": "frame.number == 11301", "timestamp_epoch": "1550950724.705226000" }, { "tcp_stream": 155, "frame_number": 11313, "display_filter": "frame.number == 11313", "timestamp_epoch": "1550950724.814012000" }, { "tcp_stream": 155, "frame_number": 11321, "display_filter": "frame.number == 11321", "timestamp_epoch": "1550950724.816014000" }, { "tcp_stream": 155, "frame_number": 11329, "display_filter": "frame.number == 11329", "timestamp_epoch": "1550950724.818223000" }, { "tcp_stream": 155, "frame_number": 11331, "display_filter": "frame.number == 11331", "timestamp_epoch": "1550950724.818985000" }, { "tcp_stream": 210, "frame_number": 24022, "display_filter": "frame.number == 24022", "timestamp_epoch": "1550951414.633666000" }, { "tcp_stream": 210, "frame_number": 24027, "display_filter": "frame.number == 24027", "timestamp_epoch": "1550951414.637421000" }, { "tcp_stream": 210, "frame_number": 24029, "display_filter": "frame.number == 24029", "timestamp_epoch": "1550951414.640914000" }, { "tcp_stream": 210, "frame_number": 24031, "display_filter": "frame.number == 24031", "timestamp_epoch": "1550951414.646370000" }, { "tcp_stream": 210, "frame_number": 24033, "display_filter": "frame.number == 24033", "timestamp_epoch": "1550951414.648823000" }, { "tcp_stream": 210, "frame_number": 24035, "display_filter": "frame.number == 24035", "timestamp_epoch": "1550951414.650088000" }, { "tcp_stream": 210, "frame_number": 24037, "display_filter": "frame.number == 24037", "timestamp_epoch": "1550951414.651335000" }, { "tcp_stream": 210, "frame_number": 24039, "display_filter": "frame.number == 24039", "timestamp_epoch": "1550951414.652491000" }, { "tcp_stream": 210, "frame_number": 24041, "display_filter": "frame.number == 24041", "timestamp_epoch": "1550951414.653592000" }, { "tcp_stream": 210, "frame_number": 24043, "display_filter": "frame.number == 24043", "timestamp_epoch": "1550951414.654757000" }, { "tcp_stream": 210, "frame_number": 24045, "display_filter": "frame.number == 24045", "timestamp_epoch": "1550951414.655975000" }, { "tcp_stream": 210, "frame_number": 24047, "display_filter": "frame.number == 24047", "timestamp_epoch": "1550951414.657335000" }, { "tcp_stream": 210, "frame_number": 24049, "display_filter": "frame.number == 24049", "timestamp_epoch": "1550951414.658456000" }, { "tcp_stream": 210, "frame_number": 24051, "display_filter": "frame.number == 24051", "timestamp_epoch": "1550951414.660459000" }, { "tcp_stream": 210, "frame_number": 24053, "display_filter": "frame.number == 24053", "timestamp_epoch": "1550951414.662207000" }, { "tcp_stream": 210, "frame_number": 24055, "display_filter": "frame.number == 24055", "timestamp_epoch": "1550951414.663911000" }, { "tcp_stream": 210, "frame_number": 24057, "display_filter": "frame.number == 24057", "timestamp_epoch": "1550951414.665348000" }, { "tcp_stream": 210, "frame_number": 24059, "display_filter": "frame.number == 24059", "timestamp_epoch": "1550951414.666759000" }, { "tcp_stream": 210, "frame_number": 24061, "display_filter": "frame.number == 24061", "timestamp_epoch": "1550951414.668766000" }, { "tcp_stream": 210, "frame_number": 24063, "display_filter": "frame.number == 24063", "timestamp_epoch": "1550951414.669937000" }, { "tcp_stream": 210, "frame_number": 24065, "display_filter": "frame.number == 24065", "timestamp_epoch": "1550951414.671112000" }, { "tcp_stream": 210, "frame_number": 24067, "display_filter": "frame.number == 24067", "timestamp_epoch": "1550951414.672478000" }, { "tcp_stream": 210, "frame_number": 24069, "display_filter": "frame.number == 24069", "timestamp_epoch": "1550951414.673809000" }, { "tcp_stream": 210, "frame_number": 24071, "display_filter": "frame.number == 24071", "timestamp_epoch": "1550951414.678022000" }, { "tcp_stream": 210, "frame_number": 24073, "display_filter": "frame.number == 24073", "timestamp_epoch": "1550951414.679378000" }, { "tcp_stream": 210, "frame_number": 24075, "display_filter": "frame.number == 24075", "timestamp_epoch": "1550951414.680580000" }, { "tcp_stream": 210, "frame_number": 24077, "display_filter": "frame.number == 24077", "timestamp_epoch": "1550951414.681689000" }, { "tcp_stream": 210, "frame_number": 24079, "display_filter": "frame.number == 24079", "timestamp_epoch": "1550951414.682842000" }, { "tcp_stream": 210, "frame_number": 24082, "display_filter": "frame.number == 24082", "timestamp_epoch": "1550951414.684520000" }, { "tcp_stream": 210, "frame_number": 24084, "display_filter": "frame.number == 24084", "timestamp_epoch": "1550951414.686054000" }, { "tcp_stream": 210, "frame_number": 24086, "display_filter": "frame.number == 24086", "timestamp_epoch": "1550951414.687475000" }, { "tcp_stream": 210, "frame_number": 24088, "display_filter": "frame.number == 24088", "timestamp_epoch": "1550951414.689122000" }, { "tcp_stream": 210, "frame_number": 24090, "display_filter": "frame.number == 24090", "timestamp_epoch": "1550951414.691763000" }, { "tcp_stream": 210, "frame_number": 24092, "display_filter": "frame.number == 24092", "timestamp_epoch": "1550951414.693472000" }, { "tcp_stream": 210, "frame_number": 24094, "display_filter": "frame.number == 24094", "timestamp_epoch": "1550951414.694759000" }, { "tcp_stream": 210, "frame_number": 24096, "display_filter": "frame.number == 24096", "timestamp_epoch": "1550951414.695963000" }, { "tcp_stream": 210, "frame_number": 24098, "display_filter": "frame.number == 24098", "timestamp_epoch": "1550951414.697062000" }, { "tcp_stream": 210, "frame_number": 24100, "display_filter": "frame.number == 24100", "timestamp_epoch": "1550951414.698389000" }, { "tcp_stream": 210, "frame_number": 24102, "display_filter": "frame.number == 24102", "timestamp_epoch": "1550951414.699452000" }, { "tcp_stream": 210, "frame_number": 24104, "display_filter": "frame.number == 24104", "timestamp_epoch": "1550951414.700421000" }, { "tcp_stream": 210, "frame_number": 24106, "display_filter": "frame.number == 24106", "timestamp_epoch": "1550951414.701469000" }, { "tcp_stream": 210, "frame_number": 24108, "display_filter": "frame.number == 24108", "timestamp_epoch": "1550951414.702597000" }, { "tcp_stream": 210, "frame_number": 24110, "display_filter": "frame.number == 24110", "timestamp_epoch": "1550951414.703618000" }, { "tcp_stream": 210, "frame_number": 24112, "display_filter": "frame.number == 24112", "timestamp_epoch": "1550951414.705153000" }, { "tcp_stream": 210, "frame_number": 24114, "display_filter": "frame.number == 24114", "timestamp_epoch": "1550951414.706132000" }, { "tcp_stream": 210, "frame_number": 24116, "display_filter": "frame.number == 24116", "timestamp_epoch": "1550951414.707168000" }, { "tcp_stream": 210, "frame_number": 24118, "display_filter": "frame.number == 24118", "timestamp_epoch": "1550951414.708263000" }, { "tcp_stream": 210, "frame_number": 24120, "display_filter": "frame.number == 24120", "timestamp_epoch": "1550951414.709352000" }, { "tcp_stream": 210, "frame_number": 24122, "display_filter": "frame.number == 24122", "timestamp_epoch": "1550951414.710591000" }, { "tcp_stream": 210, "frame_number": 24124, "display_filter": "frame.number == 24124", "timestamp_epoch": "1550951414.711662000" }, { "tcp_stream": 210, "frame_number": 24126, "display_filter": "frame.number == 24126", "timestamp_epoch": "1550951414.712609000" }, { "tcp_stream": 210, "frame_number": 24128, "display_filter": "frame.number == 24128", "timestamp_epoch": "1550951414.713680000" }, { "tcp_stream": 210, "frame_number": 24130, "display_filter": "frame.number == 24130", "timestamp_epoch": "1550951414.714731000" }, { "tcp_stream": 210, "frame_number": 24132, "display_filter": "frame.number == 24132", "timestamp_epoch": "1550951414.715124000" }, { "tcp_stream": 210, "frame_number": 24134, "display_filter": "frame.number == 24134", "timestamp_epoch": "1550951414.715473000" }, { "tcp_stream": 211, "frame_number": 24144, "display_filter": "frame.number == 24144", "timestamp_epoch": "1550951414.751946000" }, { "tcp_stream": 211, "frame_number": 24149, "display_filter": "frame.number == 24149", "timestamp_epoch": "1550951414.753529000" }, { "tcp_stream": 211, "frame_number": 24151, "display_filter": "frame.number == 24151", "timestamp_epoch": "1550951414.754024000" }, { "tcp_stream": 211, "frame_number": 24153, "display_filter": "frame.number == 24153", "timestamp_epoch": "1550951414.754367000" }, { "tcp_stream": 211, "frame_number": 24155, "display_filter": "frame.number == 24155", "timestamp_epoch": "1550951414.754705000" }, { "tcp_stream": 211, "frame_number": 24158, "display_filter": "frame.number == 24158", "timestamp_epoch": "1550951414.756088000" }, { "tcp_stream": 211, "frame_number": 24161, "display_filter": "frame.number == 24161", "timestamp_epoch": "1550951414.758710000" }, { "tcp_stream": 211, "frame_number": 24163, "display_filter": "frame.number == 24163", "timestamp_epoch": "1550951414.759048000" }, { "tcp_stream": 211, "frame_number": 24165, "display_filter": "frame.number == 24165", "timestamp_epoch": "1550951414.759358000" }, { "tcp_stream": 211, "frame_number": 24168, "display_filter": "frame.number == 24168", "timestamp_epoch": "1550951414.759892000" }, { "tcp_stream": 211, "frame_number": 24171, "display_filter": "frame.number == 24171", "timestamp_epoch": "1550951414.760478000" }, { "tcp_stream": 211, "frame_number": 24173, "display_filter": "frame.number == 24173", "timestamp_epoch": "1550951414.760760000" }, { "tcp_stream": 211, "frame_number": 24175, "display_filter": "frame.number == 24175", "timestamp_epoch": "1550951414.761036000" }, { "tcp_stream": 211, "frame_number": 24178, "display_filter": "frame.number == 24178", "timestamp_epoch": "1550951414.761542000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-b4bfd98118d369fcd9be3b8a", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.2.23.231", "protocol": "drsuapi", "destination": "10.2.23.2", "event_count": 14, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 6, "frame_number": 129, "display_filter": "frame.number == 129", "timestamp_epoch": "1550949877.428527000" }, { "tcp_stream": 6, "frame_number": 131, "display_filter": "frame.number == 131", "timestamp_epoch": "1550949877.432273000" }, { "tcp_stream": 6, "frame_number": 133, "display_filter": "frame.number == 133", "timestamp_epoch": "1550949877.434941000" }, { "tcp_stream": 6, "frame_number": 135, "display_filter": "frame.number == 135", "timestamp_epoch": "1550949877.436366000" }, { "tcp_stream": 44, "frame_number": 857, "display_filter": "frame.number == 857", "timestamp_epoch": "1550949937.320392000" }, { "tcp_stream": 44, "frame_number": 859, "display_filter": "frame.number == 859", "timestamp_epoch": "1550949937.320801000" }, { "tcp_stream": 44, "frame_number": 861, "display_filter": "frame.number == 861", "timestamp_epoch": "1550949937.321703000" }, { "tcp_stream": 44, "frame_number": 863, "display_filter": "frame.number == 863", "timestamp_epoch": "1550949937.322185000" }, { "tcp_stream": 234, "frame_number": 26302, "display_filter": "frame.number == 26302", "timestamp_epoch": "1550951444.026428000" }, { "tcp_stream": 234, "frame_number": 26304, "display_filter": "frame.number == 26304", "timestamp_epoch": "1550951444.026852000" }, { "tcp_stream": 234, "frame_number": 26306, "display_filter": "frame.number == 26306", "timestamp_epoch": "1550951444.027943000" }, { "tcp_stream": 234, "frame_number": 26310, "display_filter": "frame.number == 26310", "timestamp_epoch": "1550951444.029901000" }, { "tcp_stream": 234, "frame_number": 26312, "display_filter": "frame.number == 26312", "timestamp_epoch": "1550951444.030230000" }, { "tcp_stream": 234, "frame_number": 26314, "display_filter": "frame.number == 26314", "timestamp_epoch": "1550951444.030602000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-e3554588354170d80001dad1", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.2.23.231", "protocol": "ldap", "destination": "10.2.23.2", "event_count": 386, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 0, "frame_number": 17, "display_filter": "frame.number == 17", "timestamp_epoch": "1550949876.658499000" }, { "tcp_stream": 0, "frame_number": 52, "display_filter": "frame.number == 52", "timestamp_epoch": "1550949876.702314000" }, { "tcp_stream": 0, "frame_number": 55, "display_filter": "frame.number == 55", "timestamp_epoch": "1550949876.704189000" }, { "tcp_stream": 10, "frame_number": 144, "display_filter": "frame.number == 144", "timestamp_epoch": "1550949877.469989000" }, { "tcp_stream": 10, "frame_number": 161, "display_filter": "frame.number == 161", "timestamp_epoch": "1550949877.474293000" }, { "tcp_stream": 10, "frame_number": 164, "display_filter": "frame.number == 164", "timestamp_epoch": "1550949877.478675000" }, { "tcp_stream": 12, "frame_number": 170, "display_filter": "frame.number == 170", "timestamp_epoch": "1550949877.485116000" }, { "tcp_stream": 12, "frame_number": 173, "display_filter": "frame.number == 173", "timestamp_epoch": "1550949877.486566000" }, { "tcp_stream": 12, "frame_number": 175, "display_filter": "frame.number == 175", "timestamp_epoch": "1550949877.487027000" }, { "tcp_stream": 10, "frame_number": 177, "display_filter": "frame.number == 177", "timestamp_epoch": "1550949877.488245000" }, { "tcp_stream": 12, "frame_number": 263, "display_filter": "frame.number == 263", "timestamp_epoch": "1550949877.580211000" }, { "tcp_stream": 10, "frame_number": 282, "display_filter": "frame.number == 282", "timestamp_epoch": "1550949878.111695000" }, { "tcp_stream": 52, "frame_number": 875, "display_filter": "frame.number == 875", "timestamp_epoch": "1550949937.846826000" }, { "tcp_stream": 52, "frame_number": 890, "display_filter": "frame.number == 890", "timestamp_epoch": "1550949937.864696000" }, { "tcp_stream": 54, "frame_number": 897, "display_filter": "frame.number == 897", "timestamp_epoch": "1550949937.869770000" }, { "tcp_stream": 54, "frame_number": 902, "display_filter": "frame.number == 902", "timestamp_epoch": "1550949937.871074000" }, { "tcp_stream": 54, "frame_number": 907, "display_filter": "frame.number == 907", "timestamp_epoch": "1550949937.871658000" }, { "tcp_stream": 52, "frame_number": 909, "display_filter": "frame.number == 909", "timestamp_epoch": "1550949937.872306000" }, { "tcp_stream": 54, "frame_number": 969, "display_filter": "frame.number == 969", "timestamp_epoch": "1550949937.901822000" }, { "tcp_stream": 52, "frame_number": 973, "display_filter": "frame.number == 973", "timestamp_epoch": "1550949938.417995000" }, { "tcp_stream": 127, "frame_number": 10400, "display_filter": "frame.number == 10400", "timestamp_epoch": "1550950710.954530000" }, { "tcp_stream": 127, "frame_number": 10405, "display_filter": "frame.number == 10405", "timestamp_epoch": "1550950710.960943000" }, { "tcp_stream": 127, "frame_number": 10408, "display_filter": "frame.number == 10408", "timestamp_epoch": "1550950710.978235000" }, { "tcp_stream": 127, "frame_number": 10410, "display_filter": "frame.number == 10410", "timestamp_epoch": "1550950710.979760000" }, { "tcp_stream": 127, "frame_number": 10412, "display_filter": "frame.number == 10412", "timestamp_epoch": "1550950710.981504000" }, { "tcp_stream": 127, "frame_number": 10414, "display_filter": "frame.number == 10414", "timestamp_epoch": "1550950710.982082000" }, { "tcp_stream": 127, "frame_number": 10619, "display_filter": "frame.number == 10619", "timestamp_epoch": "1550950711.059166000" }, { "tcp_stream": 127, "frame_number": 11101, "display_filter": "frame.number == 11101", "timestamp_epoch": "1550950716.106342000" }, { "tcp_stream": 155, "frame_number": 11266, "display_filter": "frame.number == 11266", "timestamp_epoch": "1550950724.594943000" }, { "tcp_stream": 155, "frame_number": 11283, "display_filter": "frame.number == 11283", "timestamp_epoch": "1550950724.599570000" }, { "tcp_stream": 155, "frame_number": 11286, "display_filter": "frame.number == 11286", "timestamp_epoch": "1550950724.600293000" }, { "tcp_stream": 155, "frame_number": 11288, "display_filter": "frame.number == 11288", "timestamp_epoch": "1550950724.600604000" }, { "tcp_stream": 155, "frame_number": 11299, "display_filter": "frame.number == 11299", "timestamp_epoch": "1550950724.704722000" }, { "tcp_stream": 155, "frame_number": 11310, "display_filter": "frame.number == 11310", "timestamp_epoch": "1550950724.813345000" }, { "tcp_stream": 155, "frame_number": 11318, "display_filter": "frame.number == 11318", "timestamp_epoch": "1550950724.815360000" }, { "tcp_stream": 155, "frame_number": 11327, "display_filter": "frame.number == 11327", "timestamp_epoch": "1550950724.817949000" }, { "tcp_stream": 155, "frame_number": 11330, "display_filter": "frame.number == 11330", "timestamp_epoch": "1550950724.818459000" }, { "tcp_stream": 155, "frame_number": 11332, "display_filter": "frame.number == 11332", "timestamp_epoch": "1550950724.819211000" }, { "tcp_stream": 210, "frame_number": 24020, "display_filter": "frame.number == 24020", "timestamp_epoch": "1550951414.633128000" }, { "tcp_stream": 210, "frame_number": 24025, "display_filter": "frame.number == 24025", "timestamp_epoch": "1550951414.636529000" }, { "tcp_stream": 210, "frame_number": 24028, "display_filter": "frame.number == 24028", "timestamp_epoch": "1550951414.640672000" }, { "tcp_stream": 210, "frame_number": 24030, "display_filter": "frame.number == 24030", "timestamp_epoch": "1550951414.645255000" }, { "tcp_stream": 210, "frame_number": 24032, "display_filter": "frame.number == 24032", "timestamp_epoch": "1550951414.648403000" }, { "tcp_stream": 210, "frame_number": 24034, "display_filter": "frame.number == 24034", "timestamp_epoch": "1550951414.649897000" }, { "tcp_stream": 210, "frame_number": 24036, "display_filter": "frame.number == 24036", "timestamp_epoch": "1550951414.651148000" }, { "tcp_stream": 210, "frame_number": 24038, "display_filter": "frame.number == 24038", "timestamp_epoch": "1550951414.652294000" }, { "tcp_stream": 210, "frame_number": 24040, "display_filter": "frame.number == 24040", "timestamp_epoch": "1550951414.653403000" }, { "tcp_stream": 210, "frame_number": 24042, "display_filter": "frame.number == 24042", "timestamp_epoch": "1550951414.654530000" }, { "tcp_stream": 210, "frame_number": 24044, "display_filter": "frame.number == 24044", "timestamp_epoch": "1550951414.655745000" }, { "tcp_stream": 210, "frame_number": 24046, "display_filter": "frame.number == 24046", "timestamp_epoch": "1550951414.657102000" }, { "tcp_stream": 210, "frame_number": 24048, "display_filter": "frame.number == 24048", "timestamp_epoch": "1550951414.658222000" }, { "tcp_stream": 210, "frame_number": 24050, "display_filter": "frame.number == 24050", "timestamp_epoch": "1550951414.659212000" }, { "tcp_stream": 210, "frame_number": 24052, "display_filter": "frame.number == 24052", "timestamp_epoch": "1550951414.661931000" }, { "tcp_stream": 210, "frame_number": 24054, "display_filter": "frame.number == 24054", "timestamp_epoch": "1550951414.663580000" }, { "tcp_stream": 210, "frame_number": 24056, "display_filter": "frame.number == 24056", "timestamp_epoch": "1550951414.665089000" }, { "tcp_stream": 210, "frame_number": 24058, "display_filter": "frame.number == 24058", "timestamp_epoch": "1550951414.666489000" }, { "tcp_stream": 210, "frame_number": 24060, "display_filter": "frame.number == 24060", "timestamp_epoch": "1550951414.668397000" }, { "tcp_stream": 210, "frame_number": 24062, "display_filter": "frame.number == 24062", "timestamp_epoch": "1550951414.669712000" }, { "tcp_stream": 210, "frame_number": 24064, "display_filter": "frame.number == 24064", "timestamp_epoch": "1550951414.670888000" }, { "tcp_stream": 210, "frame_number": 24066, "display_filter": "frame.number == 24066", "timestamp_epoch": "1550951414.672175000" }, { "tcp_stream": 210, "frame_number": 24068, "display_filter": "frame.number == 24068", "timestamp_epoch": "1550951414.673525000" }, { "tcp_stream": 210, "frame_number": 24070, "display_filter": "frame.number == 24070", "timestamp_epoch": "1550951414.674964000" }, { "tcp_stream": 210, "frame_number": 24072, "display_filter": "frame.number == 24072", "timestamp_epoch": "1550951414.678998000" }, { "tcp_stream": 210, "frame_number": 24074, "display_filter": "frame.number == 24074", "timestamp_epoch": "1550951414.680197000" }, { "tcp_stream": 210, "frame_number": 24076, "display_filter": "frame.number == 24076", "timestamp_epoch": "1550951414.681335000" }, { "tcp_stream": 210, "frame_number": 24078, "display_filter": "frame.number == 24078", "timestamp_epoch": "1550951414.682451000" }, { "tcp_stream": 210, "frame_number": 24080, "display_filter": "frame.number == 24080", "timestamp_epoch": "1550951414.683999000" }, { "tcp_stream": 210, "frame_number": 24083, "display_filter": "frame.number == 24083", "timestamp_epoch": "1550951414.685714000" }, { "tcp_stream": 210, "frame_number": 24085, "display_filter": "frame.number == 24085", "timestamp_epoch": "1550951414.687108000" }, { "tcp_stream": 210, "frame_number": 24087, "display_filter": "frame.number == 24087", "timestamp_epoch": "1550951414.688623000" }, { "tcp_stream": 210, "frame_number": 24089, "display_filter": "frame.number == 24089", "timestamp_epoch": "1550951414.691215000" }, { "tcp_stream": 210, "frame_number": 24091, "display_filter": "frame.number == 24091", "timestamp_epoch": "1550951414.693237000" }, { "tcp_stream": 210, "frame_number": 24093, "display_filter": "frame.number == 24093", "timestamp_epoch": "1550951414.694565000" }, { "tcp_stream": 210, "frame_number": 24095, "display_filter": "frame.number == 24095", "timestamp_epoch": "1550951414.695779000" }, { "tcp_stream": 210, "frame_number": 24097, "display_filter": "frame.number == 24097", "timestamp_epoch": "1550951414.696903000" }, { "tcp_stream": 210, "frame_number": 24099, "display_filter": "frame.number == 24099", "timestamp_epoch": "1550951414.698186000" }, { "tcp_stream": 210, "frame_number": 24101, "display_filter": "frame.number == 24101", "timestamp_epoch": "1550951414.699267000" }, { "tcp_stream": 210, "frame_number": 24103, "display_filter": "frame.number == 24103", "timestamp_epoch": "1550951414.700262000" }, { "tcp_stream": 210, "frame_number": 24105, "display_filter": "frame.number == 24105", "timestamp_epoch": "1550951414.701311000" }, { "tcp_stream": 210, "frame_number": 24107, "display_filter": "frame.number == 24107", "timestamp_epoch": "1550951414.702448000" }, { "tcp_stream": 210, "frame_number": 24109, "display_filter": "frame.number == 24109", "timestamp_epoch": "1550951414.703473000" }, { "tcp_stream": 210, "frame_number": 24111, "display_filter": "frame.number == 24111", "timestamp_epoch": "1550951414.704398000" }, { "tcp_stream": 210, "frame_number": 24113, "display_filter": "frame.number == 24113", "timestamp_epoch": "1550951414.705955000" }, { "tcp_stream": 210, "frame_number": 24115, "display_filter": "frame.number == 24115", "timestamp_epoch": "1550951414.706992000" }, { "tcp_stream": 210, "frame_number": 24117, "display_filter": "frame.number == 24117", "timestamp_epoch": "1550951414.708061000" }, { "tcp_stream": 210, "frame_number": 24119, "display_filter": "frame.number == 24119", "timestamp_epoch": "1550951414.709133000" }, { "tcp_stream": 210, "frame_number": 24121, "display_filter": "frame.number == 24121", "timestamp_epoch": "1550951414.710403000" }, { "tcp_stream": 210, "frame_number": 24123, "display_filter": "frame.number == 24123", "timestamp_epoch": "1550951414.711483000" }, { "tcp_stream": 210, "frame_number": 24125, "display_filter": "frame.number == 24125", "timestamp_epoch": "1550951414.712454000" }, { "tcp_stream": 210, "frame_number": 24127, "display_filter": "frame.number == 24127", "timestamp_epoch": "1550951414.713497000" }, { "tcp_stream": 210, "frame_number": 24129, "display_filter": "frame.number == 24129", "timestamp_epoch": "1550951414.714528000" }, { "tcp_stream": 210, "frame_number": 24131, "display_filter": "frame.number == 24131", "timestamp_epoch": "1550951414.714909000" }, { "tcp_stream": 210, "frame_number": 24133, "display_filter": "frame.number == 24133", "timestamp_epoch": "1550951414.715319000" }, { "tcp_stream": 211, "frame_number": 24142, "display_filter": "frame.number == 24142", "timestamp_epoch": "1550951414.751756000" }, { "tcp_stream": 211, "frame_number": 24147, "display_filter": "frame.number == 24147", "timestamp_epoch": "1550951414.752929000" }, { "tcp_stream": 211, "frame_number": 24150, "display_filter": "frame.number == 24150", "timestamp_epoch": "1550951414.753869000" }, { "tcp_stream": 211, "frame_number": 24152, "display_filter": "frame.number == 24152", "timestamp_epoch": "1550951414.754192000" }, { "tcp_stream": 211, "frame_number": 24154, "display_filter": "frame.number == 24154", "timestamp_epoch": "1550951414.754576000" }, { "tcp_stream": 211, "frame_number": 24156, "display_filter": "frame.number == 24156", "timestamp_epoch": "1550951414.754878000" }, { "tcp_stream": 211, "frame_number": 24160, "display_filter": "frame.number == 24160", "timestamp_epoch": "1550951414.757907000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-04114e2d346ff58c70ade481", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Credential-shaped records in a cleartext HTTP request", "status": "candidate", "metrics": { "source": "10.2.23.231", "body_sha256": "d95a35fac8425ed6c010066a81b4330ade8dd325713e077d67fcfd33e7cafcac", "destination": "190.146.112.216", "body_size_bytes": 262, "secrets_redacted": true }, "rule_id": "sensitive-data-in-cleartext", "evidence": [ { "tcp_stream": 208, "frame_number": 23816, "display_filter": "frame.number == 23816", "timestamp_epoch": "1550951355.921398000" } ], "severity": "high", "confidence": 0.95, "finding_id": "finding-1ba21054ed92beb68817dd71", "explanation": "The decoded request body contains a credential-record structure or private-key marker. Values are redacted from derived evidence. This proves transmission of the observed structure, not that a credential is valid or how it was obtained.", "rule_version": "pcap-rules-v5" }, { "title": "System-inventory structure transmitted in HTTP body", "status": "candidate", "metrics": { "source": "10.2.23.231", "body_sha256": "77ab5e18a4c52fe1b402ca8907ad3315c19e1fb7ed19aaa03f1fb3070cd286b1", "destination": "190.146.112.216", "claimed_identities": [ { "type": "hostname", "value": "Ferguson-Win-PC", "source": "explicit-body-label" }, { "type": "account", "value": "ruby.ferguson", "source": "explicit-body-label" } ] }, "rule_id": "system-inventory-upload", "evidence": [ { "tcp_stream": 237, "frame_number": 26591, "display_filter": "frame.number == 26591", "timestamp_epoch": "1550951444.371220000" } ], "severity": "medium", "confidence": 0.9, "finding_id": "finding-28c6ca5e894af81710043f04", "explanation": "A request body contains process/system inventory markers and may include host/account assertions. This is network-observed transmission, not proof of the commands having executed on that host.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "2a5ae5050a02bf3477c21a609a0f7b80", "sha1": "a0bcf06358319c190dfe6a8d979e185020e5af04", "type": "http-exported-object", "sha256": "f1b789be1126b557240dd0dfe98fc5f3ad6341bb1a5d8be0a954f65b486ad32a", "evidence": [ { "tcp_stream": 110, "frame_number": 11971, "display_filter": "frame.number == 11971", "timestamp_epoch": "1550950744.087696000" } ], "filename": "Tinx86_14.exe", "filenames": [ "Tinx86_14.exe" ], "transfers": [ { "url": "http://46.249.62.199/Tinx86_14.exe", "client_ip": "10.2.23.231", "server_ip": "46.249.62.199", "tcp_stream": 110, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6249, "response_frame": 11971 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2818560, "artifact_id": "artifact-bc3e0c0ff9381dba43f4d332", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "47b497cae96da976cc40c4b428bdedfb", "sha1": "4cf5574d9dec1d3684784f181782a7885656eeb2", "type": "http-exported-object", "sha256": "63e2dc2b85defb87378e12ecd7d0f4631d37fcf42152acf2a28ae7453b40633c", "evidence": [ { "tcp_stream": 82, "frame_number": 2049, "display_filter": "frame.number == 2049", "timestamp_epoch": "1550950018.735133000" } ], "filename": "common-c2a92195cbc0a2d6aed1-min.en-US.js", "filenames": [ "common-c2a92195cbc0a2d6aed1-min.en-US.js" ], "transfers": [ { "url": "http://static.squarespace.com/universal/scripts-compressed/common-c2a92195cbc0a2d6aed1-min.en-US.js", "client_ip": "10.2.23.109", "server_ip": "151.101.64.238", "tcp_stream": 82, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1433, "response_frame": 2049 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 1841388, "artifact_id": "artifact-17453bd1bdc062e33e00d9a7", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 85551, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "26a97b078e5c6bfaf5170a6520c786bf", "sha1": "5240075708299993915fe76197d33b0976755435", "type": "http-exported-object", "sha256": "38c6c5b8d6fa71d9856758a5c0c2ac9d0a0a1450f75bb1004dd988e23d73a312", "evidence": [ { "tcp_stream": 150, "frame_number": 12777, "display_filter": "frame.number == 12777", "timestamp_epoch": "1550950769.154035000" } ], "filename": "win.png", "filenames": [ "win.png" ], "transfers": [ { "url": "http://85.143.218.7/win.png", "client_ip": "10.2.23.231", "server_ip": "85.143.218.7", "tcp_stream": 150, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 10966, "response_frame": 12777 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 270336, "artifact_id": "artifact-a44db5d69b9bc8f3fdaaff4e", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2684f88431df44a9e096890a8a552a67", "sha1": "fb513aa01475b6a4847dad0fa0011502b43335ce", "type": "http-exported-object", "sha256": "3abae6dd2ddae23b2de2ccbcc160a4a5773bef8934d0e6896d50197c3d3c417f", "evidence": [ { "tcp_stream": 200, "frame_number": 20903, "display_filter": "frame.number == 20903", "timestamp_epoch": "1550950987.637616000" } ], "filename": "sin.png", "filenames": [ "sin.png" ], "transfers": [ { "url": "http://85.143.218.7/sin.png", "client_ip": "10.2.23.231", "server_ip": "85.143.218.7", "tcp_stream": 200, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 20146, "response_frame": 20903 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 270336, "artifact_id": "artifact-64c04b868e21280de7169f44", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0f7e98a8980410bfd81158598dff11b6", "sha1": "e3591fc815429040edfc1627101aa6f65dbf97e3", "type": "http-exported-object", "sha256": "4c957072ab097d3474039f432466cd251d1dc7d91559b76d4e5ead4a8bd499d5", "evidence": [ { "tcp_stream": 161, "frame_number": 13356, "display_filter": "frame.number == 13356", "timestamp_epoch": "1550950790.090739000" } ], "filename": "tin.png", "filenames": [ "tin.png" ], "transfers": [ { "url": "http://85.143.218.7/tin.png", "client_ip": "10.2.23.231", "server_ip": "85.143.218.7", "tcp_stream": 161, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 11986, "response_frame": 13356 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 270336, "artifact_id": "artifact-c300c6cc1195496e5d11e6e0", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "901a99ca72a48f3a067886b158db217e", "sha1": "cce0b8b2580ba4c49e5744ce96c324dcfbca9de6", "type": "http-exported-object", "sha256": "d43159c8bf2e1bd866abdbb1687911e2282b1f98a7c063f85ffd53a7f51efed4", "evidence": [ { "tcp_stream": 109, "frame_number": 6800, "display_filter": "frame.number == 6800", "timestamp_epoch": "1550950432.567344000" } ], "filename": "Sw9JKmXqaSj.exe", "filenames": [ "Sw9JKmXqaSj.exe" ], "transfers": [ { "url": "http://46.249.62.199/Sw9JKmXqaSj.exe", "client_ip": "10.2.23.231", "server_ip": "46.249.62.199", "tcp_stream": 109, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6262, "response_frame": 6800 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 168448, "artifact_id": "artifact-2a57148deacdd09c06651c07", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 168448, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 168448, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c9d7cca380a983bae2170e159b0eef5d", "sha1": "559a05242fd61714da79c5d95c67b8e9edfec616", "type": "http-exported-object", "sha256": "8cf2cddda8522975a22da3da429339be471234eacc0e11c099d6dcb732cf3cbb", "evidence": [ { "tcp_stream": 105, "frame_number": 3542, "display_filter": "frame.number == 3542", "timestamp_epoch": "1550950040.342832000" } ], "filename": "troll1.jpg", "filenames": [ "troll1.jpg" ], "transfers": [ { "url": "http://209.141.55.226/troll1.jpg", "client_ip": "10.2.23.231", "server_ip": "209.141.55.226", "tcp_stream": 105, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 3119, "response_frame": 3542 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 122880, "artifact_id": "artifact-162a2189c16314dce4cad0b7", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 122880, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 122880, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "24711366cca603e1d0773741e08fbb1f", "sha1": "feac0bc666be07a731407aa838df66b75922bc15", "type": "http-exported-object", "sha256": "810151e2aa23d212c5105db84e9eb16a76bb589eacfd4bc5a287a092c2ef71fa", "evidence": [ { "tcp_stream": 76, "frame_number": 1415, "display_filter": "frame.number == 1415", "timestamp_epoch": "1550949990.600699000" } ], "filename": "site.css%3f&filterFeatures=false", "filenames": [ "site.css%3f&filterFeatures=false" ], "transfers": [ { "url": "http://static1.squarespace.com/static/sitecss/53176ac0e4b0cc8a54026440/47/507c1fdf84ae362b5e7be44e/53176ac0e4b0cc8a54026444/2141-05142015/1418412276795/site.css?&filterFeatures=false", "client_ip": "10.2.23.109", "server_ip": "151.101.0.238", "tcp_stream": 76, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1309, "response_frame": 1415 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 548880, "artifact_id": "artifact-3e8796a7d42c01e79cc7f198", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "559ce2401715b9a3bcb160a42cd1200f", "sha1": "7c7bde6c0c1c9a536129f2130f516327cdf1689c", "type": "http-exported-object", "sha256": "351e3c9dadd0128ea718633173e073a6f7a3d9bf6a1ce173bff2221cb3b0afae", "evidence": [ { "tcp_stream": 223, "frame_number": 28116, "display_filter": "frame.number == 28116", "timestamp_epoch": "1550951462.411859000" } ], "filename": "TanyaandJenna.jpg", "filenames": [ "TanyaandJenna.jpg" ], "transfers": [ { "url": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/TanyaandJenna.jpg", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 223, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 25573, "response_frame": 28116 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 227673, "artifact_id": "artifact-487b1b917a40b83e90d5e8dd", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 227673, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 227673, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2277ca2bdab250888d67856d2cc868fa", "sha1": "c7cc509376d1172259b0771ef896fc0013ec16fb", "type": "http-exported-object", "sha256": "d7c9595737524bc5febd4507cbe47457dbd59ce733315f1ada59a91c6754c193", "evidence": [ { "tcp_stream": 216, "frame_number": 26006, "display_filter": "frame.number == 26006", "timestamp_epoch": "1550951440.092420000" } ], "filename": "bootstrap.css", "filenames": [ "bootstrap.css" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/bootstrap.css", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 216, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 24734, "response_frame": 26006 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 128190, "artifact_id": "artifact-e6f88fe8f50fa57c8310e5db", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 128190, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 128190, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5d2c226a9132d1108e759fe53d9e529f", "sha1": "a55b2e8c831f823dec22f94cf40f82deec6d04d9", "type": "http-exported-object", "sha256": "b577d12d1f8eaacf060db96a7b2bcc0009d0c3fd8d4842bd85175a50b2a1f972", "evidence": [ { "tcp_stream": 230, "frame_number": 27968, "display_filter": "frame.number == 27968", "timestamp_epoch": "1550951460.239749000" } ], "filename": "functions.js", "filenames": [ "functions.js" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/functions.js", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 230, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 25149, "response_frame": 27968 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 126945, "artifact_id": "artifact-b80c7e513443ea4c6618bf39", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 126945, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 126945, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cdce6651c76bcdd9ed88e4c28b076730", "sha1": "a75e1d1015f3ec7ea87e94926bb2f01a3421dcc4", "type": "http-exported-object", "sha256": "9801c1c9ecc18a5361fbb2188614518c84837fd23cdcc5dafde214c7efc5ba61", "evidence": [ { "tcp_stream": 226, "frame_number": 26841, "display_filter": "frame.number == 26841", "timestamp_epoch": "1550951447.134923000" } ], "filename": "jquery.js", "filenames": [ "jquery.js" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/jquery.js", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 226, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 25868, "response_frame": 26841 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 95954, "artifact_id": "artifact-a7dfa155cb680f6a0da19855", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 95954, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 95954, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a5be1f0cbaca944ca0dae0cf82f51f54", "sha1": "6823e0d0fee938bb93c17f12fa43a1d444d72048", "type": "http-exported-object", "sha256": "3362bbc3aeca0b9a3e74c27568033c566350d30214cfa383b470327ec2ac8c07", "evidence": [ { "tcp_stream": 226, "frame_number": 27683, "display_filter": "frame.number == 27683", "timestamp_epoch": "1550951457.461120000" } ], "filename": "3A1.png", "filenames": [ "3A1.png" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/3A1.png", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 226, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 26843, "response_frame": 27683 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 83761, "artifact_id": "artifact-a822997ef0276b99d5bb5146", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 83761, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 83761, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5920b7fd7898a7845e4aeaf0238eccff", "sha1": "259b933f29614010306121f3c56c7148bd5bdca7", "type": "http-exported-object", "sha256": "ce3a22f1ccba5bbeebb0a9fd49c3e72fbde9e1816959b67e5b1fb248c1e1041a", "evidence": [ { "tcp_stream": 223, "frame_number": 25448, "display_filter": "frame.number == 25448", "timestamp_epoch": "1550951433.800967000" } ], "filename": "animate.css", "filenames": [ "animate.css" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/animate.css", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 223, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 24828, "response_frame": 25448 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 70788, "artifact_id": "artifact-216d8bbfa23ee53444996157", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 70788, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 70788, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d0262c4a7b9aa062ad00f56782059358", "sha1": "da9282f47d6a4bf9651270587666ed14870cefb4", "type": "http-exported-object", "sha256": "6736e7a0746fbcfef21feae864dda1ae4e888d3ea1d5cea115c71849e47e787a", "evidence": [ { "tcp_stream": 215, "frame_number": 25048, "display_filter": "frame.number == 25048", "timestamp_epoch": "1550951429.284563000" } ], "filename": "%2f(2)", "filenames": [ "%2f(2)" ], "transfers": [ { "url": "http://www.co.utah.ut.us/", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 215, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 24724, "response_frame": 25048 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 61931, "artifact_id": "artifact-d27a637b84000b4f61440b71", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 61931, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 61931, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a26c5f9af9b83c4a718440d6d6163102", "sha1": "2989a8fa647daaaf9e775bc9e0731818d24f563f", "type": "http-exported-object", "sha256": "adc225a50d7a314341a7c857f092b962e3967d4addb7d2b48ff335c7bedad350", "evidence": [ { "tcp_stream": 215, "frame_number": 27118, "display_filter": "frame.number == 27118", "timestamp_epoch": "1550951450.581148000" } ], "filename": "1A1.png", "filenames": [ "1A1.png" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/1A1.png", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 215, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 26237, "response_frame": 27118 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 61552, "artifact_id": "artifact-159395787bbe57c116526118", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 61552, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 61552, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "bb377df27a55c05bb3793cd1e125c869", "sha1": "295d5a7cb802a8058059f6c29dc2491a15a7d55c", "type": "http-exported-object", "sha256": "3c4ec495f17d21cc236bc7238bc02728bd945c07157fbf875cac340269afc207", "evidence": [ { "tcp_stream": 108, "frame_number": 6230, "display_filter": "frame.number == 6230", "timestamp_epoch": "1550950409.157698000" }, { "tcp_stream": 195, "frame_number": 20132, "display_filter": "frame.number == 20132", "timestamp_epoch": "1550950939.798540000" } ], "filename": "authrootstl(1).cab", "filenames": [ "authrootstl(1).cab", "authrootstl.cab" ], "transfers": [ { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "client_ip": "10.2.23.231", "server_ip": "8.253.129.66", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6171, "response_frame": 6230 }, { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "client_ip": "10.2.23.231", "server_ip": "72.21.81.240", "tcp_stream": 195, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 19578, "response_frame": 20132 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 56560, "artifact_id": "artifact-62902e4e32ab123515071153", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 56560, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 56560, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b0e3a7d3bdb70656832bc7c22e67af41", "sha1": "87e6e5840e9f05c94dac0367a4f1e694c49c236f", "type": "http-exported-object", "sha256": "51cd2200fde479b2d57db744c846f9c83dbefe967e10efa510a0eecf644ac2ac", "evidence": [ { "tcp_stream": 219, "frame_number": 25411, "display_filter": "frame.number == 25411", "timestamp_epoch": "1550951433.295385000" } ], "filename": "dark.css", "filenames": [ "dark.css" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/dark.css", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 219, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 25099, "response_frame": 25411 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 55948, "artifact_id": "artifact-d17dc412a72c05a9649e3331", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 55948, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 55948, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e5bf7b8920538bed0bdbe2812679908f", "sha1": "787c5fc4f3d2dc30abb50cb90fa08cd5ac8fdbbd", "type": "http-exported-object", "sha256": "152f05b79c5f8ae61dce111c5415be105396ad820f3fc3cd537b0aaa2acd8d58", "evidence": [ { "tcp_stream": 76, "frame_number": 1307, "display_filter": "frame.number == 1307", "timestamp_epoch": "1550949988.156805000" } ], "filename": "%3fformat=1500w", "filenames": [ "%3fformat=1500w" ], "transfers": [ { "url": "http://static1.squarespace.com/static/53176ac0e4b0cc8a54026440/t/53597593e4b0bb8f10e2db9a/1503949442424/?format=1500w", "client_ip": "10.2.23.109", "server_ip": "151.101.0.238", "tcp_stream": 76, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1219, "response_frame": 1307 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 47031, "artifact_id": "artifact-ef2b7c4780e0b66c64364e41", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 47031, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 47031, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "653a8449bd2e6e672d38e6eb87b81d74", "sha1": "d6b8c4c5e3ba1e53d81ba4bbb1df5cb6047cfb41", "type": "http-exported-object", "sha256": "f0c4a8877fe0d8ed1f7350d20d476d37601fb6c6119eb986fce4d8ae2852061c", "evidence": [ { "tcp_stream": 224, "frame_number": 25568, "display_filter": "frame.number == 25568", "timestamp_epoch": "1550951434.984084000" } ], "filename": "responsive.css", "filenames": [ "responsive.css" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/responsive.css", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 224, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 24829, "response_frame": 25568 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 43468, "artifact_id": "artifact-b52ce2ba9dfea4e93efac6b0", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 43468, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 43468, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0fdaa78419da86faa734408deee4d12b", "sha1": "34ad516ef6f5602be5d399fb4d5bb91ed82ae0a0", "type": "http-exported-object", "sha256": "17ef1c0ff8515ab325b5976632264553118a2618e5e8dcf3ff058dee515ab738", "evidence": [ { "tcp_stream": 238, "frame_number": 27246, "display_filter": "frame.number == 27246", "timestamp_epoch": "1550951452.196595000" } ], "filename": "StormWater1.png", "filenames": [ "StormWater1.png" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/StormWater1.png", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 238, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 27072, "response_frame": 27246 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 34595, "artifact_id": "artifact-da6725cb22939d52177d7fa4", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 34595, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 34595, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "96ab8de32fb8dd16d6feb09f7e09bcc2", "sha1": "dc572a54d4ce7cfb45fd9d0846257cec8d2be42d", "type": "http-exported-object", "sha256": "fbf3439d0eb209ab2bdf6794da01485836e5bb0910c4624ac2d43dead3ff10d9", "evidence": [ { "tcp_stream": 238, "frame_number": 27070, "display_filter": "frame.number == 27070", "timestamp_epoch": "1550951449.805659000" } ], "filename": "7ABurn1.png", "filenames": [ "7ABurn1.png" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/7ABurn1.png", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 238, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 26945, "response_frame": 27070 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 32241, "artifact_id": "artifact-d48b4c7cee579194ec01b58e", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 32241, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 32241, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "62fb51e9e645f63599238881b9de15dd", "sha1": "82b144e3c8b4ff40aeca34ddf7bc35985311b90e", "type": "http-exported-object", "sha256": "5aeb07f9980663c2501c9620371e11ae7aa6e320d94dd753d0ef56d8308c74b3", "evidence": [ { "tcp_stream": 94, "frame_number": 2779, "display_filter": "frame.number == 2779", "timestamp_epoch": "1550950024.656101000" } ], "filename": "S6uyw4BMUTPHjx4wWA.woff", "filenames": [ "S6uyw4BMUTPHjx4wWA.woff" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/lato/v14/S6uyw4BMUTPHjx4wWA.woff", "client_ip": "10.2.23.109", "server_ip": "172.217.2.3", "tcp_stream": 94, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 2107, "response_frame": 2779 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 28412, "artifact_id": "artifact-a1badea2223c5f9783fdb694", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 28412, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 28412, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d1de5e9e4bc27c76ad57191addf1ff42", "sha1": "0278dcd021f6cb4c1fc7e24e833ae258b0e0cd6c", "type": "http-exported-object", "sha256": "6ee67e7ec3881929e6d6f2bf4e761fb44d04b84b5e77f1df7ef3c05a698484ee", "evidence": [ { "tcp_stream": 74, "frame_number": 1210, "display_filter": "frame.number == 1210", "timestamp_epoch": "1550949986.103590000" } ], "filename": "%2f(1)", "filenames": [ "%2f(1)" ], "transfers": [ { "url": "http://www.rootscafeslc.com/", "client_ip": "10.2.23.109", "server_ip": "198.185.159.135", "tcp_stream": 74, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1197, "response_frame": 1210 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 27975, "artifact_id": "artifact-1bf9941e6838439ae9eb96e1", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 27975, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 27975, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "752c20224144760a496fb9e19a62f616", "sha1": "975f17fad3d9d4e0ead06edbaade619ecb1b7dc3", "type": "http-exported-object", "sha256": "6281f4b88789d78a3520cea62298a5d76562a5ac5a265c915f58ab46e90773bf", "evidence": [ { "tcp_stream": 95, "frame_number": 2511, "display_filter": "frame.number == 2511", "timestamp_epoch": "1550950022.640892000" } ], "filename": "S6u8w4BMUTPHh30AXC-s.woff", "filenames": [ "S6u8w4BMUTPHh30AXC-s.woff" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/lato/v14/S6u8w4BMUTPHh30AXC-s.woff", "client_ip": "10.2.23.109", "server_ip": "172.217.2.3", "tcp_stream": 95, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 2105, "response_frame": 2511 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 26860, "artifact_id": "artifact-254142681b57f8c3dd0a5147", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 26860, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 26860, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0ae651d6e3052e89daa7bb4f92d687aa", "sha1": "478694a7e3f5defea644011eb9121a4acb3df742", "type": "http-exported-object", "sha256": "df5f5ce34c9cf3edd665586295e356d6b56d9ef3e54614001f4b178217ec92fe", "evidence": [ { "tcp_stream": 229, "frame_number": 25503, "display_filter": "frame.number == 25503", "timestamp_epoch": "1550951434.212345000" } ], "filename": "default.jpg", "filenames": [ "default.jpg" ], "transfers": [ { "url": "http://www.co.utah.ut.us/Dept/COMMISH/Data/WNData/default.jpg", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 229, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 25234, "response_frame": 25503 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 25595, "artifact_id": "artifact-4c6c718bbf624d44d4d4dba5", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 25595, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 25595, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "758f83d51db495e1298817635f638ff7", "sha1": "c9fa542f5352d73599dee2f2ca2b72d205fa198f", "type": "http-exported-object", "sha256": "ed001f8b45a9191508e79be37b5a0003faaf3bc356eb241fe11f2b56ab9f60ae", "evidence": [ { "tcp_stream": 215, "frame_number": 26101, "display_filter": "frame.number == 26101", "timestamp_epoch": "1550951441.282231000" } ], "filename": "Opiate_ProvoTownHall.jpg", "filenames": [ "Opiate_ProvoTownHall.jpg" ], "transfers": [ { "url": "http://www.co.utah.ut.us/Images1/custom/Opiate_ProvoTownHall.jpg", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 215, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 25168, "response_frame": 26101 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 24715, "artifact_id": "artifact-661d43b19fc0c659e67f78e2", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 24715, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 24715, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "ceb79595334295200b49af81e3f36d5c", "sha1": "e1094279be16e3c2f17bdd1fa950e346af985046", "type": "http-exported-object", "sha256": "640994b0bf9615de96e00f0344d84c56ff04eff2f47e99ebf0c9ea7fa6ba3502", "evidence": [ { "tcp_stream": 83, "frame_number": 1594, "display_filter": "frame.number == 1594", "timestamp_epoch": "1550950001.311240000" } ], "filename": "qtSfIe0hWL1wtEbIsJFPUsITCi0N4DUQd5Tzt0wJ8s6feGw2fFHN4UJLFRbh52jhWD9DwQShjAw3ZQsKweFR5eIuF2MkFRbXwgTuiaiaO14zdasDjhBcZWFCjkoRdhXCScNziYFRjAZ8ShUROcFzdPUCiAoTdkuqZWZ8deN3dAm0ifuE-QJUO1FUiABkZWF3jAF8OcFzdP37OcUudc8zOAs8icmCdaglZAoXOWTTwRI0SaBujW48Sagyjh90.js", "filenames": [ "qtSfIe0hWL1wtEbIsJFPUsITCi0N4DUQd5Tzt0wJ8s6feGw2fFHN4UJLFRbh52jhWD9DwQShjAw3ZQsKweFR5eIuF2MkFRbXwgTuiaiaO14zdasDjhBcZWFCjkoRdhXCScNziYFRjAZ8ShUROcFzdPUCiAoTdkuqZWZ8deN3dAm0ifuE-QJUO1FUiABkZWF3jAF8OcFzdP37OcUudc8zOAs8icmCdaglZAoXOWTTwRI0SaBujW48Sagyjh90.js" ], "transfers": [ { "url": "http://use.typekit.net/ik/qtSfIe0hWL1wtEbIsJFPUsITCi0N4DUQd5Tzt0wJ8s6feGw2fFHN4UJLFRbh52jhWD9DwQShjAw3ZQsKweFR5eIuF2MkFRbXwgTuiaiaO14zdasDjhBcZWFCjkoRdhXCScNziYFRjAZ8ShUROcFzdPUCiAoTdkuqZWZ8deN3dAm0ifuE-QJUO1FUiABkZWF3jAF8OcFzdP37OcUudc8zOAs8icmCdaglZAoXOWTTwRI0SaBujW48Sagyjh90jhNlJ6U3ScNt-AuyOAozicIKgcBqZAUCZPG4fHCgIMMjMPMfH6qJtKGbMg62JMJ7fbKzMsMMeMb6MKG4fHXgIMMjgKMfH6qJK3IbMg6YJMJ7fbKTMsMMeM66MKG4f5w7IMMj2PMfH6qJKbIbMg64JMJ7fbK3MsMMeMt6MKG4fHtgIMMjIfMfH6qJRMIbMg6sJMJ7fbK7MsMMegJ6MKG4fJGgIMMjIkMfH6qJXR9bMs62JMJ7fbR5FsMgeMb6MKG4fFIVIMIjgkMfH6qJXD9bMs6FJMJ7fbRVFsMgeMt6MKG4fFJVIMIjIPMf.js", "client_ip": "10.2.23.109", "server_ip": "23.63.25.226", "tcp_stream": 83, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1526, "response_frame": 1594 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 23159, "artifact_id": "artifact-5aef5c3cb5cfd93153fddff6", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23159, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 23159, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e24628d798d1b0043f10a0e423ec7ce7", "sha1": "1d802f842351c7c2b53585641e4b288050845352", "type": "http-exported-object", "sha256": "6b6bf68b59a71f79863bf3b342b6dba38c2dbb76814deea82250c513517ddb19", "evidence": [ { "tcp_stream": 215, "frame_number": 25166, "display_filter": "frame.number == 25166", "timestamp_epoch": "1550951430.604451000" } ], "filename": "swiper.css", "filenames": [ "swiper.css" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/swiper.css", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 215, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 25050, "response_frame": 25166 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 17216, "artifact_id": "artifact-79faa1f02d4f62aad727057a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 17216, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 17216, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c67b9d552989f8cc0bf6e87048d4e77b", "sha1": "f9ac0a7ef2220e94b994a26c54c5f9e38b02cdf7", "type": "http-exported-object", "sha256": "a7325536819e47e298d38720b60ecb4c6ca63ebf07df04e768ee95d92c854e17", "evidence": [ { "tcp_stream": 216, "frame_number": 27155, "display_filter": "frame.number == 27155", "timestamp_epoch": "1550951451.114407000" } ], "filename": "6A1.png", "filenames": [ "6A1.png" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/6A1.png", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 216, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 26868, "response_frame": 27155 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 10536, "artifact_id": "artifact-a386177f36fc47a02b2f1b3b", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 10536, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 10536, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "6235bdeae96aebe0a24cd023e219bd94", "sha1": "17c7f034b3802e13d5ef70dc165d415d74476282", "type": "http-exported-object", "sha256": "aaa1afd7ae3a37dd93a8b19408e2770eaee666932366bf4e1703533148914076", "evidence": [ { "tcp_stream": 223, "frame_number": 25567, "display_filter": "frame.number == 25567", "timestamp_epoch": "1550951434.983996000" } ], "filename": "Martin_Richard.jpg", "filenames": [ "Martin_Richard.jpg" ], "transfers": [ { "url": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/Martin_Richard.jpg", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 223, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 25450, "response_frame": 25567 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/jpeg", "size_bytes": 10185, "artifact_id": "artifact-9d5163079c8f9cb95d9db1b3", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 10185, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 10185, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5cdb7dc28468443358a9f4bd4984d802", "sha1": "0e5b6f9280d1d085d5818d908034d3224b90fe04", "type": "http-exported-object", "sha256": "9a9eef92488fae7c9199a57abe8fe52dfbabfd4884a150cde674f86304748c84", "evidence": [ { "tcp_stream": 229, "frame_number": 25232, "display_filter": "frame.number == 25232", "timestamp_epoch": "1550951431.173059000" } ], "filename": "logo1.png", "filenames": [ "logo1.png" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/logo1.png", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 229, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 25144, "response_frame": 25232 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 9666, "artifact_id": "artifact-60a6e97481fad9d641371b13", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 9666, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 9666, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0b26655a49b4a1b48b59b958b9f6ad86", "sha1": "3a71f6e8b4f87f37a8c6fdd72559334114b163d6", "type": "http-exported-object", "sha256": "7898a2dbfd52591cf085b2743c0f2eaa750143b77a8cfebfbbf23d692bc4d846", "evidence": [ { "tcp_stream": 216, "frame_number": 26865, "display_filter": "frame.number == 26865", "timestamp_epoch": "1550951447.370546000" } ], "filename": "2A1.png", "filenames": [ "2A1.png" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/2A1.png", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 216, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 26243, "response_frame": 26865 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 9151, "artifact_id": "artifact-f2ad19171920cde7a2f7764e", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 9151, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 9151, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f7c253f9171b49b915a3fd26b36e1932", "sha1": "c1bf669190f2489d92b7f73e856293cf30bc1a38", "type": "http-exported-object", "sha256": "6bb03471d2a729fd037bb0f8b42854c3b9d14e87e7bc9b337ed2274a74a0a3c4", "evidence": [ { "tcp_stream": 216, "frame_number": 26022, "display_filter": "frame.number == 26022", "timestamp_epoch": "1550951440.216997000" } ], "filename": "tick.png", "filenames": [ "tick.png" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tick.png", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 216, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 26008, "response_frame": 26022 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 6046, "artifact_id": "artifact-1c83c80862f150f03f0eb2eb", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6046, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 6046, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "fc4e9bde302a81d31ca4bcf63bd61bb0", "sha1": "5403887efa37e08ffe552f57751aa06860529d67", "type": "http-exported-object", "sha256": "f7b0061ce2ceec8a73a0957dc975d2dde0f4de8c0b63c041cd78a29414d2645c", "evidence": [ { "tcp_stream": 216, "frame_number": 26241, "display_filter": "frame.number == 26241", "timestamp_epoch": "1550951443.363403000" } ], "filename": "tools.png", "filenames": [ "tools.png" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tools.png", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 216, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 26024, "response_frame": 26241 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 5968, "artifact_id": "artifact-85a5081bcafbdf75f00eb123", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5968, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5968, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cc01be156d2abc2c131202c8d2261875", "sha1": "0ede7213844d4e442f3195c2704d75fe0a7ceb0d", "type": "http-exported-object", "sha256": "d7b2de7a314f64ab62777494d3f9587dd679d637fd8e68783b68977bbb3df29e", "evidence": [ { "tcp_stream": 215, "frame_number": 26145, "display_filter": "frame.number == 26145", "timestamp_epoch": "1550951442.234915000" } ], "filename": "map.png", "filenames": [ "map.png" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/map.png", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 215, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 26103, "response_frame": 26145 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 5595, "artifact_id": "artifact-18fd505e64bc63366f7e9143", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5595, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5595, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "af816a8b4ed546689ecda897feddf83c", "sha1": "9819afebda4678f3436b99352aa2a467932f6dc1", "type": "http-exported-object", "sha256": "592e7fa07596b36f577e4a703c8614d98c6602b3fbafd6cf94026aadc109ee42", "evidence": [ { "tcp_stream": 215, "frame_number": 26235, "display_filter": "frame.number == 26235", "timestamp_epoch": "1550951443.194829000" } ], "filename": "performance.png", "filenames": [ "performance.png" ], "transfers": [ { "url": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/performance.png", "client_ip": "10.2.23.109", "server_ip": "161.119.42.22", "tcp_stream": 215, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 26147, "response_frame": 26235 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 4680, "artifact_id": "artifact-198d1e533e02f6fc1861b3b9", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 4680, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 4680, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "52c98b79c29a261c44f7de8a51bf06e2", "sha1": "b2ad81cb89cfd9d08f46810bfd74093a53275bc1", "type": "http-exported-object", "sha256": "77ab5e18a4c52fe1b402ca8907ad3315c19e1fb7ed19aaa03f1fb3070cd286b1", "evidence": [], "filename": "90(2)", "filenames": [ "90(2)" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 4678, "artifact_id": "artifact-e350343bbebf3632a8e2fda1", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 4678, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e7081205434e0e55a3a6d5d4ca0c80ec", "sha1": "598ae9c508cbe813cd8c8c3c6082af755259b3ff", "type": "http-exported-object", "sha256": "33c2fde7c0162c50e4450e874c99a13a086a56db266d8962bd7d31bdb08956f3", "evidence": [ { "tcp_stream": 227, "frame_number": 25159, "display_filter": "frame.number == 25159", "timestamp_epoch": "1550951430.561445000" } ], "filename": "css%3ffamily=Lato%3a300,400,400italic,600,700%7cRaleway%3a300,400,500,600,700%7cCrete+Round%3a400italic", "filenames": [ "css%3ffamily=Lato%3a300,400,400italic,600,700%7cRaleway%3a300,400,500,600,700%7cCrete+Round%3a400italic" ], "transfers": [ { "url": "http://fonts.googleapis.com/css?family=Lato:300,400,400italic,600,700|Raleway:300,400,500,600,700|Crete+Round:400italic", "client_ip": "10.2.23.109", "server_ip": "172.217.2.10", "tcp_stream": 227, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 25114, "response_frame": 25159 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2251, "artifact_id": "artifact-9a2e9a48bc55551952ca7e30", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2251, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2251, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "adafbd81515975893dc9272306051f5b", "sha1": "874092de659f67b921ac8305804c56311348d345", "type": "http-exported-object", "sha256": "de799971c904cfabc587484202b8d4bd4b40414ac6b23d1e51b16196bf100013", "evidence": [], "filename": "90", "filenames": [ "90" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2105, "artifact_id": "artifact-d9a03398e372dad11155d700", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2105, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9abd2b10f679c8b6a78b5e9762cdc59e", "sha1": "b78a4a82d53f03792e15ccf95217a53adeffe5d4", "type": "http-exported-object", "sha256": "44373d4e4bea5c974656b41b630eae6519b62aeb4889277034ba7925c01bb60f", "evidence": [], "filename": "RecordHit%3fcrumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi", "filenames": [ "RecordHit%3fcrumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi", "RecordHit%3fcrumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi(2)" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 882, "artifact_id": "artifact-90348610fc36eba20e5c4026", "occurrences": 2, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 882, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a26dcbb948da05ec8af97885dbd149b0", "sha1": "cfa529c048ec394a1203853c0c9a5e28ea23f035", "type": "http-exported-object", "sha256": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "evidence": [ { "tcp_stream": 184, "frame_number": 16115, "display_filter": "frame.number == 16115", "timestamp_epoch": "1550950846.686257000" } ], "filename": "CSPCA.crl", "filenames": [ "CSPCA.crl" ], "transfers": [ { "url": "http://crl.microsoft.com/pki/crl/products/CSPCA.crl", "client_ip": "10.2.23.109", "server_ip": "23.218.156.17", "tcp_stream": 184, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 16113, "response_frame": 16115 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 506, "artifact_id": "artifact-2f037968e1b78e6f08e39895", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 506, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 506, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "56e61e2686f39b64c6f64c1ff49bb05e", "sha1": "cde0300123f31937ded5094a5bc29b76d8020dab", "type": "http-exported-object", "sha256": "ec0a5627751851db7afed684f83dde6178c3e6b2114adc24a1294fb2bb1d40e8", "evidence": [ { "tcp_stream": 81, "frame_number": 1522, "display_filter": "frame.number == 1522", "timestamp_epoch": "1550949999.760145000" } ], "filename": "css%3ffamily=Lato%3a100,400", "filenames": [ "css%3ffamily=Lato%3a100,400" ], "transfers": [ { "url": "http://fonts.googleapis.com/css?family=Lato:100,400", "client_ip": "10.2.23.109", "server_ip": "172.217.2.10", "tcp_stream": 81, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1438, "response_frame": 1522 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 432, "artifact_id": "artifact-c763104692429fe70feae10f", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 432, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 432, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c847dd9f5b5965908b03dcda969f5a2d", "sha1": "fa51cc50a4c9c9049c3d7c81bd5f3038458ba6df", "type": "http-exported-object", "sha256": "360daaf74aa6a7e36952e66764a76de6b6a1a48bcbbad611288396ead6f733bb", "evidence": [], "filename": "83", "filenames": [ "83" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 286, "artifact_id": "artifact-18c317f294ae7d935d32a0b1", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 286, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1fd76ac7b29dac99ead87a24172b2c77", "sha1": "3e4b1fff85e901579e71eec87ac68c7eb65a1511", "type": "http-exported-object", "sha256": "d95a35fac8425ed6c010066a81b4330ade8dd325713e077d67fcfd33e7cafcac", "evidence": [], "filename": "81", "filenames": [ "81" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 262, "artifact_id": "artifact-e98f5f5a3d62541daf0b4aad", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9fb559a691078558e77d6848202f6541", "sha1": "ea13848d33c2c7f4f4baa39348aeb1dbfad3df31", "type": "http-exported-object", "sha256": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914", "evidence": [ { "tcp_stream": 79, "frame_number": 1368, "display_filter": "frame.number == 1368", "timestamp_epoch": "1550949989.443394000" }, { "tcp_stream": 232, "frame_number": 25264, "display_filter": "frame.number == 25264", "timestamp_epoch": "1550951431.602730000" } ], "filename": "favicon(1).ico", "filenames": [ "favicon(1).ico", "favicon.ico" ], "transfers": [ { "url": "http://www.bing.com/favicon.ico", "client_ip": "10.2.23.109", "server_ip": "204.79.197.200", "tcp_stream": 79, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1357, "response_frame": 1368 }, { "url": "http://www.bing.com/favicon.ico", "client_ip": "10.2.23.109", "server_ip": "204.79.197.200", "tcp_stream": 232, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 25256, "response_frame": 25264 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/vnd.microsoft.icon", "size_bytes": 237, "artifact_id": "artifact-48167bd23469360a0ad1f05b", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 237, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 237, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b4c01e5f9c3ad32308d402dbe06d1c01", "sha1": "d81b9f92b3549dbea212a34c53493ca7f29619ec", "type": "http-exported-object", "sha256": "71a22598eedbbdedd0ba95f9fbf4a19726abf69681462f56cf535f4fd505a079", "evidence": [ { "tcp_stream": 75, "frame_number": 3452, "display_filter": "frame.number == 3452", "timestamp_epoch": "1550950037.839308000" } ], "filename": "RecordHit%3fcrumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi(1)", "filenames": [ "RecordHit%3fcrumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi(1)" ], "transfers": [ { "url": "http://www.rootscafeslc.com/api/census/RecordHit?crumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi", "client_ip": "10.2.23.109", "server_ip": "198.185.159.135", "tcp_stream": 75, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 2099, "response_frame": 3452 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 151, "artifact_id": "artifact-8589cb76a0477da267a5e9f8", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 151, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 151, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c564ac1adf0ae564136c8ac8484db675", "sha1": "cb13b5f378ee7d6ae23876632a32a0c1bb89fa42", "type": "http-exported-object", "sha256": "e32d0b53c63fe1a6b0759ebc8824b97661d369004213853438faaa34134967e6", "evidence": [ { "tcp_stream": 75, "frame_number": 3468, "display_filter": "frame.number == 3468", "timestamp_epoch": "1550950038.050329000" } ], "filename": "RecordHit%3fcrumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi(3)", "filenames": [ "RecordHit%3fcrumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi(3)" ], "transfers": [ { "url": "http://www.rootscafeslc.com/api/census/RecordHit?crumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi", "client_ip": "10.2.23.109", "server_ip": "198.185.159.135", "tcp_stream": 75, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 3456, "response_frame": 3468 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 151, "artifact_id": "artifact-7456c3ff2097a958258d0d2d", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 151, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 151, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e3e992b7ef6a4b7c1090ff73ec80a12a", "sha1": "bf77169078a14962e9044b549ab1d5c2308152c6", "type": "http-exported-object", "sha256": "1fee1ef37060734fe38728af41fad66a827abb34151a3658ceee6000d4df40b2", "evidence": [ { "tcp_stream": 196, "frame_number": 19797, "display_filter": "frame.number == 19797", "timestamp_epoch": "1550950932.270052000" } ], "filename": "plain", "filenames": [ "plain" ], "transfers": [ { "url": "http://ipecho.net/plain", "client_ip": "10.2.23.231", "server_ip": "216.239.32.21", "tcp_stream": 196, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "302", "completeness": "matches-declared-content-length", "request_frame": 19795, "response_frame": 19797 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 46, "artifact_id": "artifact-b10a3c478c9ad0ec185e202b", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 46, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 46, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cd5a4d3fdd5bffc16bf959ef75cf37bc", "sha1": "33bf88d5b82df3723d5863c7d23445e345828904", "type": "http-exported-object", "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [ { "tcp_stream": 19, "frame_number": 314, "display_filter": "frame.number == 314", "timestamp_epoch": "1550949882.793932000" }, { "tcp_stream": 45, "frame_number": 796, "display_filter": "frame.number == 796", "timestamp_epoch": "1550949925.621152000" } ], "filename": "ncsi(1).txt", "filenames": [ "ncsi(1).txt", "ncsi.txt" ], "transfers": [ { "url": "http://www.msftncsi.com/ncsi.txt", "client_ip": "10.2.23.231", "server_ip": "23.223.195.42", "tcp_stream": 19, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 312, "response_frame": 314 }, { "url": "http://www.msftncsi.com/ncsi.txt", "client_ip": "10.2.23.109", "server_ip": "23.223.195.42", "tcp_stream": 45, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 752, "response_frame": 796 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/plain", "size_bytes": 14, "artifact_id": "artifact-6bf59ed04c667e8eaea97878", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "fa06d89c65fb808240e37f4c9e128955", "sha1": "ff0288c119791fc13a51965eb3a0e61be2c06338", "type": "http-exported-object", "sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "evidence": [ { "tcp_stream": 207, "frame_number": 23796, "display_filter": "frame.number == 23796", "timestamp_epoch": "1550951353.957116000" }, { "tcp_stream": 208, "frame_number": 23819, "display_filter": "frame.number == 23819", "timestamp_epoch": "1550951356.418447000" }, { "tcp_stream": 212, "frame_number": 24670, "display_filter": "frame.number == 24670", "timestamp_epoch": "1550951415.807159000" }, { "tcp_stream": 237, "frame_number": 26802, "display_filter": "frame.number == 26802", "timestamp_epoch": "1550951446.619091000" } ], "filename": "81(1)", "filenames": [ "81(1)", "83(1)", "90(1)", "90(3)" ], "transfers": [ { "url": "http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/83/", "client_ip": "10.2.23.231", "server_ip": "190.146.112.216", "tcp_stream": 207, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 23794, "response_frame": 23796 }, { "url": "http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/81/", "client_ip": "10.2.23.231", "server_ip": "190.146.112.216", "tcp_stream": 208, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 23816, "response_frame": 23819 }, { "url": "http://190.146.112.216:8082/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/90", "client_ip": "10.2.23.231", "server_ip": "190.146.112.216", "tcp_stream": 212, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 24666, "response_frame": 24670 }, { "url": "http://190.146.112.216:8082/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/90", "client_ip": "10.2.23.231", "server_ip": "190.146.112.216", "tcp_stream": 237, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 26591, "response_frame": 26802 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 3, "artifact_id": "artifact-f529009c0694b2059ffefa63", "occurrences": 4, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d41d8cd98f00b204e9800998ecf8427e", "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "type": "http-exported-object", "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "evidence": [], "filename": "%2f", "filenames": [ "%2f" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 0, "artifact_id": "artifact-f1590e92bf1c15f5c3a2b3a2", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 0, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "10.2.23.1", "bytes_sent": 108, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-a4d30e3da0eb76edf127b84f", "packets_sent": 2, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 18678, "evidence_frames": [ 400, 401, 402, 482, 483 ], "last_seen_epoch": "1550952557.594209", "first_seen_epoch": "1550949914.394571", "packets_received": 176 }, { "ip": "10.2.23.109", "bytes_sent": 325067, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-00cc2100ba1d32d8dee9bbd4", "packets_sent": 3653, "mac_addresses": [ "20:cf:30:10:c7:2b" ], "bytes_received": 5948296, "evidence_frames": [ 394, 395, 396, 397, 398 ], "last_seen_epoch": "1550952557.594209", "first_seen_epoch": "1550949914.325883", "packets_received": 5040 }, { "ip": "10.2.23.2", "bytes_sent": 1066804, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-9b8a24759413598b64e8cfa1", "packets_sent": 3624, "mac_addresses": [ "a4:1f:72:c2:09:6a" ], "bytes_received": 1096964, "evidence_frames": [ 4, 5, 6, 7, 8 ], "last_seen_epoch": "1550952571.828707", "first_seen_epoch": "1550949876.446053", "packets_received": 3935 }, { "ip": "10.2.23.231", "bytes_sent": 1339019, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-3548128b127ecb732958e14b", "packets_sent": 8281, "mac_addresses": [ "00:11:0a:9f:c0:2d" ], "bytes_received": 11672643, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1550952584.866718", "first_seen_epoch": "1550949876.172365", "packets_received": 11913 }, { "ip": "10.2.23.254", "bytes_sent": 2736, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-0f814814dd9ecc0493aae1f8", "packets_sent": 8, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 66, "evidence_frames": [ 293, 494, 1180, 3114, 13398 ], "last_seen_epoch": "1550951426.475796", "first_seen_epoch": "1550949879.493272", "packets_received": 1 }, { "ip": "10.2.23.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-2bebd8fc1e2a3f874e056cb7", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 10384, "evidence_frames": [ 1, 83, 84, 85, 267 ], "last_seen_epoch": "1550951450.201112", "first_seen_epoch": "1550949876.172365", "packets_received": 92 }, { "ip": "151.101.0.238", "bytes_sent": 117653, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5b5d5dfef39588d72d0342a7", "packets_sent": 104, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 5620, "evidence_frames": [ 1214, 1215, 1216, 1217, 1218 ], "last_seen_epoch": "1550950095.270446", "first_seen_epoch": "1550949986.21251", "packets_received": 74 }, { "ip": "151.101.64.238", "bytes_sent": 2693739, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-48477a0036c5cdf270946c14", "packets_sent": 2038, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 74455, "evidence_frames": [ 1430, 1431, 1432, 1433, 1434 ], "last_seen_epoch": "1550950169.101709", "first_seen_epoch": "1550949997.409236", "packets_received": 1342 }, { "ip": "161.119.42.22", "bytes_sent": 2364262, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-31df5af3a259e1ba492240f0", "packets_sent": 1834, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 73029, "evidence_frames": [ 24718, 24719, 24720, 24721, 24722 ], "last_seen_epoch": "1550951463.558185", "first_seen_epoch": "1550951426.510284", "packets_received": 1133 }, { "ip": "172.217.1.200", "bytes_sent": 33990, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9175b2f8390ef5ca5b5f04d8", "packets_sent": 36, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 2595, "evidence_frames": [ 24760, 24761, 24765, 24766, 24767 ], "last_seen_epoch": "1550951463.600491", "first_seen_epoch": "1550951427.054127", "packets_received": 29 }, { "ip": "172.217.2.10", "bytes_sent": 1975, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-47b5a517cec435cd8208e47f", "packets_sent": 10, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 1513, "evidence_frames": [ 1428, 1436, 1437, 1438, 1439 ], "last_seen_epoch": "1550951463.600803", "first_seen_epoch": "1550949997.40216", "packets_received": 15 }, { "ip": "172.217.2.3", "bytes_sent": 58839, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f11a3dc0a0c4de8a88a82ca7", "packets_sent": 51, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 2534, "evidence_frames": [ 2093, 2094, 2101, 2102, 2103 ], "last_seen_epoch": "1550950094.607095", "first_seen_epoch": "1550950020.021122", "packets_received": 34 }, { "ip": "181.215.47.171", "bytes_sent": 54, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2a9c5a48c51af69e06b2d209", "packets_sent": 1, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 194, "evidence_frames": [ 6144, 6145, 6146, 7256 ], "last_seen_epoch": "1550950452.264845", "first_seen_epoch": "1550950376.817336", "packets_received": 3 }, { "ip": "185.246.116.239", "bytes_sent": 632417, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2c3429ee65a8b77e3f130950", "packets_sent": 540, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 20694, "evidence_frames": [ 6156, 6157, 6158, 6159, 6160 ], "last_seen_epoch": "1550950543.83624", "first_seen_epoch": "1550950403.233866", "packets_received": 308 }, { "ip": "190.146.112.216", "bytes_sent": 1992, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-487855629f616da16fc0b0cf", "packets_sent": 27, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 10377, "evidence_frames": [ 23789, 23790, 23791, 23792, 23793 ], "last_seen_epoch": "1550951564.112402", "first_seen_epoch": "1550951353.114976", "packets_received": 31 }, { "ip": "195.123.246.99", "bytes_sent": 2521626, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2c6dafda17e5f80df12359fa", "packets_sent": 1917, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 52413, "evidence_frames": [ 19954, 19959, 19960, 19961, 19962 ], "last_seen_epoch": "1550951473.652687", "first_seen_epoch": "1550950935.332375", "packets_received": 932 }, { "ip": "198.185.159.135", "bytes_sent": 10014, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2bb790445682b83f6dea5cca", "packets_sent": 19, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 4493, "evidence_frames": [ 1193, 1194, 1195, 1196, 1197 ], "last_seen_epoch": "1550950094.06328", "first_seen_epoch": "1550949985.00085", "packets_received": 18 }, { "ip": "198.185.159.136", "bytes_sent": 770, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e9754a5d422cfdd30c590024", "packets_sent": 8, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 823, "evidence_frames": [ 1181, 1182, 1183, 1184, 1185 ], "last_seen_epoch": "1550950094.063565", "first_seen_epoch": "1550949984.16926", "packets_received": 10 }, { "ip": "204.79.197.200", "bytes_sent": 1778, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-39103e5fa292e2d1b48d7a60", "packets_sent": 11, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 1314, "evidence_frames": [ 1342, 1343, 1353, 1354, 1355 ], "last_seen_epoch": "1550951463.662453", "first_seen_epoch": "1550949989.015127", "packets_received": 15 }, { "ip": "209.141.55.226", "bytes_sent": 128436, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-68ff957c2c42d8d5e1f8f2b7", "packets_sent": 98, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 3239, "evidence_frames": [ 3116, 3117, 3118, 3119, 3120 ], "last_seen_epoch": "1550950040.343377", "first_seen_epoch": "1550950028.090678", "packets_received": 54 }, { "ip": "213.226.68.112", "bytes_sent": 434890, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8e23930faf118ae78520ef1f", "packets_sent": 555, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 75725, "evidence_frames": [ 19092, 19093, 19094, 19095, 19096 ], "last_seen_epoch": "1550952584.866718", "first_seen_epoch": "1550950913.743458", "packets_received": 371 }, { "ip": "216.239.32.21", "bytes_sent": 4437, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9a984e5ac0d45eaa230c3a25", "packets_sent": 12, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 1394, "evidence_frames": [ 19782, 19793, 19794, 19795, 19796 ], "last_seen_epoch": "1550951026.594527", "first_seen_epoch": "1550950931.794103", "packets_received": 13 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1b329421f25732c2e83ce659", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 702, "evidence_frames": [ 3, 289, 290, 303, 394 ], "last_seen_epoch": "1550949981.036509", "first_seen_epoch": "1550949876.344041", "packets_received": 13 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e8a4a61a3a5faf2756109b73", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 1029, "evidence_frames": [ 2, 291, 298, 299, 302 ], "last_seen_epoch": "1550950915.724998", "first_seen_epoch": "1550949876.21756", "packets_received": 15 }, { "ip": "23.218.156.17", "bytes_sent": 1114, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1ba282e2edf067b620f019ab", "packets_sent": 3, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 371, "evidence_frames": [ 16109, 16111, 16112, 16113, 16114 ], "last_seen_epoch": "1550950846.730084", "first_seen_epoch": "1550950846.531226", "packets_received": 4 }, { "ip": "23.223.195.42", "bytes_sent": 906, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d06184e0ab3ea88eafb58e36", "packets_sent": 10, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 758, "evidence_frames": [ 309, 310, 311, 312, 313 ], "last_seen_epoch": "1550949926.151363", "first_seen_epoch": "1550949882.410439", "packets_received": 10 }, { "ip": "23.63.25.226", "bytes_sent": 480205, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7959413426786430f4db35c5", "packets_sent": 464, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 31551, "evidence_frames": [ 1516, 1524, 1525, 1526, 1527 ], "last_seen_epoch": "1550950094.124999", "first_seen_epoch": "1550949999.721963", "packets_received": 332 }, { "ip": "255.255.255.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-90e63114ff53d9195d68835a", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 2736, "evidence_frames": [ 292, 493, 1179, 3113, 14586 ], "last_seen_epoch": "1550951426.475706", "first_seen_epoch": "1550949879.493176", "packets_received": 8 }, { "ip": "46.249.62.199", "bytes_sent": 3114108, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-340a57b823b7d5e3ace6a4cb", "packets_sent": 2344, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 61846, "evidence_frames": [ 6239, 6240, 6247, 6248, 6249 ], "last_seen_epoch": "1550950804.106598", "first_seen_epoch": "1550950409.944187", "packets_received": 1142 }, { "ip": "72.21.81.200", "bytes_sent": 100163, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1b7c04c0c2e3bd5d8d80bbaa", "packets_sent": 99, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 6096, "evidence_frames": [ 1841, 1842, 1849, 1850, 1851 ], "last_seen_epoch": "1550951463.662677", "first_seen_epoch": "1550950014.052477", "packets_received": 78 }, { "ip": "72.21.81.240", "bytes_sent": 59440, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0fa3e2e788a1844a07451f26", "packets_sent": 47, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 1664, "evidence_frames": [ 19575, 19576, 19577, 19578, 19579 ], "last_seen_epoch": "1550951026.594464", "first_seen_epoch": "1550950925.254057", "packets_received": 25 }, { "ip": "8.253.129.66", "bytes_sent": 59526, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2543aaf466028be55e1d29a4", "packets_sent": 47, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 1201, "evidence_frames": [ 6168, 6169, 6170, 6171, 6172 ], "last_seen_epoch": "1550950496.286818", "first_seen_epoch": "1550950404.669492", "packets_received": 18 }, { "ip": "85.143.218.7", "bytes_sent": 846414, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e3a09accdc3353cb83470c02", "packets_sent": 642, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 18375, "evidence_frames": [ 10957, 10964, 10965, 10966, 10967 ], "last_seen_epoch": "1550950997.56578", "first_seen_epoch": "1550950711.10767", "packets_received": 333 }, { "ip": "87.236.22.142", "bytes_sent": 2881751, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0cf03881bb32d1cd40ef6942", "packets_sent": 2388, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 78921, "evidence_frames": [ 7516, 7522, 7523, 7524, 7525 ], "last_seen_epoch": "1550952547.403303", "first_seen_epoch": "1550950467.271204", "packets_received": 1334 }, { "ip": "92.223.105.176", "bytes_sent": 162, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7ae3548173889e28ccf12982", "packets_sent": 3, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 582, "evidence_frames": [ 13260, 13350, 13798, 15238, 15399 ], "last_seen_epoch": "1550950946.101085", "first_seen_epoch": "1550950786.590862", "packets_received": 9 }, { "ip": "94.103.95.185", "bytes_sent": 432, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-140fbbf345417d5402df22a9", "packets_sent": 8, "mac_addresses": [ "00:04:c0:83:b4:1a" ], "bytes_received": 1552, "evidence_frames": [ 6803, 6876, 7045, 7376, 7440 ], "last_seen_epoch": "1550950690.238912", "first_seen_epoch": "1550950432.68218", "packets_received": 24 } ], "identities": [ { "type": "account", "value": "byron.sutton", "bindings": [ { "account": "", "owner_ip": "10.2.23.109", "frame_number": 511, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 519, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 521, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 533, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 557, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 590, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 602, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 637, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 683, "relationship": "client-asserted", "source_field": "ntlmssp.auth.username", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.109" } ], "evidence": [ { "tcp_stream": 29, "frame_number": 511, "display_filter": "frame.number == 511", "timestamp_epoch": "1550949919.370910000" }, { "tcp_stream": 30, "frame_number": 519, "display_filter": "frame.number == 519", "timestamp_epoch": "1550949919.383115000" }, { "tcp_stream": 30, "frame_number": 521, "display_filter": "frame.number == 521", "timestamp_epoch": "1550949919.383637000" }, { "tcp_stream": 31, "frame_number": 533, "display_filter": "frame.number == 533", "timestamp_epoch": "1550949919.385468000" }, { "tcp_stream": 33, "frame_number": 557, "display_filter": "frame.number == 557", "timestamp_epoch": "1550949919.927703000" }, { "tcp_stream": 35, "frame_number": 590, "display_filter": "frame.number == 590", "timestamp_epoch": "1550949919.994396000" }, { "tcp_stream": 36, "frame_number": 602, "display_filter": "frame.number == 602", "timestamp_epoch": "1550949919.995288000" }, { "tcp_stream": 38, "frame_number": 637, "display_filter": "frame.number == 637", "timestamp_epoch": "1550949920.125815000" }, { "tcp_stream": 40, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1550949920.156300000" } ], "raw_values": [ "byron.sutton" ], "identity_id": "identity-aed8d6503467b1c6bcbcb400", "ip_addresses": [ "10.2.23.109" ], "mac_addresses": [ "20:cf:30:10:c7:2b" ] }, { "type": "account", "value": "ferguson-win-pc$", "bindings": [ { "account": "", "owner_ip": "10.2.23.231", "frame_number": 24, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 32, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 34, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 46, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 337, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 349, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 824, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 832, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 834, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 846, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 885, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 911, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 941, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 953, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 11277, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" } ], "evidence": [ { "tcp_stream": 1, "frame_number": 24, "display_filter": "frame.number == 24", "timestamp_epoch": "1550949876.662904000" }, { "tcp_stream": 2, "frame_number": 32, "display_filter": "frame.number == 32", "timestamp_epoch": "1550949876.683669000" }, { "tcp_stream": 2, "frame_number": 34, "display_filter": "frame.number == 34", "timestamp_epoch": "1550949876.685054000" }, { "tcp_stream": 3, "frame_number": 46, "display_filter": "frame.number == 46", "timestamp_epoch": "1550949876.701186000" }, { "tcp_stream": 21, "frame_number": 337, "display_filter": "frame.number == 337", "timestamp_epoch": "1550949889.114509000" }, { "tcp_stream": 22, "frame_number": 349, "display_filter": "frame.number == 349", "timestamp_epoch": "1550949889.115398000" }, { "tcp_stream": 49, "frame_number": 824, "display_filter": "frame.number == 824", "timestamp_epoch": "1550949937.298595000" }, { "tcp_stream": 50, "frame_number": 832, "display_filter": "frame.number == 832", "timestamp_epoch": "1550949937.316268000" }, { "tcp_stream": 50, "frame_number": 834, "display_filter": "frame.number == 834", "timestamp_epoch": "1550949937.316946000" }, { "tcp_stream": 51, "frame_number": 846, "display_filter": "frame.number == 846", "timestamp_epoch": "1550949937.318681000" }, { "tcp_stream": 53, "frame_number": 885, "display_filter": "frame.number == 885", "timestamp_epoch": "1550949937.853682000" }, { "tcp_stream": 55, "frame_number": 911, "display_filter": "frame.number == 911", "timestamp_epoch": "1550949937.873385000" }, { "tcp_stream": 58, "frame_number": 941, "display_filter": "frame.number == 941", "timestamp_epoch": "1550949937.897286000" }, { "tcp_stream": 59, "frame_number": 953, "display_filter": "frame.number == 953", "timestamp_epoch": "1550949937.898388000" }, { "tcp_stream": 156, "frame_number": 11277, "display_filter": "frame.number == 11277", "timestamp_epoch": "1550950724.598993000" } ], "raw_values": [ "FERGUSON-WIN-PC$", "ferguson-win-pc$" ], "identity_id": "identity-4a7b409f2d34b88ec64e0633", "ip_addresses": [ "10.2.23.231" ], "mac_addresses": [ "00:11:0a:9f:c0:2d" ] }, { "type": "account", "value": "ruby.ferguson", "bindings": [ { "account": "", "owner_ip": "10.2.23.231", "frame_number": 96, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 104, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 106, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 118, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 155, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 212, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 224, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 239, "relationship": "client-asserted", "source_field": "ntlmssp.auth.username", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 3066, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.231", "conversation_src": "10.2.23.2" }, { "owner_ip": "10.2.23.231", "frame_number": 26591, "relationship": "body-asserted-not-authenticated", "source_field": "explicit-body-label", "conversation_dst": "190.146.112.216", "conversation_src": "10.2.23.231" } ], "evidence": [ { "tcp_stream": 7, "frame_number": 96, "display_filter": "frame.number == 96", "timestamp_epoch": "1550949877.406742000" }, { "tcp_stream": 8, "frame_number": 104, "display_filter": "frame.number == 104", "timestamp_epoch": "1550949877.419022000" }, { "tcp_stream": 8, "frame_number": 106, "display_filter": "frame.number == 106", "timestamp_epoch": "1550949877.419814000" }, { "tcp_stream": 9, "frame_number": 118, "display_filter": "frame.number == 118", "timestamp_epoch": "1550949877.421635000" }, { "tcp_stream": 11, "frame_number": 155, "display_filter": "frame.number == 155", "timestamp_epoch": "1550949877.473451000" }, { "tcp_stream": 16, "frame_number": 212, "display_filter": "frame.number == 212", "timestamp_epoch": "1550949877.544872000" }, { "tcp_stream": 17, "frame_number": 224, "display_filter": "frame.number == 224", "timestamp_epoch": "1550949877.546943000" }, { "tcp_stream": 13, "frame_number": 239, "display_filter": "frame.number == 239", "timestamp_epoch": "1550949877.555162000" }, { "tcp_stream": 104, "frame_number": 3066, "display_filter": "frame.number == 3066", "timestamp_epoch": "1550950027.686127000" }, { "tcp_stream": 237, "frame_number": 26591, "display_filter": "frame.number == 26591", "timestamp_epoch": "1550951444.371220000" } ], "raw_values": [ "ruby.ferguson" ], "identity_id": "identity-5384225928c7da6682fed410", "ip_addresses": [ "10.2.23.231" ], "mac_addresses": [ "00:11:0a:9f:c0:2d" ] }, { "type": "account", "value": "sutton-win-pc$", "bindings": [ { "account": "", "owner_ip": "10.2.23.109", "frame_number": 425, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 433, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 435, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 447, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 766, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 778, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 1027, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 1035, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 1037, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 1049, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 1084, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 1098, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 1140, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 1152, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 12431, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.2.23.109", "conversation_src": "10.2.23.2" } ], "evidence": [ { "tcp_stream": 24, "frame_number": 425, "display_filter": "frame.number == 425", "timestamp_epoch": "1550949914.824781000" }, { "tcp_stream": 25, "frame_number": 433, "display_filter": "frame.number == 433", "timestamp_epoch": "1550949914.843629000" }, { "tcp_stream": 25, "frame_number": 435, "display_filter": "frame.number == 435", "timestamp_epoch": "1550949914.844221000" }, { "tcp_stream": 26, "frame_number": 447, "display_filter": "frame.number == 447", "timestamp_epoch": "1550949914.847512000" }, { "tcp_stream": 47, "frame_number": 766, "display_filter": "frame.number == 766", "timestamp_epoch": "1550949925.332914000" }, { "tcp_stream": 48, "frame_number": 778, "display_filter": "frame.number == 778", "timestamp_epoch": "1550949925.333884000" }, { "tcp_stream": 61, "frame_number": 1027, "display_filter": "frame.number == 1027", "timestamp_epoch": "1550949975.131962000" }, { "tcp_stream": 62, "frame_number": 1035, "display_filter": "frame.number == 1035", "timestamp_epoch": "1550949975.149951000" }, { "tcp_stream": 62, "frame_number": 1037, "display_filter": "frame.number == 1037", "timestamp_epoch": "1550949975.150727000" }, { "tcp_stream": 63, "frame_number": 1049, "display_filter": "frame.number == 1049", "timestamp_epoch": "1550949975.152387000" }, { "tcp_stream": 65, "frame_number": 1084, "display_filter": "frame.number == 1084", "timestamp_epoch": "1550949975.683772000" }, { "tcp_stream": 66, "frame_number": 1098, "display_filter": "frame.number == 1098", "timestamp_epoch": "1550949975.687054000" }, { "tcp_stream": 70, "frame_number": 1140, "display_filter": "frame.number == 1140", "timestamp_epoch": "1550949975.697491000" }, { "tcp_stream": 71, "frame_number": 1152, "display_filter": "frame.number == 1152", "timestamp_epoch": "1550949975.698475000" }, { "tcp_stream": 163, "frame_number": 12431, "display_filter": "frame.number == 12431", "timestamp_epoch": "1550950760.048098000" } ], "raw_values": [ "SUTTON-WIN-PC$", "sutton-win-pc$" ], "identity_id": "identity-1626007476e10f2e35f27d55", "ip_addresses": [ "10.2.23.109" ], "mac_addresses": [ "20:cf:30:10:c7:2b" ] }, { "type": "domain", "value": "STORMTHEORY", "bindings": [ { "account": "", "owner_ip": "10.2.23.231", "frame_number": 239, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 683, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 13662, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 14129, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 14746, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 14765, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 14861, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 15973, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 16521, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 17119, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 17217, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 18263, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 18282, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 19140, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 19238, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 20082, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" } ], "evidence": [ { "tcp_stream": 13, "frame_number": 239, "display_filter": "frame.number == 239", "timestamp_epoch": "1550949877.555162000" }, { "tcp_stream": 40, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1550949920.156300000" }, { "tcp_stream": 176, "frame_number": 13662, "display_filter": "frame.number == 13662", "timestamp_epoch": "1550950795.347802000" }, { "tcp_stream": 177, "frame_number": 14129, "display_filter": "frame.number == 14129", "timestamp_epoch": "1550950805.579902000" }, { "tcp_stream": 178, "frame_number": 14746, "display_filter": "frame.number == 14746", "timestamp_epoch": "1550950820.821693000" }, { "tcp_stream": 179, "frame_number": 14765, "display_filter": "frame.number == 14765", "timestamp_epoch": "1550950820.823992000" }, { "tcp_stream": 180, "frame_number": 14861, "display_filter": "frame.number == 14861", "timestamp_epoch": "1550950821.038689000" }, { "tcp_stream": 183, "frame_number": 15973, "display_filter": "frame.number == 15973", "timestamp_epoch": "1550950846.293019000" }, { "tcp_stream": 185, "frame_number": 16521, "display_filter": "frame.number == 16521", "timestamp_epoch": "1550950856.529033000" }, { "tcp_stream": 187, "frame_number": 17119, "display_filter": "frame.number == 17119", "timestamp_epoch": "1550950866.762282000" }, { "tcp_stream": 188, "frame_number": 17217, "display_filter": "frame.number == 17217", "timestamp_epoch": "1550950866.980374000" }, { "tcp_stream": 190, "frame_number": 18263, "display_filter": "frame.number == 18263", "timestamp_epoch": "1550950892.234163000" }, { "tcp_stream": 191, "frame_number": 18282, "display_filter": "frame.number == 18282", "timestamp_epoch": "1550950892.237627000" }, { "tcp_stream": 193, "frame_number": 19140, "display_filter": "frame.number == 19140", "timestamp_epoch": "1550950917.489373000" }, { "tcp_stream": 194, "frame_number": 19238, "display_filter": "frame.number == 19238", "timestamp_epoch": "1550950917.696330000" }, { "tcp_stream": 199, "frame_number": 20082, "display_filter": "frame.number == 20082", "timestamp_epoch": "1550950937.945540000" } ], "raw_values": [ "STORMTHEORY" ], "identity_id": "identity-d12cb7e5557ebd09b2781356", "ip_addresses": [ "10.2.23.109", "10.2.23.231" ], "mac_addresses": [ "00:11:0a:9f:c0:2d", "20:cf:30:10:c7:2b" ] }, { "type": "hostname", "value": "Ferguson-Win-PC", "bindings": [ { "account": "", "owner_ip": "0.0.0.0", "frame_number": 292, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 3113, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 19103, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 24655, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 1, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 83, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 85, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 239, "relationship": "client-asserted", "source_field": "ntlmssp.auth.hostname", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 268, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 271, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 284, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 286, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": "10.2.23.231", "frame_number": 288, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.231" }, { "owner_ip": "10.2.23.231", "frame_number": 26591, "relationship": "body-asserted-not-authenticated", "source_field": "explicit-body-label", "conversation_dst": "190.146.112.216", "conversation_src": "10.2.23.231" } ], "evidence": [ { "udp_stream": 11, "frame_number": 292, "display_filter": "frame.number == 292", "timestamp_epoch": "1550949879.493176000" }, { "udp_stream": 11, "frame_number": 3113, "display_filter": "frame.number == 3113", "timestamp_epoch": "1550950028.069692000" }, { "udp_stream": 11, "frame_number": 19103, "display_filter": "frame.number == 19103", "timestamp_epoch": "1550950915.527117000" }, { "udp_stream": 11, "frame_number": 24655, "display_filter": "frame.number == 24655", "timestamp_epoch": "1550951414.909026000" }, { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1550949876.172365000" }, { "udp_stream": 0, "frame_number": 83, "display_filter": "frame.number == 83", "timestamp_epoch": "1550949876.857474000" }, { "udp_stream": 0, "frame_number": 85, "display_filter": "frame.number == 85", "timestamp_epoch": "1550949876.935082000" }, { "tcp_stream": 13, "frame_number": 239, "display_filter": "frame.number == 239", "timestamp_epoch": "1550949877.555162000" }, { "udp_stream": 0, "frame_number": 268, "display_filter": "frame.number == 268", "timestamp_epoch": "1550949877.621970000" }, { "udp_stream": 0, "frame_number": 271, "display_filter": "frame.number == 271", "timestamp_epoch": "1550949877.699560000" }, { "udp_stream": 0, "frame_number": 284, "display_filter": "frame.number == 284", "timestamp_epoch": "1550949878.388200000" }, { "udp_stream": 0, "frame_number": 286, "display_filter": "frame.number == 286", "timestamp_epoch": "1550949878.465251000" }, { "udp_stream": 0, "frame_number": 288, "display_filter": "frame.number == 288", "timestamp_epoch": "1550949879.150469000" }, { "tcp_stream": 237, "frame_number": 26591, "display_filter": "frame.number == 26591", "timestamp_epoch": "1550951444.371220000" } ], "raw_values": [ "FERGUSON-WIN-PC", "FERGUSON-WIN-PC<00>,FERGUSON-WIN-PC<00> (Workstation/Redirector)", "FERGUSON-WIN-PC<20>,FERGUSON-WIN-PC<20> (Server service)", "Ferguson-Win-PC" ], "identity_id": "identity-e8f170920b9ee1218bc70d24", "ip_addresses": [ "10.2.23.231" ], "mac_addresses": [ "00:11:0a:9f:c0:2d", "00:11:0a:9f:c0:2d,00:11:0a:9f:c0:2d" ] }, { "type": "hostname", "value": "Sutton-Win-PC", "bindings": [ { "account": "", "owner_ip": "0.0.0.0", "frame_number": 493, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 1179, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 14586, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 24715, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 400, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.1", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 402, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.1", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 482, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.1", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 484, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.1", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 487, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.1", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 489, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.1", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 504, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 506, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 538, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 540, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 683, "relationship": "client-asserted", "source_field": "ntlmssp.auth.hostname", "conversation_dst": "10.2.23.2", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 713, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 715, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 721, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": "10.2.23.109", "frame_number": 723, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.109" } ], "evidence": [ { "udp_stream": 31, "frame_number": 493, "display_filter": "frame.number == 493", "timestamp_epoch": "1550949917.544521000" }, { "udp_stream": 31, "frame_number": 1179, "display_filter": "frame.number == 1179", "timestamp_epoch": "1550949984.015382000" }, { "udp_stream": 31, "frame_number": 14586, "display_filter": "frame.number == 14586", "timestamp_epoch": "1550950816.715592000" }, { "udp_stream": 31, "frame_number": 24715, "display_filter": "frame.number == 24715", "timestamp_epoch": "1550951426.475706000" }, { "udp_stream": 23, "frame_number": 400, "display_filter": "frame.number == 400", "timestamp_epoch": "1550949914.394571000" }, { "udp_stream": 23, "frame_number": 402, "display_filter": "frame.number == 402", "timestamp_epoch": "1550949914.394937000" }, { "udp_stream": 23, "frame_number": 482, "display_filter": "frame.number == 482", "timestamp_epoch": "1550949915.907515000" }, { "udp_stream": 23, "frame_number": 484, "display_filter": "frame.number == 484", "timestamp_epoch": "1550949915.907663000" }, { "udp_stream": 23, "frame_number": 487, "display_filter": "frame.number == 487", "timestamp_epoch": "1550949917.421163000" }, { "udp_stream": 23, "frame_number": 489, "display_filter": "frame.number == 489", "timestamp_epoch": "1550949917.421301000" }, { "udp_stream": 36, "frame_number": 504, "display_filter": "frame.number == 504", "timestamp_epoch": "1550949918.965191000" }, { "udp_stream": 36, "frame_number": 506, "display_filter": "frame.number == 506", "timestamp_epoch": "1550949918.965588000" }, { "udp_stream": 36, "frame_number": 538, "display_filter": "frame.number == 538", "timestamp_epoch": "1550949919.729383000" }, { "udp_stream": 36, "frame_number": 540, "display_filter": "frame.number == 540", "timestamp_epoch": "1550949919.729674000" }, { "tcp_stream": 40, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1550949920.156300000" }, { "udp_stream": 36, "frame_number": 713, "display_filter": "frame.number == 713", "timestamp_epoch": "1550949920.493943000" }, { "udp_stream": 36, "frame_number": 715, "display_filter": "frame.number == 715", "timestamp_epoch": "1550949920.494390000" }, { "udp_stream": 36, "frame_number": 721, "display_filter": "frame.number == 721", "timestamp_epoch": "1550949921.259548000" }, { "udp_stream": 36, "frame_number": 723, "display_filter": "frame.number == 723", "timestamp_epoch": "1550949921.259735000" } ], "raw_values": [ "SUTTON-WIN-PC", "SUTTON-WIN-PC<00>,SUTTON-WIN-PC<00> (Workstation/Redirector)", "SUTTON-WIN-PC<20>,SUTTON-WIN-PC<20> (Server service)", "Sutton-Win-PC" ], "identity_id": "identity-04c8705869b49bc40b1e943c", "ip_addresses": [ "10.2.23.109" ], "mac_addresses": [ "20:cf:30:10:c7:2b", "20:cf:30:10:c7:2b,20:cf:30:10:c7:2b" ] }, { "type": "netbios-group", "value": "STORMTHEORY", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 84, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": null, "frame_number": 267, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": null, "frame_number": 285, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": null, "frame_number": 287, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.231" }, { "account": "", "owner_ip": null, "frame_number": 401, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.2.23.1", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": null, "frame_number": 483, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.2.23.1", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": null, "frame_number": 488, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.2.23.1", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": null, "frame_number": 505, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": null, "frame_number": 539, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": null, "frame_number": 714, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.109" }, { "account": "", "owner_ip": null, "frame_number": 722, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.2.23.255", "conversation_src": "10.2.23.109" } ], "evidence": [ { "udp_stream": 0, "frame_number": 84, "display_filter": "frame.number == 84", "timestamp_epoch": "1550949876.857681000" }, { "udp_stream": 0, "frame_number": 267, "display_filter": "frame.number == 267", "timestamp_epoch": "1550949877.621817000" }, { "udp_stream": 0, "frame_number": 285, "display_filter": "frame.number == 285", "timestamp_epoch": "1550949878.388563000" }, { "udp_stream": 0, "frame_number": 287, "display_filter": "frame.number == 287", "timestamp_epoch": "1550949879.150287000" }, { "udp_stream": 23, "frame_number": 401, "display_filter": "frame.number == 401", "timestamp_epoch": "1550949914.394756000" }, { "udp_stream": 23, "frame_number": 483, "display_filter": "frame.number == 483", "timestamp_epoch": "1550949915.907612000" }, { "udp_stream": 23, "frame_number": 488, "display_filter": "frame.number == 488", "timestamp_epoch": "1550949917.421253000" }, { "udp_stream": 36, "frame_number": 505, "display_filter": "frame.number == 505", "timestamp_epoch": "1550949918.965412000" }, { "udp_stream": 36, "frame_number": 539, "display_filter": "frame.number == 539", "timestamp_epoch": "1550949919.729590000" }, { "udp_stream": 36, "frame_number": 714, "display_filter": "frame.number == 714", "timestamp_epoch": "1550949920.494255000" }, { "udp_stream": 36, "frame_number": 722, "display_filter": "frame.number == 722", "timestamp_epoch": "1550949921.259662000" } ], "raw_values": [ "STORMTHEORY<00>,STORMTHEORY<00> (Workstation/Redirector)" ], "identity_id": "identity-f06651cabb78e437fcb29f89", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.b.barracudacentral.org", "evidence": [ { "udp_stream": 107, "frame_number": 23846, "display_filter": "frame.number == 23846", "timestamp_epoch": "1550951375.637159000" }, { "udp_stream": 107, "frame_number": 23848, "display_filter": "frame.number == 23848", "timestamp_epoch": "1550951375.734445000" } ], "is_private": null, "observable_id": "observable-552a33b8f7a9a6d28c3a009c", "last_seen_epoch": "1550951375.734445000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951375.637159000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.cbl.abuseat.org", "evidence": [ { "udp_stream": 106, "frame_number": 23844, "display_filter": "frame.number == 23844", "timestamp_epoch": "1550951375.523039000" }, { "udp_stream": 106, "frame_number": 23845, "display_filter": "frame.number == 23845", "timestamp_epoch": "1550951375.636293000" } ], "is_private": null, "observable_id": "observable-c9b315f1a07c5f90f9231500", "last_seen_epoch": "1550951375.636293000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951375.523039000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.dnsbl-1.uceprotect.net", "evidence": [ { "udp_stream": 108, "frame_number": 23849, "display_filter": "frame.number == 23849", "timestamp_epoch": "1550951375.735581000" }, { "udp_stream": 108, "frame_number": 23850, "display_filter": "frame.number == 23850", "timestamp_epoch": "1550951375.880503000" } ], "is_private": null, "observable_id": "observable-033e87a0b6e3682fa816df28", "last_seen_epoch": "1550951375.880503000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951375.735581000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.spam.dnsbl.sorbs.net", "evidence": [ { "udp_stream": 109, "frame_number": 23851, "display_filter": "frame.number == 23851", "timestamp_epoch": "1550951375.881257000" }, { "udp_stream": 109, "frame_number": 23852, "display_filter": "frame.number == 23852", "timestamp_epoch": "1550951376.102761000" } ], "is_private": null, "observable_id": "observable-88dc64b86c9f853789305cc4", "last_seen_epoch": "1550951376.102761000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951375.881257000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.zen.spamhaus.org", "evidence": [ { "udp_stream": 105, "frame_number": 23842, "display_filter": "frame.number == 23842", "timestamp_epoch": "1550951375.399923000" }, { "udp_stream": 105, "frame_number": 23843, "display_filter": "frame.number == 23843", "timestamp_epoch": "1550951375.522153000" } ], "is_private": null, "observable_id": "observable-cfab0d812d6b7ed017159f9a", "last_seen_epoch": "1550951375.522153000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951375.399923000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "api.bing.com", "evidence": [ { "udp_stream": 53, "frame_number": 1290, "display_filter": "frame.number == 1290", "timestamp_epoch": "1550949987.933921000" }, { "udp_stream": 54, "frame_number": 1291, "display_filter": "frame.number == 1291", "timestamp_epoch": "1550949987.935237000" }, { "udp_stream": 54, "frame_number": 1298, "display_filter": "frame.number == 1298", "timestamp_epoch": "1550949987.996656000" }, { "udp_stream": 53, "frame_number": 1299, "display_filter": "frame.number == 1299", "timestamp_epoch": "1550949987.996754000" }, { "udp_stream": 115, "frame_number": 25118, "display_filter": "frame.number == 25118", "timestamp_epoch": "1550951430.384352000" }, { "udp_stream": 116, "frame_number": 25119, "display_filter": "frame.number == 25119", "timestamp_epoch": "1550951430.384509000" }, { "udp_stream": 116, "frame_number": 25140, "display_filter": "frame.number == 25140", "timestamp_epoch": "1550951430.455619000" }, { "udp_stream": 115, "frame_number": 25142, "display_filter": "frame.number == 25142", "timestamp_epoch": "1550951430.455767000" } ], "is_private": null, "observable_id": "observable-5ab88b0192618d89a1a7f6a9", "last_seen_epoch": "1550951430.455767000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949987.933921000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cranetisti.com", "evidence": [ { "udp_stream": 73, "frame_number": 6154, "display_filter": "frame.number == 6154", "timestamp_epoch": "1550950402.861168000" }, { "udp_stream": 73, "frame_number": 6155, "display_filter": "frame.number == 6155", "timestamp_epoch": "1550950403.232285000" }, { "tcp_stream": 107, "frame_number": 6159, "display_filter": "frame.number == 6159", "timestamp_epoch": "1550950403.574744000" }, { "tcp_stream": 113, "frame_number": 6270, "display_filter": "frame.number == 6270", "timestamp_epoch": "1550950411.285747000" }, { "tcp_stream": 115, "frame_number": 6272, "display_filter": "frame.number == 6272", "timestamp_epoch": "1550950411.286900000" }, { "tcp_stream": 114, "frame_number": 6274, "display_filter": "frame.number == 6274", "timestamp_epoch": "1550950411.287923000" }, { "tcp_stream": 116, "frame_number": 6319, "display_filter": "frame.number == 6319", "timestamp_epoch": "1550950412.293531000" }, { "tcp_stream": 111, "frame_number": 6321, "display_filter": "frame.number == 6321", "timestamp_epoch": "1550950412.293907000" }, { "tcp_stream": 112, "frame_number": 6325, "display_filter": "frame.number == 6325", "timestamp_epoch": "1550950412.305579000" } ], "is_private": null, "observable_id": "observable-31ab1898522d7d3c52589b1a", "last_seen_epoch": "1550950412.305579000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950402.861168000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "crl.microsoft.com", "evidence": [ { "udp_stream": 97, "frame_number": 15210, "display_filter": "frame.number == 15210", "timestamp_epoch": "1550950826.266512000" }, { "udp_stream": 97, "frame_number": 15218, "display_filter": "frame.number == 15218", "timestamp_epoch": "1550950827.277293000" }, { "udp_stream": 97, "frame_number": 15236, "display_filter": "frame.number == 15236", "timestamp_epoch": "1550950828.291339000" }, { "udp_stream": 97, "frame_number": 15255, "display_filter": "frame.number == 15255", "timestamp_epoch": "1550950830.303739000" }, { "udp_stream": 97, "frame_number": 15455, "display_filter": "frame.number == 15455", "timestamp_epoch": "1550950834.312890000" }, { "udp_stream": 97, "frame_number": 15656, "display_filter": "frame.number == 15656", "timestamp_epoch": "1550950837.917035000" }, { "udp_stream": 98, "frame_number": 15999, "display_filter": "frame.number == 15999", "timestamp_epoch": "1550950846.470491000" }, { "udp_stream": 98, "frame_number": 16108, "display_filter": "frame.number == 16108", "timestamp_epoch": "1550950846.527507000" }, { "tcp_stream": 184, "frame_number": 16113, "display_filter": "frame.number == 16113", "timestamp_epoch": "1550950846.604756000" } ], "is_private": null, "observable_id": "observable-bcbc956267c597bf53b6fdad", "last_seen_epoch": "1550950846.604756000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950826.266512000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dicarkadar.com", "evidence": [ { "udp_stream": 70, "frame_number": 6142, "display_filter": "frame.number == 6142", "timestamp_epoch": "1550950376.282884000" }, { "udp_stream": 70, "frame_number": 6143, "display_filter": "frame.number == 6143", "timestamp_epoch": "1550950376.813125000" } ], "is_private": null, "observable_id": "observable-1e65c65416804373bbda2b82", "last_seen_epoch": "1550950376.813125000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950376.282884000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dns.msftncsi.com", "evidence": [ { "udp_stream": 62, "frame_number": 1440, "display_filter": "frame.number == 1440", "timestamp_epoch": "1550949997.825696000" }, { "udp_stream": 62, "frame_number": 1441, "display_filter": "frame.number == 1441", "timestamp_epoch": "1550949997.877899000" }, { "udp_stream": 63, "frame_number": 1442, "display_filter": "frame.number == 1442", "timestamp_epoch": "1550949997.878519000" }, { "udp_stream": 63, "frame_number": 1443, "display_filter": "frame.number == 1443", "timestamp_epoch": "1550949997.932320000" }, { "udp_stream": 71, "frame_number": 6150, "display_filter": "frame.number == 6150", "timestamp_epoch": "1550950399.114908000" }, { "udp_stream": 71, "frame_number": 6151, "display_filter": "frame.number == 6151", "timestamp_epoch": "1550950399.176094000" }, { "udp_stream": 72, "frame_number": 6152, "display_filter": "frame.number == 6152", "timestamp_epoch": "1550950399.176507000" }, { "udp_stream": 72, "frame_number": 6153, "display_filter": "frame.number == 6153", "timestamp_epoch": "1550950399.176718000" } ], "is_private": null, "observable_id": "observable-a4fcf991cd88b6640e5f2785", "last_seen_epoch": "1550950399.176718000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949997.825696000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "ferguson-win-pc.stormtheory.info", "evidence": [ { "udp_stream": 18, "frame_number": 319, "display_filter": "frame.number == 319", "timestamp_epoch": "1550949884.482276000" }, { "udp_stream": 18, "frame_number": 320, "display_filter": "frame.number == 320", "timestamp_epoch": "1550949884.482553000" } ], "is_private": null, "observable_id": "observable-ec8db8d5f7e2dbe9274dc2be", "last_seen_epoch": "1550949884.482553000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949884.482276000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "fonts.googleapis.com", "evidence": [ { "udp_stream": 50, "frame_number": 1206, "display_filter": "frame.number == 1206", "timestamp_epoch": "1550949985.987562000" }, { "udp_stream": 50, "frame_number": 1267, "display_filter": "frame.number == 1267", "timestamp_epoch": "1550949986.996665000" }, { "udp_stream": 50, "frame_number": 1302, "display_filter": "frame.number == 1302", "timestamp_epoch": "1550949988.010465000" }, { "udp_stream": 50, "frame_number": 1391, "display_filter": "frame.number == 1391", "timestamp_epoch": "1550949990.022897000" }, { "udp_stream": 50, "frame_number": 1417, "display_filter": "frame.number == 1417", "timestamp_epoch": "1550949994.032676000" }, { "udp_stream": 50, "frame_number": 1423, "display_filter": "frame.number == 1423", "timestamp_epoch": "1550949997.308863000" }, { "udp_stream": 61, "frame_number": 1426, "display_filter": "frame.number == 1426", "timestamp_epoch": "1550949997.310632000" }, { "udp_stream": 61, "frame_number": 1427, "display_filter": "frame.number == 1427", "timestamp_epoch": "1550949997.401197000" }, { "udp_stream": 113, "frame_number": 24733, "display_filter": "frame.number == 24733", "timestamp_epoch": "1550951426.961286000" }, { "udp_stream": 113, "frame_number": 24868, "display_filter": "frame.number == 24868", "timestamp_epoch": "1550951427.964847000" }, { "udp_stream": 113, "frame_number": 24990, "display_filter": "frame.number == 24990", "timestamp_epoch": "1550951428.980007000" }, { "udp_stream": 113, "frame_number": 25109, "display_filter": "frame.number == 25109", "timestamp_epoch": "1550951430.255035000" }, { "tcp_stream": 81, "frame_number": 1438, "display_filter": "frame.number == 1438", "timestamp_epoch": "1550949997.768948000" }, { "tcp_stream": 227, "frame_number": 25114, "display_filter": "frame.number == 25114", "timestamp_epoch": "1550951430.317878000" } ], "is_private": null, "observable_id": "observable-e3faf4dc0228f563742dc0b4", "last_seen_epoch": "1550951430.317878000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949985.987562000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "fonts.gstatic.com", "evidence": [ { "udp_stream": 66, "frame_number": 2059, "display_filter": "frame.number == 2059", "timestamp_epoch": "1550950019.929210000" }, { "udp_stream": 66, "frame_number": 2092, "display_filter": "frame.number == 2092", "timestamp_epoch": "1550950020.020502000" }, { "tcp_stream": 95, "frame_number": 2105, "display_filter": "frame.number == 2105", "timestamp_epoch": "1550950020.078881000" }, { "tcp_stream": 94, "frame_number": 2107, "display_filter": "frame.number == 2107", "timestamp_epoch": "1550950020.079078000" } ], "is_private": null, "observable_id": "observable-bb89ee470e00769946f1a702", "last_seen_epoch": "1550950020.079078000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950019.929210000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "googleadapis.l.google.com", "evidence": [ { "udp_stream": 61, "frame_number": 1427, "display_filter": "frame.number == 1427", "timestamp_epoch": "1550949997.401197000" }, { "udp_stream": 113, "frame_number": 25109, "display_filter": "frame.number == 25109", "timestamp_epoch": "1550951430.255035000" } ], "is_private": null, "observable_id": "observable-46ebb9788f7adeed0b75f76d", "last_seen_epoch": "1550951430.255035000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949997.401197000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "gstaticadssl.l.google.com", "evidence": [ { "udp_stream": 66, "frame_number": 2092, "display_filter": "frame.number == 2092", "timestamp_epoch": "1550950020.020502000" } ], "is_private": null, "observable_id": "observable-2aebd2b43c6c317efa5ebaae", "last_seen_epoch": "1550950020.020502000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950020.020502000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "iecvlist.microsoft.com", "evidence": [ { "udp_stream": 65, "frame_number": 1839, "display_filter": "frame.number == 1839", "timestamp_epoch": "1550950013.988524000" }, { "udp_stream": 65, "frame_number": 1840, "display_filter": "frame.number == 1840", "timestamp_epoch": "1550950014.051797000" }, { "udp_stream": 121, "frame_number": 27599, "display_filter": "frame.number == 27599", "timestamp_epoch": "1550951456.440109000" }, { "udp_stream": 121, "frame_number": 27600, "display_filter": "frame.number == 27600", "timestamp_epoch": "1550951456.504409000" }, { "tcp_stream": 84, "frame_number": 1851, "display_filter": "frame.number == 1851", "timestamp_epoch": "1550950014.113030000" }, { "tcp_stream": 85, "frame_number": 1894, "display_filter": "frame.number == 1894", "timestamp_epoch": "1550950015.124585000" }, { "tcp_stream": 240, "frame_number": 27607, "display_filter": "frame.number == 27607", "timestamp_epoch": "1550951456.564916000" }, { "tcp_stream": 239, "frame_number": 27609, "display_filter": "frame.number == 27609", "timestamp_epoch": "1550951456.565048000" } ], "is_private": null, "observable_id": "observable-606a7c320d51cf139ee55455", "last_seen_epoch": "1550951456.565048000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950013.988524000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "ipecho.net", "evidence": [ { "udp_stream": 103, "frame_number": 19780, "display_filter": "frame.number == 19780", "timestamp_epoch": "1550950931.732645000" }, { "udp_stream": 103, "frame_number": 19781, "display_filter": "frame.number == 19781", "timestamp_epoch": "1550950931.792794000" }, { "tcp_stream": 196, "frame_number": 19795, "display_filter": "frame.number == 19795", "timestamp_epoch": "1550950931.858061000" }, { "tcp_stream": 197, "frame_number": 19926, "display_filter": "frame.number == 19926", "timestamp_epoch": "1550950933.352228000" } ], "is_private": null, "observable_id": "observable-a2ef48f518d95db53489c9fa", "last_seen_epoch": "1550950933.352228000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950931.732645000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.localdomain", "evidence": [ { "udp_stream": 16, "frame_number": 300, "display_filter": "frame.number == 300", "timestamp_epoch": "1550949879.597368000" }, { "udp_stream": 16, "frame_number": 301, "display_filter": "frame.number == 301", "timestamp_epoch": "1550949879.597678000" }, { "udp_stream": 22, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1550949914.332048000" }, { "udp_stream": 22, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1550949914.332445000" }, { "udp_stream": 37, "frame_number": 541, "display_filter": "frame.number == 541", "timestamp_epoch": "1550949919.833437000" }, { "udp_stream": 37, "frame_number": 542, "display_filter": "frame.number == 542", "timestamp_epoch": "1550949919.833781000" } ], "is_private": null, "observable_id": "observable-fe46453221fcc838826394aa", "last_seen_epoch": "1550949919.833781000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949879.597368000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "p.typekit.net", "evidence": [ { "udp_stream": 67, "frame_number": 2383, "display_filter": "frame.number == 2383", "timestamp_epoch": "1550950021.748523000" }, { "udp_stream": 67, "frame_number": 2408, "display_filter": "frame.number == 2408", "timestamp_epoch": "1550950021.846199000" }, { "tcp_stream": 99, "frame_number": 2545, "display_filter": "frame.number == 2545", "timestamp_epoch": "1550950022.959876000" }, { "tcp_stream": 98, "frame_number": 2664, "display_filter": "frame.number == 2664", "timestamp_epoch": "1550950023.985041000" } ], "is_private": null, "observable_id": "observable-8ccf22fe83184534659d4ca0", "last_seen_epoch": "1550950023.985041000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950021.748523000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.squarespace.map.fastly.net", "evidence": [ { "udp_stream": 52, "frame_number": 1213, "display_filter": "frame.number == 1213", "timestamp_epoch": "1550949986.211340000" }, { "udp_stream": 60, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1550949997.407985000" } ], "is_private": null, "observable_id": "observable-967a4a2b1d3bf9c410bea3c5", "last_seen_epoch": "1550949997.407985000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949986.211340000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "rootscafeslc.com", "evidence": [ { "udp_stream": 47, "frame_number": 1176, "display_filter": "frame.number == 1176", "timestamp_epoch": "1550949983.441602000" }, { "udp_stream": 47, "frame_number": 1177, "display_filter": "frame.number == 1177", "timestamp_epoch": "1550949983.592832000" }, { "tcp_stream": 72, "frame_number": 1185, "display_filter": "frame.number == 1185", "timestamp_epoch": "1550949984.295684000" } ], "is_private": null, "observable_id": "observable-b5d5a351649d461723ab370c", "last_seen_epoch": "1550949984.295684000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949983.441602000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "static.squarespace.com", "evidence": [ { "udp_stream": 51, "frame_number": 1207, "display_filter": "frame.number == 1207", "timestamp_epoch": "1550949985.989617000" }, { "udp_stream": 51, "frame_number": 1268, "display_filter": "frame.number == 1268", "timestamp_epoch": "1550949986.996850000" }, { "udp_stream": 51, "frame_number": 1301, "display_filter": "frame.number == 1301", "timestamp_epoch": "1550949988.010365000" }, { "udp_stream": 51, "frame_number": 1390, "display_filter": "frame.number == 1390", "timestamp_epoch": "1550949990.022735000" }, { "udp_stream": 51, "frame_number": 1418, "display_filter": "frame.number == 1418", "timestamp_epoch": "1550949994.032774000" }, { "udp_stream": 51, "frame_number": 1421, "display_filter": "frame.number == 1421", "timestamp_epoch": "1550949997.308649000" }, { "udp_stream": 60, "frame_number": 1425, "display_filter": "frame.number == 1425", "timestamp_epoch": "1550949997.309683000" }, { "udp_stream": 60, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1550949997.407985000" }, { "tcp_stream": 82, "frame_number": 1433, "display_filter": "frame.number == 1433", "timestamp_epoch": "1550949997.471468000" }, { "tcp_stream": 92, "frame_number": 2097, "display_filter": "frame.number == 2097", "timestamp_epoch": "1550950020.040042000" }, { "tcp_stream": 93, "frame_number": 2441, "display_filter": "frame.number == 2441", "timestamp_epoch": "1550950022.110604000" } ], "is_private": null, "observable_id": "observable-9841ed77476bc3ffaa1fd325", "last_seen_epoch": "1550950022.110604000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949985.989617000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "static1.squarespace.com", "evidence": [ { "udp_stream": 52, "frame_number": 1212, "display_filter": "frame.number == 1212", "timestamp_epoch": "1550949986.109212000" }, { "udp_stream": 52, "frame_number": 1213, "display_filter": "frame.number == 1213", "timestamp_epoch": "1550949986.211340000" }, { "tcp_stream": 76, "frame_number": 1219, "display_filter": "frame.number == 1219", "timestamp_epoch": "1550949986.299380000" }, { "tcp_stream": 76, "frame_number": 1309, "display_filter": "frame.number == 1309", "timestamp_epoch": "1550949988.157275000" }, { "tcp_stream": 78, "frame_number": 1279, "display_filter": "frame.number == 1279", "timestamp_epoch": "1550949987.324811000" } ], "is_private": null, "observable_id": "observable-477c941c36c1541ea82aee04", "last_seen_epoch": "1550949988.157275000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949986.109212000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "stormtheory-dc.stormtheory.info", "evidence": [ { "udp_stream": 3, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1550949876.448007000" }, { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1550949876.448229000" }, { "udp_stream": 20, "frame_number": 323, "display_filter": "frame.number == 323", "timestamp_epoch": "1550949889.106247000" }, { "udp_stream": 20, "frame_number": 324, "display_filter": "frame.number == 324", "timestamp_epoch": "1550949889.106593000" }, { "udp_stream": 25, "frame_number": 407, "display_filter": "frame.number == 407", "timestamp_epoch": "1550949914.608879000" }, { "udp_stream": 25, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1550949914.609075000" }, { "udp_stream": 38, "frame_number": 545, "display_filter": "frame.number == 545", "timestamp_epoch": "1550949919.924923000" }, { "udp_stream": 38, "frame_number": 546, "display_filter": "frame.number == 546", "timestamp_epoch": "1550949919.925158000" }, { "udp_stream": 82, "frame_number": 10621, "display_filter": "frame.number == 10621", "timestamp_epoch": "1550950711.062623000" }, { "udp_stream": 82, "frame_number": 10622, "display_filter": "frame.number == 10622", "timestamp_epoch": "1550950711.062834000" } ], "is_private": null, "observable_id": "observable-3617b48879e18c4b7bb80ddd", "last_seen_epoch": "1550950711.062834000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949876.448007000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "stormtheory.info", "evidence": [ { "udp_stream": 9, "frame_number": 179, "display_filter": "frame.number == 179", "timestamp_epoch": "1550949877.534398000" }, { "udp_stream": 9, "frame_number": 180, "display_filter": "frame.number == 180", "timestamp_epoch": "1550949877.534662000" }, { "udp_stream": 19, "frame_number": 321, "display_filter": "frame.number == 321", "timestamp_epoch": "1550949884.483779000" }, { "udp_stream": 19, "frame_number": 322, "display_filter": "frame.number == 322", "timestamp_epoch": "1550949884.485879000" }, { "udp_stream": 41, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1550949920.141213000" }, { "udp_stream": 41, "frame_number": 663, "display_filter": "frame.number == 663", "timestamp_epoch": "1550949920.141407000" }, { "udp_stream": 43, "frame_number": 727, "display_filter": "frame.number == 727", "timestamp_epoch": "1550949922.539960000" }, { "udp_stream": 43, "frame_number": 728, "display_filter": "frame.number == 728", "timestamp_epoch": "1550949922.541944000" } ], "is_private": null, "observable_id": "observable-8cc696a71919c005a1cbd1b9", "last_seen_epoch": "1550949922.541944000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949877.534398000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "superhaps.pw", "evidence": [ { "udp_stream": 75, "frame_number": 7506, "display_filter": "frame.number == 7506", "timestamp_epoch": "1550950467.015679000" }, { "udp_stream": 75, "frame_number": 7515, "display_filter": "frame.number == 7515", "timestamp_epoch": "1550950467.267304000" }, { "udp_stream": 79, "frame_number": 10362, "display_filter": "frame.number == 10362", "timestamp_epoch": "1550950709.945992000" }, { "udp_stream": 79, "frame_number": 10363, "display_filter": "frame.number == 10363", "timestamp_epoch": "1550950709.946337000" }, { "udp_stream": 104, "frame_number": 23725, "display_filter": "frame.number == 23725", "timestamp_epoch": "1550951314.065320000" }, { "udp_stream": 104, "frame_number": 23726, "display_filter": "frame.number == 23726", "timestamp_epoch": "1550951314.312083000" }, { "udp_stream": 122, "frame_number": 28423, "display_filter": "frame.number == 28423", "timestamp_epoch": "1550951918.502707000" }, { "udp_stream": 122, "frame_number": 28424, "display_filter": "frame.number == 28424", "timestamp_epoch": "1550951918.866154000" }, { "udp_stream": 123, "frame_number": 28847, "display_filter": "frame.number == 28847", "timestamp_epoch": "1550952526.030101000" }, { "udp_stream": 123, "frame_number": 28848, "display_filter": "frame.number == 28848", "timestamp_epoch": "1550952526.309792000" }, { "tcp_stream": 119, "frame_number": 7524, "display_filter": "frame.number == 7524", "timestamp_epoch": "1550950467.586401000" }, { "tcp_stream": 126, "frame_number": 10375, "display_filter": "frame.number == 10375", "timestamp_epoch": "1550950710.265164000" }, { "tcp_stream": 152, "frame_number": 10992, "display_filter": "frame.number == 10992", "timestamp_epoch": "1550950712.340467000" }, { "tcp_stream": 153, "frame_number": 11017, "display_filter": "frame.number == 11017", "timestamp_epoch": "1550950713.344469000" }, { "tcp_stream": 154, "frame_number": 11019, "display_filter": "frame.number == 11019", "timestamp_epoch": "1550950713.344870000" }, { "tcp_stream": 201, "frame_number": 21130, "display_filter": "frame.number == 21130", "timestamp_epoch": "1550951012.339404000" }, { "tcp_stream": 206, "frame_number": 23730, "display_filter": "frame.number == 23730", "timestamp_epoch": "1550951314.626672000" }, { "tcp_stream": 241, "frame_number": 28298, "display_filter": "frame.number == 28298", "timestamp_epoch": "1550951616.116842000" }, { "tcp_stream": 245, "frame_number": 28428, "display_filter": "frame.number == 28428", "timestamp_epoch": "1550951919.190239000" }, { "tcp_stream": 248, "frame_number": 28538, "display_filter": "frame.number == 28538", "timestamp_epoch": "1550952224.317550000" } ], "is_private": null, "observable_id": "observable-ba8cf8986a1d6f66b96f7c5e", "last_seen_epoch": "1550952526.737606000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950467.015679000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "sutton-win-pc.stormtheory.info", "evidence": [ { "udp_stream": 42, "frame_number": 725, "display_filter": "frame.number == 725", "timestamp_epoch": "1550949922.538276000" }, { "udp_stream": 42, "frame_number": 726, "display_filter": "frame.number == 726", "timestamp_epoch": "1550949922.538610000" }, { "udp_stream": 83, "frame_number": 10955, "display_filter": "frame.number == 10955", "timestamp_epoch": "1550950711.105255000" }, { "udp_stream": 83, "frame_number": 10956, "display_filter": "frame.number == 10956", "timestamp_epoch": "1550950711.107122000" } ], "is_private": null, "observable_id": "observable-578c64f12d70c1da1c45cab8", "last_seen_epoch": "1550950711.107122000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949922.538276000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "use.typekit.net", "evidence": [ { "udp_stream": 49, "frame_number": 1205, "display_filter": "frame.number == 1205", "timestamp_epoch": "1550949985.985154000" }, { "udp_stream": 49, "frame_number": 1269, "display_filter": "frame.number == 1269", "timestamp_epoch": "1550949986.996939000" }, { "udp_stream": 49, "frame_number": 1300, "display_filter": "frame.number == 1300", "timestamp_epoch": "1550949988.010225000" }, { "udp_stream": 49, "frame_number": 1392, "display_filter": "frame.number == 1392", "timestamp_epoch": "1550949990.023081000" }, { "udp_stream": 49, "frame_number": 1419, "display_filter": "frame.number == 1419", "timestamp_epoch": "1550949994.032866000" }, { "udp_stream": 49, "frame_number": 1422, "display_filter": "frame.number == 1422", "timestamp_epoch": "1550949997.308765000" }, { "udp_stream": 64, "frame_number": 1512, "display_filter": "frame.number == 1512", "timestamp_epoch": "1550949999.603647000" }, { "udp_stream": 64, "frame_number": 1515, "display_filter": "frame.number == 1515", "timestamp_epoch": "1550949999.720570000" }, { "tcp_stream": 83, "frame_number": 1526, "display_filter": "frame.number == 1526", "timestamp_epoch": "1550949999.780623000" }, { "tcp_stream": 87, "frame_number": 2072, "display_filter": "frame.number == 2072", "timestamp_epoch": "1550950019.948062000" }, { "tcp_stream": 89, "frame_number": 2074, "display_filter": "frame.number == 2074", "timestamp_epoch": "1550950019.948370000" }, { "tcp_stream": 90, "frame_number": 2076, "display_filter": "frame.number == 2076", "timestamp_epoch": "1550950019.948506000" }, { "tcp_stream": 91, "frame_number": 2078, "display_filter": "frame.number == 2078", "timestamp_epoch": "1550950019.948761000" }, { "tcp_stream": 88, "frame_number": 2080, "display_filter": "frame.number == 2080", "timestamp_epoch": "1550950019.948922000" }, { "tcp_stream": 86, "frame_number": 2082, "display_filter": "frame.number == 2082", "timestamp_epoch": "1550950019.949113000" }, { "tcp_stream": 96, "frame_number": 2208, "display_filter": "frame.number == 2208", "timestamp_epoch": "1550950020.677958000" }, { "tcp_stream": 97, "frame_number": 2381, "display_filter": "frame.number == 2381", "timestamp_epoch": "1550950021.703192000" }, { "tcp_stream": 101, "frame_number": 2551, "display_filter": "frame.number == 2551", "timestamp_epoch": "1550950022.978231000" }, { "tcp_stream": 100, "frame_number": 2552, "display_filter": "frame.number == 2552", "timestamp_epoch": "1550950022.978311000" }, { "tcp_stream": 102, "frame_number": 2709, "display_filter": "frame.number == 2709", "timestamp_epoch": "1550950024.296158000" } ], "is_private": null, "observable_id": "observable-265dac48fe690c1f74a8a65e", "last_seen_epoch": "1550950024.296158000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949985.985154000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.localdomain", "evidence": [ { "udp_stream": 14, "frame_number": 296, "display_filter": "frame.number == 296", "timestamp_epoch": "1550949879.500798000" }, { "udp_stream": 14, "frame_number": 297, "display_filter": "frame.number == 297", "timestamp_epoch": "1550949879.553934000" }, { "udp_stream": 34, "frame_number": 497, "display_filter": "frame.number == 497", "timestamp_epoch": "1550949917.550716000" }, { "udp_stream": 34, "frame_number": 498, "display_filter": "frame.number == 498", "timestamp_epoch": "1550949917.550893000" }, { "udp_stream": 95, "frame_number": 15023, "display_filter": "frame.number == 15023", "timestamp_epoch": "1550950823.597824000" }, { "udp_stream": 95, "frame_number": 15024, "display_filter": "frame.number == 15024", "timestamp_epoch": "1550950823.662806000" }, { "udp_stream": 100, "frame_number": 19107, "display_filter": "frame.number == 19107", "timestamp_epoch": "1550950915.530943000" }, { "udp_stream": 100, "frame_number": 19114, "display_filter": "frame.number == 19114", "timestamp_epoch": "1550950915.620746000" } ], "is_private": null, "observable_id": "observable-27e886cdddc72b4a17e68f0a", "last_seen_epoch": "1550950915.620746000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949879.500798000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.stormtheory.info", "evidence": [ { "udp_stream": 13, "frame_number": 294, "display_filter": "frame.number == 294", "timestamp_epoch": "1550949879.499617000" }, { "udp_stream": 13, "frame_number": 295, "display_filter": "frame.number == 295", "timestamp_epoch": "1550949879.499844000" }, { "udp_stream": 33, "frame_number": 495, "display_filter": "frame.number == 495", "timestamp_epoch": "1550949917.549427000" }, { "udp_stream": 33, "frame_number": 496, "display_filter": "frame.number == 496", "timestamp_epoch": "1550949917.549677000" }, { "udp_stream": 94, "frame_number": 15021, "display_filter": "frame.number == 15021", "timestamp_epoch": "1550950823.596888000" }, { "udp_stream": 94, "frame_number": 15022, "display_filter": "frame.number == 15022", "timestamp_epoch": "1550950823.597365000" }, { "udp_stream": 99, "frame_number": 19105, "display_filter": "frame.number == 19105", "timestamp_epoch": "1550950915.530407000" }, { "udp_stream": 99, "frame_number": 19106, "display_filter": "frame.number == 19106", "timestamp_epoch": "1550950915.530640000" } ], "is_private": null, "observable_id": "observable-97e21e2b8e37edf9510a5e04", "last_seen_epoch": "1550950915.530640000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949879.499617000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "www-googletagmanager.l.google.com", "evidence": [ { "udp_stream": 114, "frame_number": 24759, "display_filter": "frame.number == 24759", "timestamp_epoch": "1550951427.053264000" } ], "is_private": null, "observable_id": "observable-f5e080f6ca048a178c54a862", "last_seen_epoch": "1550951427.053264000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951427.053264000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.bing.com", "evidence": [ { "udp_stream": 55, "frame_number": 1292, "display_filter": "frame.number == 1292", "timestamp_epoch": "1550949987.935983000" }, { "udp_stream": 56, "frame_number": 1293, "display_filter": "frame.number == 1293", "timestamp_epoch": "1550949987.937966000" }, { "udp_stream": 57, "frame_number": 1294, "display_filter": "frame.number == 1294", "timestamp_epoch": "1550949987.938668000" }, { "udp_stream": 58, "frame_number": 1295, "display_filter": "frame.number == 1295", "timestamp_epoch": "1550949987.939588000" }, { "udp_stream": 56, "frame_number": 1303, "display_filter": "frame.number == 1303", "timestamp_epoch": "1550949988.034813000" }, { "udp_stream": 57, "frame_number": 1304, "display_filter": "frame.number == 1304", "timestamp_epoch": "1550949988.034951000" }, { "udp_stream": 58, "frame_number": 1305, "display_filter": "frame.number == 1305", "timestamp_epoch": "1550949988.035045000" }, { "udp_stream": 55, "frame_number": 1306, "display_filter": "frame.number == 1306", "timestamp_epoch": "1550949988.035122000" }, { "udp_stream": 117, "frame_number": 25120, "display_filter": "frame.number == 25120", "timestamp_epoch": "1550951430.384807000" }, { "udp_stream": 118, "frame_number": 25121, "display_filter": "frame.number == 25121", "timestamp_epoch": "1550951430.385017000" }, { "udp_stream": 119, "frame_number": 25122, "display_filter": "frame.number == 25122", "timestamp_epoch": "1550951430.385119000" }, { "udp_stream": 120, "frame_number": 25123, "display_filter": "frame.number == 25123", "timestamp_epoch": "1550951430.385453000" }, { "udp_stream": 118, "frame_number": 25145, "display_filter": "frame.number == 25145", "timestamp_epoch": "1550951430.455991000" }, { "udp_stream": 119, "frame_number": 25147, "display_filter": "frame.number == 25147", "timestamp_epoch": "1550951430.456116000" }, { "udp_stream": 120, "frame_number": 25148, "display_filter": "frame.number == 25148", "timestamp_epoch": "1550951430.456236000" }, { "udp_stream": 117, "frame_number": 25151, "display_filter": "frame.number == 25151", "timestamp_epoch": "1550951430.456347000" }, { "tcp_stream": 79, "frame_number": 1357, "display_filter": "frame.number == 1357", "timestamp_epoch": "1550949989.086110000" }, { "tcp_stream": 232, "frame_number": 25256, "display_filter": "frame.number == 25256", "timestamp_epoch": "1550951431.532822000" } ], "is_private": null, "observable_id": "observable-d552fe92508b5d9f64198eb3", "last_seen_epoch": "1550951431.532822000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949987.935983000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.co.utah.ut.us", "evidence": [ { "udp_stream": 112, "frame_number": 24713, "display_filter": "frame.number == 24713", "timestamp_epoch": "1550951426.323411000" }, { "udp_stream": 112, "frame_number": 24717, "display_filter": "frame.number == 24717", "timestamp_epoch": "1550951426.486292000" }, { "tcp_stream": 215, "frame_number": 24724, "display_filter": "frame.number == 24724", "timestamp_epoch": "1550951426.570470000" }, { "tcp_stream": 216, "frame_number": 24734, "display_filter": "frame.number == 24734", "timestamp_epoch": "1550951426.966829000" }, { "tcp_stream": 217, "frame_number": 24753, "display_filter": "frame.number == 24753", "timestamp_epoch": "1550951427.031893000" }, { "tcp_stream": 223, "frame_number": 24828, "display_filter": "frame.number == 24828", "timestamp_epoch": "1550951427.595681000" }, { "tcp_stream": 224, "frame_number": 24829, "display_filter": "frame.number == 24829", "timestamp_epoch": "1550951427.595969000" }, { "tcp_stream": 215, "frame_number": 25050, "display_filter": "frame.number == 25050", "timestamp_epoch": "1550951429.285375000" }, { "tcp_stream": 219, "frame_number": 25099, "display_filter": "frame.number == 25099", "timestamp_epoch": "1550951430.033640000" }, { "tcp_stream": 220, "frame_number": 25103, "display_filter": "frame.number == 25103", "timestamp_epoch": "1550951430.057131000" }, { "tcp_stream": 229, "frame_number": 25144, "display_filter": "frame.number == 25144", "timestamp_epoch": "1550951430.455912000" }, { "tcp_stream": 230, "frame_number": 25149, "display_filter": "frame.number == 25149", "timestamp_epoch": "1550951430.456252000" }, { "tcp_stream": 215, "frame_number": 25168, "display_filter": "frame.number == 25168", "timestamp_epoch": "1550951430.605082000" }, { "tcp_stream": 229, "frame_number": 25234, "display_filter": "frame.number == 25234", "timestamp_epoch": "1550951431.173776000" }, { "tcp_stream": 219, "frame_number": 25413, "display_filter": "frame.number == 25413", "timestamp_epoch": "1550951433.296277000" }, { "tcp_stream": 223, "frame_number": 25450, "display_filter": "frame.number == 25450", "timestamp_epoch": "1550951433.801767000" }, { "tcp_stream": 229, "frame_number": 25505, "display_filter": "frame.number == 25505", "timestamp_epoch": "1550951434.213427000" }, { "tcp_stream": 224, "frame_number": 25571, "display_filter": "frame.number == 25571", "timestamp_epoch": "1550951434.984633000" }, { "tcp_stream": 223, "frame_number": 25573, "display_filter": "frame.number == 25573", "timestamp_epoch": "1550951434.984812000" }, { "tcp_stream": 226, "frame_number": 25868, "display_filter": "frame.number == 25868", "timestamp_epoch": "1550951438.897816000" } ], "is_private": null, "observable_id": "observable-17d8c2f8ade680b12ad505b5", "last_seen_epoch": "1550951449.806280000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951426.323411000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.download.windowsupdate.com", "evidence": [ { "udp_stream": 74, "frame_number": 6165, "display_filter": "frame.number == 6165", "timestamp_epoch": "1550950404.337831000" }, { "udp_stream": 74, "frame_number": 6167, "display_filter": "frame.number == 6167", "timestamp_epoch": "1550950404.667581000" }, { "udp_stream": 102, "frame_number": 19573, "display_filter": "frame.number == 19573", "timestamp_epoch": "1550950925.101210000" }, { "udp_stream": 102, "frame_number": 19574, "display_filter": "frame.number == 19574", "timestamp_epoch": "1550950925.250935000" }, { "tcp_stream": 108, "frame_number": 6171, "display_filter": "frame.number == 6171", "timestamp_epoch": "1550950405.720515000" }, { "tcp_stream": 195, "frame_number": 19578, "display_filter": "frame.number == 19578", "timestamp_epoch": "1550950926.328163000" } ], "is_private": null, "observable_id": "observable-3fcb0ac9c3ed85076cd3545a", "last_seen_epoch": "1550950926.328163000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950404.337831000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.googletagmanager.com", "evidence": [ { "udp_stream": 114, "frame_number": 24740, "display_filter": "frame.number == 24740", "timestamp_epoch": "1550951426.973506000" }, { "udp_stream": 114, "frame_number": 24759, "display_filter": "frame.number == 24759", "timestamp_epoch": "1550951427.053264000" }, { "tcp_stream": 221, "frame_number": 24769, "display_filter": "frame.number == 24769", "timestamp_epoch": "1550951427.112102000" }, { "tcp_stream": 222, "frame_number": 24771, "display_filter": "frame.number == 24771", "timestamp_epoch": "1550951427.112412000" } ], "is_private": null, "observable_id": "observable-b2384aeb152db2b10f2ac643", "last_seen_epoch": "1550951427.112412000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951426.973506000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.msftncsi.com", "evidence": [ { "udp_stream": 17, "frame_number": 307, "display_filter": "frame.number == 307", "timestamp_epoch": "1550949882.140710000" }, { "udp_stream": 17, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1550949882.246164000" }, { "udp_stream": 44, "frame_number": 745, "display_filter": "frame.number == 745", "timestamp_epoch": "1550949924.687316000" }, { "udp_stream": 44, "frame_number": 746, "display_filter": "frame.number == 746", "timestamp_epoch": "1550949924.782455000" }, { "tcp_stream": 19, "frame_number": 312, "display_filter": "frame.number == 312", "timestamp_epoch": "1550949882.465719000" }, { "tcp_stream": 45, "frame_number": 752, "display_filter": "frame.number == 752", "timestamp_epoch": "1550949924.873662000" } ], "is_private": null, "observable_id": "observable-2ad38cbf0ff8f61b2e6a365d", "last_seen_epoch": "1550949924.873662000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949882.140710000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.rootscafeslc.com", "evidence": [ { "udp_stream": 48, "frame_number": 1191, "display_filter": "frame.number == 1191", "timestamp_epoch": "1550949984.840704000" }, { "udp_stream": 48, "frame_number": 1192, "display_filter": "frame.number == 1192", "timestamp_epoch": "1550949985.000129000" }, { "tcp_stream": 74, "frame_number": 1197, "display_filter": "frame.number == 1197", "timestamp_epoch": "1550949985.110142000" }, { "tcp_stream": 75, "frame_number": 2099, "display_filter": "frame.number == 2099", "timestamp_epoch": "1550950020.077660000" }, { "tcp_stream": 75, "frame_number": 3456, "display_filter": "frame.number == 3456", "timestamp_epoch": "1550950037.861633000" } ], "is_private": null, "observable_id": "observable-eaa97753aa0254526dca06e4", "last_seen_epoch": "1550950037.861633000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949984.840704000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.2.23.1", "evidence": [], "is_private": true, "observable_id": "observable-0816b34b0863a11574b5e875", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.2.23.109", "evidence": [ { "udp_stream": 43, "frame_number": 727, "display_filter": "frame.number == 727", "timestamp_epoch": "1550949922.539960000" }, { "udp_stream": 43, "frame_number": 728, "display_filter": "frame.number == 728", "timestamp_epoch": "1550949922.541944000" }, { "udp_stream": 83, "frame_number": 10956, "display_filter": "frame.number == 10956", "timestamp_epoch": "1550950711.107122000" } ], "is_private": true, "observable_id": "observable-839453eabbe12e4213fa1c0c", "last_seen_epoch": "1550950711.107122000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949922.539960000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.2.23.2", "evidence": [ { "udp_stream": 2, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1550949876.446376000" }, { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1550949876.448229000" }, { "udp_stream": 5, "frame_number": 11, "display_filter": "frame.number == 11", "timestamp_epoch": "1550949876.550993000" }, { "udp_stream": 9, "frame_number": 180, "display_filter": "frame.number == 180", "timestamp_epoch": "1550949877.534662000" }, { "udp_stream": 18, "frame_number": 320, "display_filter": "frame.number == 320", "timestamp_epoch": "1550949884.482553000" }, { "udp_stream": 20, "frame_number": 324, "display_filter": "frame.number == 324", "timestamp_epoch": "1550949889.106593000" }, { "udp_stream": 24, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1550949914.606513000" }, { "udp_stream": 25, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1550949914.609075000" }, { "udp_stream": 27, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1550949914.710748000" }, { "udp_stream": 38, "frame_number": 546, "display_filter": "frame.number == 546", "timestamp_epoch": "1550949919.925158000" }, { "udp_stream": 41, "frame_number": 663, "display_filter": "frame.number == 663", "timestamp_epoch": "1550949920.141407000" }, { "udp_stream": 42, "frame_number": 726, "display_filter": "frame.number == 726", "timestamp_epoch": "1550949922.538610000" }, { "udp_stream": 68, "frame_number": 4396, "display_filter": "frame.number == 4396", "timestamp_epoch": "1550950076.073886000" }, { "udp_stream": 80, "frame_number": 10389, "display_filter": "frame.number == 10389", "timestamp_epoch": "1550950710.839666000" }, { "udp_stream": 82, "frame_number": 10622, "display_filter": "frame.number == 10622", "timestamp_epoch": "1550950711.062834000" }, { "udp_stream": 84, "frame_number": 11291, "display_filter": "frame.number == 11291", "timestamp_epoch": "1550950724.603463000" }, { "udp_stream": 86, "frame_number": 11303, "display_filter": "frame.number == 11303", "timestamp_epoch": "1550950724.706232000" }, { "udp_stream": 88, "frame_number": 12445, "display_filter": "frame.number == 12445", "timestamp_epoch": "1550950760.052750000" }, { "udp_stream": 90, "frame_number": 12458, "display_filter": "frame.number == 12458", "timestamp_epoch": "1550950760.159942000" } ], "is_private": true, "observable_id": "observable-0697f932c1161922eba9f1f3", "last_seen_epoch": "1550950760.159942000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949876.446376000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.2.23.231", "evidence": [ { "udp_stream": 19, "frame_number": 321, "display_filter": "frame.number == 321", "timestamp_epoch": "1550949884.483779000" }, { "udp_stream": 19, "frame_number": 322, "display_filter": "frame.number == 322", "timestamp_epoch": "1550949884.485879000" } ], "is_private": true, "observable_id": "observable-5bac2608fb52f33033ab2c02", "last_seen_epoch": "1550949884.485879000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949884.483779000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.2.23.254", "evidence": [], "is_private": true, "observable_id": "observable-b34e3efa0c38bf0ca50c0f80", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.2.23.255", "evidence": [], "is_private": true, "observable_id": "observable-601e9ae3c9c92d28cd0043bb", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.107.21.200", "evidence": [ { "udp_stream": 56, "frame_number": 1303, "display_filter": "frame.number == 1303", "timestamp_epoch": "1550949988.034813000" }, { "udp_stream": 57, "frame_number": 1304, "display_filter": "frame.number == 1304", "timestamp_epoch": "1550949988.034951000" }, { "udp_stream": 58, "frame_number": 1305, "display_filter": "frame.number == 1305", "timestamp_epoch": "1550949988.035045000" }, { "udp_stream": 55, "frame_number": 1306, "display_filter": "frame.number == 1306", "timestamp_epoch": "1550949988.035122000" }, { "udp_stream": 118, "frame_number": 25145, "display_filter": "frame.number == 25145", "timestamp_epoch": "1550951430.455991000" }, { "udp_stream": 119, "frame_number": 25147, "display_filter": "frame.number == 25147", "timestamp_epoch": "1550951430.456116000" }, { "udp_stream": 120, "frame_number": 25148, "display_filter": "frame.number == 25148", "timestamp_epoch": "1550951430.456236000" }, { "udp_stream": 117, "frame_number": 25151, "display_filter": "frame.number == 25151", "timestamp_epoch": "1550951430.456347000" } ], "is_private": false, "observable_id": "observable-72f93d5d58f456e9328aa6c5", "last_seen_epoch": "1550951430.456347000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949988.034813000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.107.5.80", "evidence": [ { "udp_stream": 54, "frame_number": 1298, "display_filter": "frame.number == 1298", "timestamp_epoch": "1550949987.996656000" }, { "udp_stream": 53, "frame_number": 1299, "display_filter": "frame.number == 1299", "timestamp_epoch": "1550949987.996754000" }, { "udp_stream": 116, "frame_number": 25140, "display_filter": "frame.number == 25140", "timestamp_epoch": "1550951430.455619000" }, { "udp_stream": 115, "frame_number": 25142, "display_filter": "frame.number == 25142", "timestamp_epoch": "1550951430.455767000" } ], "is_private": false, "observable_id": "observable-965f3d7b22b1aaac55e15d60", "last_seen_epoch": "1550951430.455767000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949987.996656000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "131.107.255.255", "evidence": [ { "udp_stream": 62, "frame_number": 1441, "display_filter": "frame.number == 1441", "timestamp_epoch": "1550949997.877899000" }, { "udp_stream": 71, "frame_number": 6151, "display_filter": "frame.number == 6151", "timestamp_epoch": "1550950399.176094000" } ], "is_private": false, "observable_id": "observable-4555b48b0e93d4e1089077dd", "last_seen_epoch": "1550950399.176094000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949997.877899000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.0.238", "evidence": [ { "udp_stream": 52, "frame_number": 1213, "display_filter": "frame.number == 1213", "timestamp_epoch": "1550949986.211340000" }, { "udp_stream": 60, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1550949997.407985000" } ], "is_private": false, "observable_id": "observable-fc42e550e0da4b24c149e154", "last_seen_epoch": "1550949997.407985000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949986.211340000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.128.238", "evidence": [ { "udp_stream": 52, "frame_number": 1213, "display_filter": "frame.number == 1213", "timestamp_epoch": "1550949986.211340000" }, { "udp_stream": 60, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1550949997.407985000" } ], "is_private": false, "observable_id": "observable-ef2c107b10edc7271a3b3586", "last_seen_epoch": "1550949997.407985000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949986.211340000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.192.238", "evidence": [ { "udp_stream": 52, "frame_number": 1213, "display_filter": "frame.number == 1213", "timestamp_epoch": "1550949986.211340000" }, { "udp_stream": 60, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1550949997.407985000" } ], "is_private": false, "observable_id": "observable-c0eac9e32352500dc84ff5a7", "last_seen_epoch": "1550949997.407985000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949986.211340000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.64.238", "evidence": [ { "udp_stream": 52, "frame_number": 1213, "display_filter": "frame.number == 1213", "timestamp_epoch": "1550949986.211340000" }, { "udp_stream": 60, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1550949997.407985000" } ], "is_private": false, "observable_id": "observable-a9bd11f53acfa0814c11c929", "last_seen_epoch": "1550949997.407985000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949986.211340000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "161.119.42.22", "evidence": [ { "udp_stream": 112, "frame_number": 24717, "display_filter": "frame.number == 24717", "timestamp_epoch": "1550951426.486292000" } ], "is_private": false, "observable_id": "observable-ec4096f0b104f8e5d0b3391a", "last_seen_epoch": "1550951426.486292000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951426.486292000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.1.200", "evidence": [ { "udp_stream": 114, "frame_number": 24759, "display_filter": "frame.number == 24759", "timestamp_epoch": "1550951427.053264000" } ], "is_private": false, "observable_id": "observable-15ff862b800c0d39d1b700fc", "last_seen_epoch": "1550951427.053264000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951427.053264000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.2.10", "evidence": [ { "udp_stream": 61, "frame_number": 1427, "display_filter": "frame.number == 1427", "timestamp_epoch": "1550949997.401197000" }, { "udp_stream": 113, "frame_number": 25109, "display_filter": "frame.number == 25109", "timestamp_epoch": "1550951430.255035000" } ], "is_private": false, "observable_id": "observable-74d9217689ef7b84c3039cc4", "last_seen_epoch": "1550951430.255035000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949997.401197000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.2.3", "evidence": [ { "udp_stream": 66, "frame_number": 2092, "display_filter": "frame.number == 2092", "timestamp_epoch": "1550950020.020502000" } ], "is_private": false, "observable_id": "observable-fb353827abc42e775c29e637", "last_seen_epoch": "1550950020.020502000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950020.020502000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "181.215.47.171", "evidence": [ { "udp_stream": 70, "frame_number": 6143, "display_filter": "frame.number == 6143", "timestamp_epoch": "1550950376.813125000" } ], "is_private": false, "observable_id": "observable-6e3a5454404bd81f6744e3c3", "last_seen_epoch": "1550950376.813125000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950376.813125000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.246.116.239", "evidence": [ { "udp_stream": 73, "frame_number": 6155, "display_filter": "frame.number == 6155", "timestamp_epoch": "1550950403.232285000" } ], "is_private": false, "observable_id": "observable-cb55a28a3892556f716734f3", "last_seen_epoch": "1550950403.232285000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950403.232285000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "190.146.112.216", "evidence": [ { "tcp_stream": 207, "frame_number": 23794, "display_filter": "frame.number == 23794", "timestamp_epoch": "1550951353.371777000" }, { "tcp_stream": 208, "frame_number": 23816, "display_filter": "frame.number == 23816", "timestamp_epoch": "1550951355.921398000" }, { "tcp_stream": 212, "frame_number": 24666, "display_filter": "frame.number == 24666", "timestamp_epoch": "1550951415.192699000" }, { "tcp_stream": 237, "frame_number": 26591, "display_filter": "frame.number == 26591", "timestamp_epoch": "1550951444.371220000" } ], "is_private": false, "observable_id": "observable-db1013cdbef509ee4266e470", "last_seen_epoch": "1550951444.371220000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951353.371777000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "195.123.246.99", "evidence": [], "is_private": false, "observable_id": "observable-40ec586e098e0a020e3adfcb", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "198.185.159.135", "evidence": [ { "udp_stream": 48, "frame_number": 1192, "display_filter": "frame.number == 1192", "timestamp_epoch": "1550949985.000129000" } ], "is_private": false, "observable_id": "observable-59ca07ea1d2bb1e7a63315cb", "last_seen_epoch": "1550949985.000129000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949985.000129000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "198.185.159.136", "evidence": [ { "udp_stream": 47, "frame_number": 1177, "display_filter": "frame.number == 1177", "timestamp_epoch": "1550949983.592832000" } ], "is_private": false, "observable_id": "observable-d834e098bb2a986ace1f42f7", "last_seen_epoch": "1550949983.592832000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949983.592832000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.79.197.200", "evidence": [ { "udp_stream": 56, "frame_number": 1303, "display_filter": "frame.number == 1303", "timestamp_epoch": "1550949988.034813000" }, { "udp_stream": 57, "frame_number": 1304, "display_filter": "frame.number == 1304", "timestamp_epoch": "1550949988.034951000" }, { "udp_stream": 58, "frame_number": 1305, "display_filter": "frame.number == 1305", "timestamp_epoch": "1550949988.035045000" }, { "udp_stream": 55, "frame_number": 1306, "display_filter": "frame.number == 1306", "timestamp_epoch": "1550949988.035122000" }, { "udp_stream": 118, "frame_number": 25145, "display_filter": "frame.number == 25145", "timestamp_epoch": "1550951430.455991000" }, { "udp_stream": 119, "frame_number": 25147, "display_filter": "frame.number == 25147", "timestamp_epoch": "1550951430.456116000" }, { "udp_stream": 120, "frame_number": 25148, "display_filter": "frame.number == 25148", "timestamp_epoch": "1550951430.456236000" }, { "udp_stream": 117, "frame_number": 25151, "display_filter": "frame.number == 25151", "timestamp_epoch": "1550951430.456347000" } ], "is_private": false, "observable_id": "observable-144b1028560c7a04c96dc444", "last_seen_epoch": "1550951430.456347000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949988.034813000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "209.141.55.226", "evidence": [ { "tcp_stream": 105, "frame_number": 3119, "display_filter": "frame.number == 3119", "timestamp_epoch": "1550950028.171418000" } ], "is_private": false, "observable_id": "observable-170b01c66f1a9e349c03023e", "last_seen_epoch": "1550950028.171418000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950028.171418000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "213.226.68.112", "evidence": [], "is_private": false, "observable_id": "observable-b2925bf1f32b2e52d2ea1ae1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.239.32.21", "evidence": [ { "udp_stream": 103, "frame_number": 19781, "display_filter": "frame.number == 19781", "timestamp_epoch": "1550950931.792794000" } ], "is_private": false, "observable_id": "observable-f7bd398c4b34d04a8d8294dd", "last_seen_epoch": "1550950931.792794000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950931.792794000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.239.34.21", "evidence": [ { "udp_stream": 103, "frame_number": 19781, "display_filter": "frame.number == 19781", "timestamp_epoch": "1550950931.792794000" } ], "is_private": false, "observable_id": "observable-ed81a714cbdde9f234a46d95", "last_seen_epoch": "1550950931.792794000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950931.792794000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.239.36.21", "evidence": [ { "udp_stream": 103, "frame_number": 19781, "display_filter": "frame.number == 19781", "timestamp_epoch": "1550950931.792794000" } ], "is_private": false, "observable_id": "observable-54a5cb27a21a943e24e2ccd3", "last_seen_epoch": "1550950931.792794000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950931.792794000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.239.38.21", "evidence": [ { "udp_stream": 103, "frame_number": 19781, "display_filter": "frame.number == 19781", "timestamp_epoch": "1550950931.792794000" } ], "is_private": false, "observable_id": "observable-33b33e296d4261b8060fa538", "last_seen_epoch": "1550950931.792794000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950931.792794000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-ee77a7ead2aca761a3661c86", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-c53e7cb4b8bee40eec6e9b26", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.218.156.10", "evidence": [ { "udp_stream": 98, "frame_number": 16108, "display_filter": "frame.number == 16108", "timestamp_epoch": "1550950846.527507000" } ], "is_private": false, "observable_id": "observable-3a035cb96b9ba098546424af", "last_seen_epoch": "1550950846.527507000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950846.527507000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.218.156.17", "evidence": [ { "udp_stream": 98, "frame_number": 16108, "display_filter": "frame.number == 16108", "timestamp_epoch": "1550950846.527507000" } ], "is_private": false, "observable_id": "observable-e2b4867c1c13ccbe22856007", "last_seen_epoch": "1550950846.527507000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950846.527507000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.223.195.33", "evidence": [ { "udp_stream": 17, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1550949882.246164000" }, { "udp_stream": 44, "frame_number": 746, "display_filter": "frame.number == 746", "timestamp_epoch": "1550949924.782455000" } ], "is_private": false, "observable_id": "observable-4b1e9edaf92aa129b16e4ac7", "last_seen_epoch": "1550949924.782455000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949882.246164000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.223.195.42", "evidence": [ { "udp_stream": 17, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1550949882.246164000" }, { "udp_stream": 44, "frame_number": 746, "display_filter": "frame.number == 746", "timestamp_epoch": "1550949924.782455000" } ], "is_private": false, "observable_id": "observable-2a1cfdd7864de2960d62d226", "last_seen_epoch": "1550949924.782455000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949882.246164000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.63.25.226", "evidence": [ { "udp_stream": 64, "frame_number": 1515, "display_filter": "frame.number == 1515", "timestamp_epoch": "1550949999.720570000" }, { "udp_stream": 67, "frame_number": 2408, "display_filter": "frame.number == 2408", "timestamp_epoch": "1550950021.846199000" } ], "is_private": false, "observable_id": "observable-0a40093d25eeafd62d8aa4fa", "last_seen_epoch": "1550950021.846199000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949999.720570000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "255.255.255.255", "evidence": [], "is_private": true, "observable_id": "observable-4ca24b6b1a0abbc75229999b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "46.249.62.199", "evidence": [ { "tcp_stream": 110, "frame_number": 6249, "display_filter": "frame.number == 6249", "timestamp_epoch": "1550950410.137505000" }, { "tcp_stream": 109, "frame_number": 6262, "display_filter": "frame.number == 6262", "timestamp_epoch": "1550950411.127146000" } ], "is_private": false, "observable_id": "observable-6684b889cd33370be446e822", "last_seen_epoch": "1550950411.127146000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950410.137505000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "67.26.187.254", "evidence": [ { "udp_stream": 74, "frame_number": 6167, "display_filter": "frame.number == 6167", "timestamp_epoch": "1550950404.667581000" } ], "is_private": false, "observable_id": "observable-512eb42e3e8dbc3ed82c3589", "last_seen_epoch": "1550950404.667581000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950404.667581000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.21.81.200", "evidence": [ { "udp_stream": 65, "frame_number": 1840, "display_filter": "frame.number == 1840", "timestamp_epoch": "1550950014.051797000" }, { "udp_stream": 121, "frame_number": 27600, "display_filter": "frame.number == 27600", "timestamp_epoch": "1550951456.504409000" } ], "is_private": false, "observable_id": "observable-506125efb62da8b3e2661904", "last_seen_epoch": "1550951456.504409000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950014.051797000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.21.81.240", "evidence": [ { "udp_stream": 102, "frame_number": 19574, "display_filter": "frame.number == 19574", "timestamp_epoch": "1550950925.250935000" } ], "is_private": false, "observable_id": "observable-6f6acdb0395da1c4f28c9d34", "last_seen_epoch": "1550950925.250935000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950925.250935000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "8.252.15.254", "evidence": [ { "udp_stream": 74, "frame_number": 6167, "display_filter": "frame.number == 6167", "timestamp_epoch": "1550950404.667581000" } ], "is_private": false, "observable_id": "observable-b30d57f8a81a6fcd6bfdfacf", "last_seen_epoch": "1550950404.667581000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950404.667581000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "8.252.250.126", "evidence": [ { "udp_stream": 74, "frame_number": 6167, "display_filter": "frame.number == 6167", "timestamp_epoch": "1550950404.667581000" } ], "is_private": false, "observable_id": "observable-afb24c987db76f525ded2f87", "last_seen_epoch": "1550950404.667581000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950404.667581000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "8.253.129.66", "evidence": [ { "udp_stream": 74, "frame_number": 6167, "display_filter": "frame.number == 6167", "timestamp_epoch": "1550950404.667581000" } ], "is_private": false, "observable_id": "observable-b5b72c3e2dc64df2121cb66d", "last_seen_epoch": "1550950404.667581000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950404.667581000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "8.253.203.254", "evidence": [ { "udp_stream": 74, "frame_number": 6167, "display_filter": "frame.number == 6167", "timestamp_epoch": "1550950404.667581000" } ], "is_private": false, "observable_id": "observable-0831296c9c4fbe988381749a", "last_seen_epoch": "1550950404.667581000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950404.667581000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "85.143.218.7", "evidence": [ { "tcp_stream": 150, "frame_number": 10966, "display_filter": "frame.number == 10966", "timestamp_epoch": "1550950711.324212000" }, { "tcp_stream": 161, "frame_number": 11986, "display_filter": "frame.number == 11986", "timestamp_epoch": "1550950744.487874000" }, { "tcp_stream": 200, "frame_number": 20146, "display_filter": "frame.number == 20146", "timestamp_epoch": "1550950940.188912000" } ], "is_private": false, "observable_id": "observable-25485a8aa76cec11e08dbcf8", "last_seen_epoch": "1550950940.188912000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950711.324212000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "87.236.22.142", "evidence": [ { "udp_stream": 75, "frame_number": 7515, "display_filter": "frame.number == 7515", "timestamp_epoch": "1550950467.267304000" }, { "udp_stream": 79, "frame_number": 10363, "display_filter": "frame.number == 10363", "timestamp_epoch": "1550950709.946337000" }, { "udp_stream": 104, "frame_number": 23726, "display_filter": "frame.number == 23726", "timestamp_epoch": "1550951314.312083000" }, { "udp_stream": 122, "frame_number": 28424, "display_filter": "frame.number == 28424", "timestamp_epoch": "1550951918.866154000" }, { "udp_stream": 123, "frame_number": 28848, "display_filter": "frame.number == 28848", "timestamp_epoch": "1550952526.309792000" } ], "is_private": false, "observable_id": "observable-f9b8591529ee2e2b16c6d3f0", "last_seen_epoch": "1550952526.309792000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950467.267304000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "92.223.105.176", "evidence": [], "is_private": false, "observable_id": "observable-94d626ba8a5a2d89fc0903db", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "94.103.95.185", "evidence": [], "is_private": false, "observable_id": "observable-1fadd1d0c842aa14150fafcf", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv6", "roles": [ "dns-answer" ], "value": "fd3e:4f5a:5b81::1", "evidence": [ { "udp_stream": 63, "frame_number": 1443, "display_filter": "frame.number == 1443", "timestamp_epoch": "1550949997.932320000" }, { "udp_stream": 72, "frame_number": 6153, "display_filter": "frame.number == 6153", "timestamp_epoch": "1550950399.176718000" } ], "is_private": true, "observable_id": "observable-f26d44700504b0160296b9d0", "last_seen_epoch": "1550950399.176718000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949997.932320000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "1d095e68489d3c535297cd8dffb06cb9", "evidence": [ { "tcp_stream": 107, "frame_number": 6159, "display_filter": "frame.number == 6159", "timestamp_epoch": "1550950403.574744000" }, { "tcp_stream": 113, "frame_number": 6270, "display_filter": "frame.number == 6270", "timestamp_epoch": "1550950411.285747000" }, { "tcp_stream": 115, "frame_number": 6272, "display_filter": "frame.number == 6272", "timestamp_epoch": "1550950411.286900000" }, { "tcp_stream": 114, "frame_number": 6274, "display_filter": "frame.number == 6274", "timestamp_epoch": "1550950411.287923000" }, { "tcp_stream": 116, "frame_number": 6319, "display_filter": "frame.number == 6319", "timestamp_epoch": "1550950412.293531000" }, { "tcp_stream": 111, "frame_number": 6321, "display_filter": "frame.number == 6321", "timestamp_epoch": "1550950412.293907000" }, { "tcp_stream": 112, "frame_number": 6325, "display_filter": "frame.number == 6325", "timestamp_epoch": "1550950412.305579000" }, { "tcp_stream": 126, "frame_number": 10375, "display_filter": "frame.number == 10375", "timestamp_epoch": "1550950710.265164000" }, { "tcp_stream": 152, "frame_number": 10992, "display_filter": "frame.number == 10992", "timestamp_epoch": "1550950712.340467000" }, { "tcp_stream": 153, "frame_number": 11017, "display_filter": "frame.number == 11017", "timestamp_epoch": "1550950713.344469000" }, { "tcp_stream": 154, "frame_number": 11019, "display_filter": "frame.number == 11019", "timestamp_epoch": "1550950713.344870000" }, { "tcp_stream": 197, "frame_number": 19926, "display_filter": "frame.number == 19926", "timestamp_epoch": "1550950933.352228000" }, { "tcp_stream": 201, "frame_number": 21130, "display_filter": "frame.number == 21130", "timestamp_epoch": "1550951012.339404000" }, { "tcp_stream": 206, "frame_number": 23730, "display_filter": "frame.number == 23730", "timestamp_epoch": "1550951314.626672000" }, { "tcp_stream": 241, "frame_number": 28298, "display_filter": "frame.number == 28298", "timestamp_epoch": "1550951616.116842000" }, { "tcp_stream": 245, "frame_number": 28428, "display_filter": "frame.number == 28428", "timestamp_epoch": "1550951919.190239000" }, { "tcp_stream": 248, "frame_number": 28538, "display_filter": "frame.number == 28538", "timestamp_epoch": "1550952224.317550000" }, { "tcp_stream": 250, "frame_number": 28852, "display_filter": "frame.number == 28852", "timestamp_epoch": "1550952526.737606000" } ], "is_private": null, "observable_id": "observable-f401cda0b51fb41d05380a0b", "last_seen_epoch": "1550952526.737606000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950403.574744000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "4d7a28d6f2263ed61de88ca66eb011e3", "evidence": [ { "tcp_stream": 78, "frame_number": 1279, "display_filter": "frame.number == 1279", "timestamp_epoch": "1550949987.324811000" }, { "tcp_stream": 84, "frame_number": 1851, "display_filter": "frame.number == 1851", "timestamp_epoch": "1550950014.113030000" }, { "tcp_stream": 85, "frame_number": 1894, "display_filter": "frame.number == 1894", "timestamp_epoch": "1550950015.124585000" }, { "tcp_stream": 87, "frame_number": 2072, "display_filter": "frame.number == 2072", "timestamp_epoch": "1550950019.948062000" }, { "tcp_stream": 89, "frame_number": 2074, "display_filter": "frame.number == 2074", "timestamp_epoch": "1550950019.948370000" }, { "tcp_stream": 90, "frame_number": 2076, "display_filter": "frame.number == 2076", "timestamp_epoch": "1550950019.948506000" }, { "tcp_stream": 91, "frame_number": 2078, "display_filter": "frame.number == 2078", "timestamp_epoch": "1550950019.948761000" }, { "tcp_stream": 88, "frame_number": 2080, "display_filter": "frame.number == 2080", "timestamp_epoch": "1550950019.948922000" }, { "tcp_stream": 86, "frame_number": 2082, "display_filter": "frame.number == 2082", "timestamp_epoch": "1550950019.949113000" }, { "tcp_stream": 92, "frame_number": 2097, "display_filter": "frame.number == 2097", "timestamp_epoch": "1550950020.040042000" }, { "tcp_stream": 96, "frame_number": 2208, "display_filter": "frame.number == 2208", "timestamp_epoch": "1550950020.677958000" }, { "tcp_stream": 97, "frame_number": 2381, "display_filter": "frame.number == 2381", "timestamp_epoch": "1550950021.703192000" }, { "tcp_stream": 93, "frame_number": 2441, "display_filter": "frame.number == 2441", "timestamp_epoch": "1550950022.110604000" }, { "tcp_stream": 99, "frame_number": 2545, "display_filter": "frame.number == 2545", "timestamp_epoch": "1550950022.959876000" }, { "tcp_stream": 101, "frame_number": 2551, "display_filter": "frame.number == 2551", "timestamp_epoch": "1550950022.978231000" }, { "tcp_stream": 100, "frame_number": 2552, "display_filter": "frame.number == 2552", "timestamp_epoch": "1550950022.978311000" }, { "tcp_stream": 98, "frame_number": 2664, "display_filter": "frame.number == 2664", "timestamp_epoch": "1550950023.985041000" }, { "tcp_stream": 102, "frame_number": 2709, "display_filter": "frame.number == 2709", "timestamp_epoch": "1550950024.296158000" }, { "tcp_stream": 221, "frame_number": 24769, "display_filter": "frame.number == 24769", "timestamp_epoch": "1550951427.112102000" }, { "tcp_stream": 222, "frame_number": 24771, "display_filter": "frame.number == 24771", "timestamp_epoch": "1550951427.112412000" } ], "is_private": null, "observable_id": "observable-9652a8208764d29ffd75f562", "last_seen_epoch": "1550951456.565048000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949987.324811000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "6734f37431670b3ab4292b8f60f29984", "evidence": [ { "tcp_stream": 192, "frame_number": 19095, "display_filter": "frame.number == 19095", "timestamp_epoch": "1550950914.026542000" }, { "tcp_stream": 198, "frame_number": 19961, "display_filter": "frame.number == 19961", "timestamp_epoch": "1550950935.540528000" }, { "tcp_stream": 202, "frame_number": 21841, "display_filter": "frame.number == 21841", "timestamp_epoch": "1550951099.148760000" }, { "tcp_stream": 204, "frame_number": 23651, "display_filter": "frame.number == 23651", "timestamp_epoch": "1550951299.251853000" }, { "tcp_stream": 205, "frame_number": 23667, "display_filter": "frame.number == 23667", "timestamp_epoch": "1550951301.629976000" }, { "tcp_stream": 209, "frame_number": 23864, "display_filter": "frame.number == 23864", "timestamp_epoch": "1550951379.114063000" }, { "tcp_stream": 244, "frame_number": 28371, "display_filter": "frame.number == 28371", "timestamp_epoch": "1550951733.552861000" }, { "tcp_stream": 246, "frame_number": 28446, "display_filter": "frame.number == 28446", "timestamp_epoch": "1550951936.050671000" }, { "tcp_stream": 247, "frame_number": 28504, "display_filter": "frame.number == 28504", "timestamp_epoch": "1550952138.813188000" }, { "tcp_stream": 249, "frame_number": 28573, "display_filter": "frame.number == 28573", "timestamp_epoch": "1550952341.405205000" }, { "tcp_stream": 251, "frame_number": 28876, "display_filter": "frame.number == 28876", "timestamp_epoch": "1550952581.016068000" } ], "is_private": null, "observable_id": "observable-fd36d5d2fa68266aec9ecc63", "last_seen_epoch": "1550952581.016068000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950914.026542000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "152f05b79c5f8ae61dce111c5415be105396ad820f3fc3cd537b0aaa2acd8d58", "evidence": [], "is_private": null, "observable_id": "observable-4fcc2ba9609091979e1d64ab", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "17ef1c0ff8515ab325b5976632264553118a2618e5e8dcf3ff058dee515ab738", "evidence": [], "is_private": null, "observable_id": "observable-ff7f6c8a102e82f6d0b85ae5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1fee1ef37060734fe38728af41fad66a827abb34151a3658ceee6000d4df40b2", "evidence": [], "is_private": null, "observable_id": "observable-98b2a62ec437856e716017b5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3362bbc3aeca0b9a3e74c27568033c566350d30214cfa383b470327ec2ac8c07", "evidence": [], "is_private": null, "observable_id": "observable-1bb8b8543606b4e692ca3b8e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "33c2fde7c0162c50e4450e874c99a13a086a56db266d8962bd7d31bdb08956f3", "evidence": [], "is_private": null, "observable_id": "observable-71add15f2538ccd5ef9de531", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "351e3c9dadd0128ea718633173e073a6f7a3d9bf6a1ce173bff2221cb3b0afae", "evidence": [], "is_private": null, "observable_id": "observable-ce74f34c8bbf4a023011258e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "360daaf74aa6a7e36952e66764a76de6b6a1a48bcbbad611288396ead6f733bb", "evidence": [], "is_private": null, "observable_id": "observable-464a66892443e3879ed5011c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "38c6c5b8d6fa71d9856758a5c0c2ac9d0a0a1450f75bb1004dd988e23d73a312", "evidence": [], "is_private": null, "observable_id": "observable-b20ca00bbd92de471ea68adb", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3abae6dd2ddae23b2de2ccbcc160a4a5773bef8934d0e6896d50197c3d3c417f", "evidence": [], "is_private": null, "observable_id": "observable-280ea17d1444a818aab8c47f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3c4ec495f17d21cc236bc7238bc02728bd945c07157fbf875cac340269afc207", "evidence": [], "is_private": null, "observable_id": "observable-39f209a6bba2310f670a2f55", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "evidence": [], "is_private": null, "observable_id": "observable-c883ceb6c60bac3290b24648", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "44373d4e4bea5c974656b41b630eae6519b62aeb4889277034ba7925c01bb60f", "evidence": [], "is_private": null, "observable_id": "observable-759cc4bbb8f93091e01ee60b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4c957072ab097d3474039f432466cd251d1dc7d91559b76d4e5ead4a8bd499d5", "evidence": [], "is_private": null, "observable_id": "observable-3269f326bdd038cdfa2e9421", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "51cd2200fde479b2d57db744c846f9c83dbefe967e10efa510a0eecf644ac2ac", "evidence": [], "is_private": null, "observable_id": "observable-8d528f0af13bd19e60a6b362", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "592e7fa07596b36f577e4a703c8614d98c6602b3fbafd6cf94026aadc109ee42", "evidence": [], "is_private": null, "observable_id": "observable-13c8a47dcfaa750a6273854f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5aeb07f9980663c2501c9620371e11ae7aa6e320d94dd753d0ef56d8308c74b3", "evidence": [], "is_private": null, "observable_id": "observable-402a6641caaad340f1a9dc42", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [], "is_private": null, "observable_id": "observable-e187e6ddd23eff995a401b14", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6281f4b88789d78a3520cea62298a5d76562a5ac5a265c915f58ab46e90773bf", "evidence": [], "is_private": null, "observable_id": "observable-9381476bf76d8b483b2ed59b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "63e2dc2b85defb87378e12ecd7d0f4631d37fcf42152acf2a28ae7453b40633c", "evidence": [], "is_private": null, "observable_id": "observable-fc2a01bc43e4811640783d76", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "640994b0bf9615de96e00f0344d84c56ff04eff2f47e99ebf0c9ea7fa6ba3502", "evidence": [], "is_private": null, "observable_id": "observable-76ca49464d86ec49c6f5b9cf", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6736e7a0746fbcfef21feae864dda1ae4e888d3ea1d5cea115c71849e47e787a", "evidence": [], "is_private": null, "observable_id": "observable-e23a3dc785f0cd3636c156a0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6b6bf68b59a71f79863bf3b342b6dba38c2dbb76814deea82250c513517ddb19", "evidence": [], "is_private": null, "observable_id": "observable-d6ac6571e1acb2b39b239f05", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6bb03471d2a729fd037bb0f8b42854c3b9d14e87e7bc9b337ed2274a74a0a3c4", "evidence": [], "is_private": null, "observable_id": "observable-f6e3a3080e5a04bef75002bd", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914", "evidence": [], "is_private": null, "observable_id": "observable-101e0cfd50734ea8aad47853", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6ee67e7ec3881929e6d6f2bf4e761fb44d04b84b5e77f1df7ef3c05a698484ee", "evidence": [], "is_private": null, "observable_id": "observable-ce7e08bcc569633103c37756", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "71a22598eedbbdedd0ba95f9fbf4a19726abf69681462f56cf535f4fd505a079", "evidence": [], "is_private": null, "observable_id": "observable-319bb4a74f7ce96c55ad8104", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "77ab5e18a4c52fe1b402ca8907ad3315c19e1fb7ed19aaa03f1fb3070cd286b1", "evidence": [], "is_private": null, "observable_id": "observable-3973f8623feb3c413e031a75", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7898a2dbfd52591cf085b2743c0f2eaa750143b77a8cfebfbbf23d692bc4d846", "evidence": [], "is_private": null, "observable_id": "observable-c0495ef846493aaddfbcdc28", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "810151e2aa23d212c5105db84e9eb16a76bb589eacfd4bc5a287a092c2ef71fa", "evidence": [], "is_private": null, "observable_id": "observable-3d5edcd90db3b223e66cc36e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8cf2cddda8522975a22da3da429339be471234eacc0e11c099d6dcb732cf3cbb", "evidence": [], "is_private": null, "observable_id": "observable-7e5e4969aa04010eaee019e3", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9801c1c9ecc18a5361fbb2188614518c84837fd23cdcc5dafde214c7efc5ba61", "evidence": [], "is_private": null, "observable_id": "observable-c33d3cc0b06519b804273a79", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9a9eef92488fae7c9199a57abe8fe52dfbabfd4884a150cde674f86304748c84", "evidence": [], "is_private": null, "observable_id": "observable-08dac1f725f9cf7701f6b7ef", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a7325536819e47e298d38720b60ecb4c6ca63ebf07df04e768ee95d92c854e17", "evidence": [], "is_private": null, "observable_id": "observable-5e02afc119160ffd710e0df4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "aaa1afd7ae3a37dd93a8b19408e2770eaee666932366bf4e1703533148914076", "evidence": [], "is_private": null, "observable_id": "observable-6d40592f77fb4cc0459d8cd9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "adc225a50d7a314341a7c857f092b962e3967d4addb7d2b48ff335c7bedad350", "evidence": [], "is_private": null, "observable_id": "observable-772d2d988483709a1c33da14", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b577d12d1f8eaacf060db96a7b2bcc0009d0c3fd8d4842bd85175a50b2a1f972", "evidence": [], "is_private": null, "observable_id": "observable-da542c8fb1418024ac36e724", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "evidence": [], "is_private": null, "observable_id": "observable-7130ab373fdabb704a58cd2e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ce3a22f1ccba5bbeebb0a9fd49c3e72fbde9e1816959b67e5b1fb248c1e1041a", "evidence": [], "is_private": null, "observable_id": "observable-2b41952158d05172d5d5d773", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d43159c8bf2e1bd866abdbb1687911e2282b1f98a7c063f85ffd53a7f51efed4", "evidence": [], "is_private": null, "observable_id": "observable-a07c5cd31310fda8829f8a07", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d7b2de7a314f64ab62777494d3f9587dd679d637fd8e68783b68977bbb3df29e", "evidence": [], "is_private": null, "observable_id": "observable-649927f34fb9787dad86eb3c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d7c9595737524bc5febd4507cbe47457dbd59ce733315f1ada59a91c6754c193", "evidence": [], "is_private": null, "observable_id": "observable-cb1d2139c306b1ebe0e3e17b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d95a35fac8425ed6c010066a81b4330ade8dd325713e077d67fcfd33e7cafcac", "evidence": [], "is_private": null, "observable_id": "observable-b3189899e9b16fbccc24f145", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "de799971c904cfabc587484202b8d4bd4b40414ac6b23d1e51b16196bf100013", "evidence": [], "is_private": null, "observable_id": "observable-80edf00724bb934b24f0df6c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "df5f5ce34c9cf3edd665586295e356d6b56d9ef3e54614001f4b178217ec92fe", "evidence": [], "is_private": null, "observable_id": "observable-968dae5b323d3142b8b7f4b4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e32d0b53c63fe1a6b0759ebc8824b97661d369004213853438faaa34134967e6", "evidence": [], "is_private": null, "observable_id": "observable-ae021e095ec69c6fc7aa1a1a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "evidence": [], "is_private": null, "observable_id": "observable-c1946ed796846985b738b150", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ec0a5627751851db7afed684f83dde6178c3e6b2114adc24a1294fb2bb1d40e8", "evidence": [], "is_private": null, "observable_id": "observable-3fdb374ab8b6ecdb20e04b3c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ed001f8b45a9191508e79be37b5a0003faaf3bc356eb241fe11f2b56ab9f60ae", "evidence": [], "is_private": null, "observable_id": "observable-dc7f7f2c3cc7f6901993e10e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f0c4a8877fe0d8ed1f7350d20d476d37601fb6c6119eb986fce4d8ae2852061c", "evidence": [], "is_private": null, "observable_id": "observable-1ab215ceb3cf11de4f9a2a7f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f1b789be1126b557240dd0dfe98fc5f3ad6341bb1a5d8be0a954f65b486ad32a", "evidence": [], "is_private": null, "observable_id": "observable-0d8e695ab072cfe7dcc72a77", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f7b0061ce2ceec8a73a0957dc975d2dde0f4de8c0b63c041cd78a29414d2645c", "evidence": [], "is_private": null, "observable_id": "observable-736e65d2692d41acda941b16", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "fbf3439d0eb209ab2bdf6794da01485836e5bb0910c4624ac2d43dead3ff10d9", "evidence": [], "is_private": null, "observable_id": "observable-fa073d9c0ce8fb6569371e2d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/81/", "evidence": [ { "tcp_stream": 208, "frame_number": 23816, "display_filter": "frame.number == 23816", "timestamp_epoch": "1550951355.921398000" } ], "is_private": null, "observable_id": "observable-3b67ebf8fe21997043fe676e", "last_seen_epoch": "1550951355.921398000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951355.921398000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/83/", "evidence": [ { "tcp_stream": 207, "frame_number": 23794, "display_filter": "frame.number == 23794", "timestamp_epoch": "1550951353.371777000" } ], "is_private": null, "observable_id": "observable-d85a116081326c38b2c3a16e", "last_seen_epoch": "1550951353.371777000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951353.371777000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://190.146.112.216:8082/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/90", "evidence": [ { "tcp_stream": 212, "frame_number": 24666, "display_filter": "frame.number == 24666", "timestamp_epoch": "1550951415.192699000" }, { "tcp_stream": 237, "frame_number": 26591, "display_filter": "frame.number == 26591", "timestamp_epoch": "1550951444.371220000" } ], "is_private": null, "observable_id": "observable-228d7a3a6afd97e6c0e8e085", "last_seen_epoch": "1550951444.371220000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951415.192699000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://209.141.55.226/troll1.jpg", "evidence": [ { "tcp_stream": 105, "frame_number": 3119, "display_filter": "frame.number == 3119", "timestamp_epoch": "1550950028.171418000" } ], "is_private": null, "observable_id": "observable-c17b4f48a53da84765b0aed4", "last_seen_epoch": "1550950028.171418000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950028.171418000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://46.249.62.199/Sw9JKmXqaSj.exe", "evidence": [ { "tcp_stream": 109, "frame_number": 6262, "display_filter": "frame.number == 6262", "timestamp_epoch": "1550950411.127146000" } ], "is_private": null, "observable_id": "observable-0f637827ead5bfb10acf8369", "last_seen_epoch": "1550950411.127146000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950411.127146000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://46.249.62.199/Tinx86_14.exe", "evidence": [ { "tcp_stream": 110, "frame_number": 6249, "display_filter": "frame.number == 6249", "timestamp_epoch": "1550950410.137505000" } ], "is_private": null, "observable_id": "observable-f4859bb7df681e1f342875de", "last_seen_epoch": "1550950410.137505000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950410.137505000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://85.143.218.7/sin.png", "evidence": [ { "tcp_stream": 200, "frame_number": 20146, "display_filter": "frame.number == 20146", "timestamp_epoch": "1550950940.188912000" } ], "is_private": null, "observable_id": "observable-512678c4062635d244ef1f1a", "last_seen_epoch": "1550950940.188912000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950940.188912000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://85.143.218.7/tin.png", "evidence": [ { "tcp_stream": 161, "frame_number": 11986, "display_filter": "frame.number == 11986", "timestamp_epoch": "1550950744.487874000" } ], "is_private": null, "observable_id": "observable-d71816509b6d177f9eb8ec8b", "last_seen_epoch": "1550950744.487874000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950744.487874000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://85.143.218.7/win.png", "evidence": [ { "tcp_stream": 150, "frame_number": 10966, "display_filter": "frame.number == 10966", "timestamp_epoch": "1550950711.324212000" } ], "is_private": null, "observable_id": "observable-f4364408a935dbfd2e32ce2b", "last_seen_epoch": "1550950711.324212000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950711.324212000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://crl.microsoft.com/pki/crl/products/CSPCA.crl", "evidence": [ { "tcp_stream": 184, "frame_number": 16113, "display_filter": "frame.number == 16113", "timestamp_epoch": "1550950846.604756000" } ], "is_private": null, "observable_id": "observable-6ac88152528db3d3a2bd4873", "last_seen_epoch": "1550950846.604756000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950846.604756000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.googleapis.com/css?family=Lato:100,400", "evidence": [ { "tcp_stream": 81, "frame_number": 1438, "display_filter": "frame.number == 1438", "timestamp_epoch": "1550949997.768948000" } ], "is_private": null, "observable_id": "observable-a68ec87830f38926c7380e25", "last_seen_epoch": "1550949997.768948000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949997.768948000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.googleapis.com/css?family=Lato:300,400,400italic,600,700|Raleway:300,400,500,600,700|Crete+Round:400italic", "evidence": [ { "tcp_stream": 227, "frame_number": 25114, "display_filter": "frame.number == 25114", "timestamp_epoch": "1550951430.317878000" } ], "is_private": null, "observable_id": "observable-47ff539e4ea523045fe2d034", "last_seen_epoch": "1550951430.317878000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951430.317878000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/lato/v14/S6u8w4BMUTPHh30AXC-s.woff", "evidence": [ { "tcp_stream": 95, "frame_number": 2105, "display_filter": "frame.number == 2105", "timestamp_epoch": "1550950020.078881000" } ], "is_private": null, "observable_id": "observable-ab36e678bcc2b118442e5d6d", "last_seen_epoch": "1550950020.078881000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950020.078881000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/lato/v14/S6uyw4BMUTPHjx4wWA.woff", "evidence": [ { "tcp_stream": 94, "frame_number": 2107, "display_filter": "frame.number == 2107", "timestamp_epoch": "1550950020.079078000" } ], "is_private": null, "observable_id": "observable-049b7fffe4759c4e84e95c4a", "last_seen_epoch": "1550950020.079078000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950020.079078000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ipecho.net/plain", "evidence": [ { "tcp_stream": 196, "frame_number": 19795, "display_filter": "frame.number == 19795", "timestamp_epoch": "1550950931.858061000" } ], "is_private": null, "observable_id": "observable-d3f429118b422d4a7c345e30", "last_seen_epoch": "1550950931.858061000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950931.858061000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://rootscafeslc.com/", "evidence": [ { "tcp_stream": 72, "frame_number": 1185, "display_filter": "frame.number == 1185", "timestamp_epoch": "1550949984.295684000" } ], "is_private": null, "observable_id": "observable-2ad57d1c491957465dac93f0", "last_seen_epoch": "1550949984.295684000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949984.295684000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://static.squarespace.com/universal/scripts-compressed/common-c2a92195cbc0a2d6aed1-min.en-US.js", "evidence": [ { "tcp_stream": 82, "frame_number": 1433, "display_filter": "frame.number == 1433", "timestamp_epoch": "1550949997.471468000" } ], "is_private": null, "observable_id": "observable-752ce33925275481a1a7bf59", "last_seen_epoch": "1550949997.471468000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949997.471468000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://static1.squarespace.com/static/53176ac0e4b0cc8a54026440/t/53597593e4b0bb8f10e2db9a/1503949442424/?format=1500w", "evidence": [ { "tcp_stream": 76, "frame_number": 1219, "display_filter": "frame.number == 1219", "timestamp_epoch": "1550949986.299380000" } ], "is_private": null, "observable_id": "observable-23c4114c50019f53a6c776e7", "last_seen_epoch": "1550949986.299380000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949986.299380000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://static1.squarespace.com/static/sitecss/53176ac0e4b0cc8a54026440/47/507c1fdf84ae362b5e7be44e/53176ac0e4b0cc8a54026444/2141-05142015/1418412276795/site.css?&filterFeatures=false", "evidence": [ { "tcp_stream": 76, "frame_number": 1309, "display_filter": "frame.number == 1309", "timestamp_epoch": "1550949988.157275000" } ], "is_private": null, "observable_id": "observable-b5f3bf91f56c182c2d061f1c", "last_seen_epoch": "1550949988.157275000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949988.157275000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://superhaps.pw/data2.php?C68FF38437D96CED", "evidence": [ { "tcp_stream": 119, "frame_number": 7524, "display_filter": "frame.number == 7524", "timestamp_epoch": "1550950467.586401000" } ], "is_private": null, "observable_id": "observable-7bf557c85934a638d0fdb7a9", "last_seen_epoch": "1550950467.586401000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950467.586401000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://use.typekit.net/ik/qtSfIe0hWL1wtEbIsJFPUsITCi0N4DUQd5Tzt0wJ8s6feGw2fFHN4UJLFRbh52jhWD9DwQShjAw3ZQsKweFR5eIuF2MkFRbXwgTuiaiaO14zdasDjhBcZWFCjkoRdhXCScNziYFRjAZ8ShUROcFzdPUCiAoTdkuqZWZ8deN3dAm0ifuE-QJUO1FUiABkZWF3jAF8OcFzdP37OcUudc8zOAs8icmCdaglZAoXOWTTwRI0SaBujW48Sagyjh90jhNlJ6U3ScNt-AuyOAozicIKgcBqZAUCZPG4fHCgIMMjMPMfH6qJtKGbMg62JMJ7fbKzMsMMeMb6MKG4fHXgIMMjgKMfH6qJK3IbMg6YJMJ7fbKTMsMMeM66MKG4f5w7IMMj2PMfH6qJKbIbMg64JMJ7fbK3MsMMeMt6MKG4fHtgIMMjIfMfH6qJRMIbMg6sJMJ7fbK7MsMMegJ6MKG4fJGgIMMjIkMfH6qJXR9bMs62JMJ7fbR5FsMgeMb6MKG4fFIVIMIjgkMfH6qJXD9bMs6FJMJ7fbRVFsMgeMt6MKG4fFJVIMIjIPMf.js", "evidence": [ { "tcp_stream": 83, "frame_number": 1526, "display_filter": "frame.number == 1526", "timestamp_epoch": "1550949999.780623000" } ], "is_private": null, "observable_id": "observable-0d116571c566ea2b21e8a654", "last_seen_epoch": "1550949999.780623000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949999.780623000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.bing.com/favicon.ico", "evidence": [ { "tcp_stream": 79, "frame_number": 1357, "display_filter": "frame.number == 1357", "timestamp_epoch": "1550949989.086110000" }, { "tcp_stream": 232, "frame_number": 25256, "display_filter": "frame.number == 25256", "timestamp_epoch": "1550951431.532822000" } ], "is_private": null, "observable_id": "observable-837c693c5aa5d932c2a4b2df", "last_seen_epoch": "1550951431.532822000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949989.086110000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/", "evidence": [ { "tcp_stream": 215, "frame_number": 24724, "display_filter": "frame.number == 24724", "timestamp_epoch": "1550951426.570470000" } ], "is_private": null, "observable_id": "observable-f3d9fd08f05a69e041de7e36", "last_seen_epoch": "1550951426.570470000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951426.570470000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/animate.css", "evidence": [ { "tcp_stream": 223, "frame_number": 24828, "display_filter": "frame.number == 24828", "timestamp_epoch": "1550951427.595681000" } ], "is_private": null, "observable_id": "observable-057abb2fd1c51bc8f4154e31", "last_seen_epoch": "1550951427.595681000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951427.595681000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/bootstrap.css", "evidence": [ { "tcp_stream": 216, "frame_number": 24734, "display_filter": "frame.number == 24734", "timestamp_epoch": "1550951426.966829000" } ], "is_private": null, "observable_id": "observable-3375535c41d2317809a5fda1", "last_seen_epoch": "1550951426.966829000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951426.966829000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/dark.css", "evidence": [ { "tcp_stream": 219, "frame_number": 25099, "display_filter": "frame.number == 25099", "timestamp_epoch": "1550951430.033640000" } ], "is_private": null, "observable_id": "observable-8d0ac63fd67803f9263eda6f", "last_seen_epoch": "1550951430.033640000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951430.033640000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/font-icons.css", "evidence": [ { "tcp_stream": 220, "frame_number": 25103, "display_filter": "frame.number == 25103", "timestamp_epoch": "1550951430.057131000" } ], "is_private": null, "observable_id": "observable-edf6df46069a1bf7140f07e7", "last_seen_epoch": "1550951430.057131000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951430.057131000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/responsive.css", "evidence": [ { "tcp_stream": 224, "frame_number": 24829, "display_filter": "frame.number == 24829", "timestamp_epoch": "1550951427.595969000" } ], "is_private": null, "observable_id": "observable-901b2baafa56bc91df123b9d", "last_seen_epoch": "1550951427.595969000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951427.595969000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/swiper.css", "evidence": [ { "tcp_stream": 215, "frame_number": 25050, "display_filter": "frame.number == 25050", "timestamp_epoch": "1550951429.285375000" } ], "is_private": null, "observable_id": "observable-670ed465bbcb9ce9694a48e2", "last_seen_epoch": "1550951429.285375000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951429.285375000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/1A1.png", "evidence": [ { "tcp_stream": 215, "frame_number": 26237, "display_filter": "frame.number == 26237", "timestamp_epoch": "1550951443.195589000" } ], "is_private": null, "observable_id": "observable-f51698a1016f96d95862c423", "last_seen_epoch": "1550951443.195589000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951443.195589000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/2A1.png", "evidence": [ { "tcp_stream": 216, "frame_number": 26243, "display_filter": "frame.number == 26243", "timestamp_epoch": "1550951443.363937000" } ], "is_private": null, "observable_id": "observable-109ee3c2ad1403ff2a24a054", "last_seen_epoch": "1550951443.363937000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951443.363937000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/3A1.png", "evidence": [ { "tcp_stream": 226, "frame_number": 26843, "display_filter": "frame.number == 26843", "timestamp_epoch": "1550951447.135555000" } ], "is_private": null, "observable_id": "observable-bca12960c7d63c74ab28cd27", "last_seen_epoch": "1550951447.135555000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951447.135555000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/6A1.png", "evidence": [ { "tcp_stream": 216, "frame_number": 26868, "display_filter": "frame.number == 26868", "timestamp_epoch": "1550951447.371722000" } ], "is_private": null, "observable_id": "observable-e0b87aa5638b396cbf8bf059", "last_seen_epoch": "1550951447.371722000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951447.371722000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/7ABurn1.png", "evidence": [ { "tcp_stream": 238, "frame_number": 26945, "display_filter": "frame.number == 26945", "timestamp_epoch": "1550951448.057698000" } ], "is_private": null, "observable_id": "observable-1efd0eaa8598c7c918ab7490", "last_seen_epoch": "1550951448.057698000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951448.057698000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/StormWater1.png", "evidence": [ { "tcp_stream": 238, "frame_number": 27072, "display_filter": "frame.number == 27072", "timestamp_epoch": "1550951449.806280000" } ], "is_private": null, "observable_id": "observable-1c203b480b334074139e12af", "last_seen_epoch": "1550951449.806280000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951449.806280000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/map.png", "evidence": [ { "tcp_stream": 215, "frame_number": 26103, "display_filter": "frame.number == 26103", "timestamp_epoch": "1550951441.282788000" } ], "is_private": null, "observable_id": "observable-7fd29f9aee92755a0172aa25", "last_seen_epoch": "1550951441.282788000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951441.282788000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/performance.png", "evidence": [ { "tcp_stream": 215, "frame_number": 26147, "display_filter": "frame.number == 26147", "timestamp_epoch": "1550951442.235477000" } ], "is_private": null, "observable_id": "observable-ba0f2d0521c25dc39dd62e31", "last_seen_epoch": "1550951442.235477000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951442.235477000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tick.png", "evidence": [ { "tcp_stream": 216, "frame_number": 26008, "display_filter": "frame.number == 26008", "timestamp_epoch": "1550951440.093034000" } ], "is_private": null, "observable_id": "observable-51670dd180fc2d8b2cf56b3a", "last_seen_epoch": "1550951440.093034000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951440.093034000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tools.png", "evidence": [ { "tcp_stream": 216, "frame_number": 26024, "display_filter": "frame.number == 26024", "timestamp_epoch": "1550951440.217419000" } ], "is_private": null, "observable_id": "observable-e07d9963d19079211c5e9129", "last_seen_epoch": "1550951440.217419000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951440.217419000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/logo1.png", "evidence": [ { "tcp_stream": 229, "frame_number": 25144, "display_filter": "frame.number == 25144", "timestamp_epoch": "1550951430.455912000" } ], "is_private": null, "observable_id": "observable-4bbf20d4ec6a15bb1d956c58", "last_seen_epoch": "1550951430.455912000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951430.455912000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/functions.js", "evidence": [ { "tcp_stream": 230, "frame_number": 25149, "display_filter": "frame.number == 25149", "timestamp_epoch": "1550951430.456252000" } ], "is_private": null, "observable_id": "observable-3c8ffdc5158a7dc63095c1bb", "last_seen_epoch": "1550951430.456252000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951430.456252000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/jquery.js", "evidence": [ { "tcp_stream": 226, "frame_number": 25868, "display_filter": "frame.number == 25868", "timestamp_epoch": "1550951438.897816000" } ], "is_private": null, "observable_id": "observable-fae2920f4ed37fcaf8e46175", "last_seen_epoch": "1550951438.897816000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951438.897816000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/plugins.js", "evidence": [ { "tcp_stream": 225, "frame_number": 25880, "display_filter": "frame.number == 25880", "timestamp_epoch": "1550951438.932666000" } ], "is_private": null, "observable_id": "observable-d94d4574ff30609a61510176", "last_seen_epoch": "1550951438.932666000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951438.932666000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/style.css", "evidence": [ { "tcp_stream": 217, "frame_number": 24753, "display_filter": "frame.number == 24753", "timestamp_epoch": "1550951427.031893000" } ], "is_private": null, "observable_id": "observable-930ac9040e1e1d32b55b383d", "last_seen_epoch": "1550951427.031893000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951427.031893000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/Dept/COMMISH/Data/WNData/default.jpg", "evidence": [ { "tcp_stream": 229, "frame_number": 25234, "display_filter": "frame.number == 25234", "timestamp_epoch": "1550951431.173776000" } ], "is_private": null, "observable_id": "observable-b5324de2f7558708afa608d5", "last_seen_epoch": "1550951431.173776000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951431.173776000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/IMG_1047.JPG", "evidence": [ { "tcp_stream": 224, "frame_number": 25571, "display_filter": "frame.number == 25571", "timestamp_epoch": "1550951434.984633000" } ], "is_private": null, "observable_id": "observable-9d400ba8f0d9ee8d63389fd9", "last_seen_epoch": "1550951434.984633000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951434.984633000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/JerikaTimpCaveTrail1.JPG", "evidence": [ { "tcp_stream": 229, "frame_number": 25505, "display_filter": "frame.number == 25505", "timestamp_epoch": "1550951434.213427000" } ], "is_private": null, "observable_id": "observable-af4aafafa06ca9ef633a3adb", "last_seen_epoch": "1550951434.213427000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951434.213427000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/Martin_Richard.jpg", "evidence": [ { "tcp_stream": 223, "frame_number": 25450, "display_filter": "frame.number == 25450", "timestamp_epoch": "1550951433.801767000" } ], "is_private": null, "observable_id": "observable-ad13e042eab69e3316d898b2", "last_seen_epoch": "1550951433.801767000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951433.801767000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/OUR_Adobe_Jon_Lines_Award.jpg", "evidence": [ { "tcp_stream": 219, "frame_number": 25413, "display_filter": "frame.number == 25413", "timestamp_epoch": "1550951433.296277000" } ], "is_private": null, "observable_id": "observable-d07d0207e1e46cd76a98e4a5", "last_seen_epoch": "1550951433.296277000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951433.296277000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/TanyaandJenna.jpg", "evidence": [ { "tcp_stream": 223, "frame_number": 25573, "display_filter": "frame.number == 25573", "timestamp_epoch": "1550951434.984812000" } ], "is_private": null, "observable_id": "observable-3b7d12f595ebcf8b2bfac90f", "last_seen_epoch": "1550951434.984812000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951434.984812000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.co.utah.ut.us/Images1/custom/Opiate_ProvoTownHall.jpg", "evidence": [ { "tcp_stream": 215, "frame_number": 25168, "display_filter": "frame.number == 25168", "timestamp_epoch": "1550951430.605082000" } ], "is_private": null, "observable_id": "observable-4419532888cea78d71400267", "last_seen_epoch": "1550951430.605082000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951430.605082000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "evidence": [ { "tcp_stream": 108, "frame_number": 6171, "display_filter": "frame.number == 6171", "timestamp_epoch": "1550950405.720515000" }, { "tcp_stream": 195, "frame_number": 19578, "display_filter": "frame.number == 19578", "timestamp_epoch": "1550950926.328163000" } ], "is_private": null, "observable_id": "observable-6c68eed0733dc2d73c76765e", "last_seen_epoch": "1550950926.328163000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950405.720515000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.msftncsi.com/ncsi.txt", "evidence": [ { "tcp_stream": 19, "frame_number": 312, "display_filter": "frame.number == 312", "timestamp_epoch": "1550949882.465719000" }, { "tcp_stream": 45, "frame_number": 752, "display_filter": "frame.number == 752", "timestamp_epoch": "1550949924.873662000" } ], "is_private": null, "observable_id": "observable-d9177fda301c136e2ea2bd76", "last_seen_epoch": "1550949924.873662000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949882.465719000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.rootscafeslc.com/", "evidence": [ { "tcp_stream": 74, "frame_number": 1197, "display_filter": "frame.number == 1197", "timestamp_epoch": "1550949985.110142000" } ], "is_private": null, "observable_id": "observable-8c4e5f8bab2c29fce1ab67bd", "last_seen_epoch": "1550949985.110142000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949985.110142000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.rootscafeslc.com/api/census/RecordHit?crumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi", "evidence": [ { "tcp_stream": 75, "frame_number": 2099, "display_filter": "frame.number == 2099", "timestamp_epoch": "1550950020.077660000" }, { "tcp_stream": 75, "frame_number": 3456, "display_filter": "frame.number == 3456", "timestamp_epoch": "1550950037.861633000" } ], "is_private": null, "observable_id": "observable-3b894db358a1d895946b3f05", "last_seen_epoch": "1550950037.861633000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950020.077660000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft NCSI", "evidence": [ { "tcp_stream": 19, "frame_number": 312, "display_filter": "frame.number == 312", "timestamp_epoch": "1550949882.465719000" }, { "tcp_stream": 45, "frame_number": 752, "display_filter": "frame.number == 752", "timestamp_epoch": "1550949924.873662000" } ], "is_private": null, "observable_id": "observable-c0dbe233425fd5e5ce20179c", "last_seen_epoch": "1550949924.873662000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949882.465719000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft-CryptoAPI/6.1", "evidence": [ { "tcp_stream": 108, "frame_number": 6171, "display_filter": "frame.number == 6171", "timestamp_epoch": "1550950405.720515000" }, { "tcp_stream": 184, "frame_number": 16113, "display_filter": "frame.number == 16113", "timestamp_epoch": "1550950846.604756000" }, { "tcp_stream": 195, "frame_number": 19578, "display_filter": "frame.number == 19578", "timestamp_epoch": "1550950926.328163000" } ], "is_private": null, "observable_id": "observable-eb1e44dbac873b936fba0e42", "last_seen_epoch": "1550950926.328163000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950405.720515000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "evidence": [ { "tcp_stream": 207, "frame_number": 23794, "display_filter": "frame.number == 23794", "timestamp_epoch": "1550951353.371777000" }, { "tcp_stream": 208, "frame_number": 23816, "display_filter": "frame.number == 23816", "timestamp_epoch": "1550951355.921398000" } ], "is_private": null, "observable_id": "observable-88be0c05d0874261df4dcd5a", "last_seen_epoch": "1550951355.921398000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951353.371777000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "evidence": [ { "tcp_stream": 105, "frame_number": 3119, "display_filter": "frame.number == 3119", "timestamp_epoch": "1550950028.171418000" } ], "is_private": null, "observable_id": "observable-7e5e6acbf31c94b2e1f9b8d9", "last_seen_epoch": "1550950028.171418000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950028.171418000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2228.0 Safari/537.36", "evidence": [ { "tcp_stream": 196, "frame_number": 19795, "display_filter": "frame.number == 19795", "timestamp_epoch": "1550950931.858061000" } ], "is_private": null, "observable_id": "observable-88d1ab23aed4aa0dff8daf33", "last_seen_epoch": "1550950931.858061000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950931.858061000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "evidence": [ { "tcp_stream": 79, "frame_number": 1357, "display_filter": "frame.number == 1357", "timestamp_epoch": "1550949989.086110000" }, { "tcp_stream": 232, "frame_number": 25256, "display_filter": "frame.number == 25256", "timestamp_epoch": "1550951431.532822000" } ], "is_private": null, "observable_id": "observable-d275a925169c45c4572dcba8", "last_seen_epoch": "1550951431.532822000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949989.086110000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "evidence": [ { "tcp_stream": 72, "frame_number": 1185, "display_filter": "frame.number == 1185", "timestamp_epoch": "1550949984.295684000" }, { "tcp_stream": 74, "frame_number": 1197, "display_filter": "frame.number == 1197", "timestamp_epoch": "1550949985.110142000" }, { "tcp_stream": 76, "frame_number": 1219, "display_filter": "frame.number == 1219", "timestamp_epoch": "1550949986.299380000" }, { "tcp_stream": 76, "frame_number": 1309, "display_filter": "frame.number == 1309", "timestamp_epoch": "1550949988.157275000" }, { "tcp_stream": 82, "frame_number": 1433, "display_filter": "frame.number == 1433", "timestamp_epoch": "1550949997.471468000" }, { "tcp_stream": 81, "frame_number": 1438, "display_filter": "frame.number == 1438", "timestamp_epoch": "1550949997.768948000" }, { "tcp_stream": 83, "frame_number": 1526, "display_filter": "frame.number == 1526", "timestamp_epoch": "1550949999.780623000" }, { "tcp_stream": 75, "frame_number": 2099, "display_filter": "frame.number == 2099", "timestamp_epoch": "1550950020.077660000" }, { "tcp_stream": 95, "frame_number": 2105, "display_filter": "frame.number == 2105", "timestamp_epoch": "1550950020.078881000" }, { "tcp_stream": 94, "frame_number": 2107, "display_filter": "frame.number == 2107", "timestamp_epoch": "1550950020.079078000" }, { "tcp_stream": 75, "frame_number": 3456, "display_filter": "frame.number == 3456", "timestamp_epoch": "1550950037.861633000" }, { "tcp_stream": 215, "frame_number": 24724, "display_filter": "frame.number == 24724", "timestamp_epoch": "1550951426.570470000" }, { "tcp_stream": 216, "frame_number": 24734, "display_filter": "frame.number == 24734", "timestamp_epoch": "1550951426.966829000" }, { "tcp_stream": 217, "frame_number": 24753, "display_filter": "frame.number == 24753", "timestamp_epoch": "1550951427.031893000" }, { "tcp_stream": 223, "frame_number": 24828, "display_filter": "frame.number == 24828", "timestamp_epoch": "1550951427.595681000" }, { "tcp_stream": 224, "frame_number": 24829, "display_filter": "frame.number == 24829", "timestamp_epoch": "1550951427.595969000" }, { "tcp_stream": 215, "frame_number": 25050, "display_filter": "frame.number == 25050", "timestamp_epoch": "1550951429.285375000" }, { "tcp_stream": 219, "frame_number": 25099, "display_filter": "frame.number == 25099", "timestamp_epoch": "1550951430.033640000" }, { "tcp_stream": 220, "frame_number": 25103, "display_filter": "frame.number == 25103", "timestamp_epoch": "1550951430.057131000" }, { "tcp_stream": 227, "frame_number": 25114, "display_filter": "frame.number == 25114", "timestamp_epoch": "1550951430.317878000" } ], "is_private": null, "observable_id": "observable-fdfd3d313b29e6373aab86f7", "last_seen_epoch": "1550951449.806280000", "enrichment_state": "not_requested", "first_seen_epoch": "1550949984.295684000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "test", "evidence": [ { "tcp_stream": 212, "frame_number": 24666, "display_filter": "frame.number == 24666", "timestamp_epoch": "1550951415.192699000" }, { "tcp_stream": 237, "frame_number": 26591, "display_filter": "frame.number == 26591", "timestamp_epoch": "1550951444.371220000" } ], "is_private": null, "observable_id": "observable-54d41bc1720983711d6f4f87", "last_seen_epoch": "1550951444.371220000", "enrichment_state": "not_requested", "first_seen_epoch": "1550951415.192699000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "WinHTTP loader/1.0", "evidence": [ { "tcp_stream": 161, "frame_number": 11986, "display_filter": "frame.number == 11986", "timestamp_epoch": "1550950744.487874000" }, { "tcp_stream": 200, "frame_number": 20146, "display_filter": "frame.number == 20146", "timestamp_epoch": "1550950940.188912000" } ], "is_private": null, "observable_id": "observable-d06e6daf9d8ec2a14779a4d4", "last_seen_epoch": "1550950940.188912000", "enrichment_state": "not_requested", "first_seen_epoch": "1550950744.487874000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "6a25f7bd75a7b1f270d5c53f627231d7b0295bb014e382846fcd0e77a59bd0c8", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [ { "name": "Ingress Tool Transfer", "status": "suggested", "tactic": "command-and-control", "evidence": [ { "tcp_stream": 110, "frame_number": 11971, "display_filter": "frame.number == 11971", "timestamp_epoch": "1550950744.087696000" }, { "tcp_stream": 82, "frame_number": 1433, "display_filter": "frame.number == 1433", "timestamp_epoch": "1550949997.471468000" }, { "tcp_stream": 83, "frame_number": 1526, "display_filter": "frame.number == 1526", "timestamp_epoch": "1550949999.780623000" }, { "tcp_stream": 83, "frame_number": 1594, "display_filter": "frame.number == 1594", "timestamp_epoch": "1550950001.311240000" }, { "tcp_stream": 82, "frame_number": 2049, "display_filter": "frame.number == 2049", "timestamp_epoch": "1550950018.735133000" }, { "tcp_stream": 230, "frame_number": 25149, "display_filter": "frame.number == 25149", "timestamp_epoch": "1550951430.456252000" }, { "tcp_stream": 226, "frame_number": 25868, "display_filter": "frame.number == 25868", "timestamp_epoch": "1550951438.897816000" }, { "tcp_stream": 226, "frame_number": 26841, "display_filter": "frame.number == 26841", "timestamp_epoch": "1550951447.134923000" }, { "tcp_stream": 230, "frame_number": 27968, "display_filter": "frame.number == 27968", "timestamp_epoch": "1550951460.239749000" }, { "tcp_stream": 110, "frame_number": 6249, "display_filter": "frame.number == 6249", "timestamp_epoch": "1550950410.137505000" }, { "tcp_stream": 109, "frame_number": 6262, "display_filter": "frame.number == 6262", "timestamp_epoch": "1550950411.127146000" }, { "tcp_stream": 109, "frame_number": 6800, "display_filter": "frame.number == 6800", "timestamp_epoch": "1550950432.567344000" } ], "attack_id": "T1105", "confidence": 0.8, "finding_ids": [ "finding-23b318fe4b83043b05f23020", "finding-3385b4c8ffed4bb2b389ffab", "finding-39056bda31707ecb669f20fb", "finding-886929ab2082e4c59b408d4d", "finding-c4c6c2478918933011320016", "finding-c80a70eba572e50f2498707a" ], "mapping_basis": "versioned-deterministic-rule" } ], "analysis_key_material": { "source_sha256": "f6d740aeaac9e7d23843b481b7cbc179117cd21fab2f0d82c0e94fe8ba092775", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 207, "observable_limit": 5000, "observables_total": 207, "matched_observables": 0, "observables_checked": 207, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:08:44.803184+00:00", "session_id": "900128f8-0b80-4266-8ed1-7a1b5d6a8a0a", "techniques": [ { "url": "https://attack.mitre.org/techniques/T1105", "name": "Ingress Tool Transfer", "status": "catalog-context-not-validation-of-behavior", "attack_id": "T1105", "detection": "", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "WinEventLog:Sysmon", "auditd:SYSCALL", "iptables:LOG", "macos:endpointsecurity", "macos:unifiedlog", "esxi:hostd", "esxi:vmkernel", "NSM:Flow", "snmp:syslog" ], "catalog_version_id": 851, "detection_strategies": [ { "name": "Detect Ingress Tool Transfers via Behavioral Chain", "stix_id": "x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554", "attack_id": "DET0060" } ], "detection_links_truncated": false } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "71b77b215ad5adbe60aff4160d3fdb0cb8fbddbd0f64bb14739dc464fb1ebe35", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "6a25f7bd75a7b1f270d5c53f627231d7b0295bb014e382846fcd0e77a59bd0c8", "cross_case_correlations": [ { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 16, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 22, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 11, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 15, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 19, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 18, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 17, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 21, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 17, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "6a25f7bd75a7b1f270d5c53f627231d7b0295bb014e382846fcd0e77a59bd0c8", "items": [ { "observable_id": "observable-552a33b8f7a9a6d28c3a009c", "type": "domain", "value": "112.146.166.173.b.barracudacentral.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 107, "frame_number": 23846, "display_filter": "frame.number == 23846", "timestamp_epoch": "1550951375.637159000" }, { "udp_stream": 107, "frame_number": 23848, "display_filter": "frame.number == 23848", "timestamp_epoch": "1550951375.734445000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c9b315f1a07c5f90f9231500", "type": "domain", "value": "112.146.166.173.cbl.abuseat.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 106, "frame_number": 23844, "display_filter": "frame.number == 23844", "timestamp_epoch": "1550951375.523039000" }, { "udp_stream": 106, "frame_number": 23845, "display_filter": "frame.number == 23845", "timestamp_epoch": "1550951375.636293000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-033e87a0b6e3682fa816df28", "type": "domain", "value": "112.146.166.173.dnsbl-1.uceprotect.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 108, "frame_number": 23849, "display_filter": "frame.number == 23849", "timestamp_epoch": "1550951375.735581000" }, { "udp_stream": 108, "frame_number": 23850, "display_filter": "frame.number == 23850", "timestamp_epoch": "1550951375.880503000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-88dc64b86c9f853789305cc4", "type": "domain", "value": "112.146.166.173.spam.dnsbl.sorbs.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 109, "frame_number": 23851, "display_filter": "frame.number == 23851", "timestamp_epoch": "1550951375.881257000" }, { "udp_stream": 109, "frame_number": 23852, "display_filter": "frame.number == 23852", "timestamp_epoch": "1550951376.102761000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cfab0d812d6b7ed017159f9a", "type": "domain", "value": "112.146.166.173.zen.spamhaus.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 23842, "display_filter": "frame.number == 23842", "timestamp_epoch": "1550951375.399923000" }, { "udp_stream": 105, "frame_number": 23843, "display_filter": "frame.number == 23843", "timestamp_epoch": "1550951375.522153000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5ab88b0192618d89a1a7f6a9", "type": "domain", "value": "api.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 53, "frame_number": 1290, "display_filter": "frame.number == 1290", "timestamp_epoch": "1550949987.933921000" }, { "udp_stream": 54, "frame_number": 1291, "display_filter": "frame.number == 1291", "timestamp_epoch": "1550949987.935237000" }, { "udp_stream": 54, "frame_number": 1298, "display_filter": "frame.number == 1298", "timestamp_epoch": "1550949987.996656000" }, { "udp_stream": 53, "frame_number": 1299, "display_filter": "frame.number == 1299", "timestamp_epoch": "1550949987.996754000" }, { "udp_stream": 115, "frame_number": 25118, "display_filter": "frame.number == 25118", "timestamp_epoch": "1550951430.384352000" }, { "udp_stream": 116, "frame_number": 25119, "display_filter": "frame.number == 25119", "timestamp_epoch": "1550951430.384509000" }, { "udp_stream": 116, "frame_number": 25140, "display_filter": "frame.number == 25140", "timestamp_epoch": "1550951430.455619000" }, { "udp_stream": 115, "frame_number": 25142, "display_filter": "frame.number == 25142", "timestamp_epoch": "1550951430.455767000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-31ab1898522d7d3c52589b1a", "type": "domain", "value": "cranetisti.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:20.549793+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.547810+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 6154, "display_filter": "frame.number == 6154", "timestamp_epoch": "1550950402.861168000" }, { "udp_stream": 73, "frame_number": 6155, "display_filter": "frame.number == 6155", "timestamp_epoch": "1550950403.232285000" }, { "tcp_stream": 107, "frame_number": 6159, "display_filter": "frame.number == 6159", "timestamp_epoch": "1550950403.574744000" }, { "tcp_stream": 113, "frame_number": 6270, "display_filter": "frame.number == 6270", "timestamp_epoch": "1550950411.285747000" }, { "tcp_stream": 115, "frame_number": 6272, "display_filter": "frame.number == 6272", "timestamp_epoch": "1550950411.286900000" }, { "tcp_stream": 114, "frame_number": 6274, "display_filter": "frame.number == 6274", "timestamp_epoch": "1550950411.287923000" }, { "tcp_stream": 116, "frame_number": 6319, "display_filter": "frame.number == 6319", "timestamp_epoch": "1550950412.293531000" }, { "tcp_stream": 111, "frame_number": 6321, "display_filter": "frame.number == 6321", "timestamp_epoch": "1550950412.293907000" }, { "tcp_stream": 112, "frame_number": 6325, "display_filter": "frame.number == 6325", "timestamp_epoch": "1550950412.305579000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:20.545245+00:00" }, { "observable_id": "observable-bcbc956267c597bf53b6fdad", "type": "domain", "value": "crl.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:47:12.176626+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.713407+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 97, "frame_number": 15210, "display_filter": "frame.number == 15210", "timestamp_epoch": "1550950826.266512000" }, { "udp_stream": 97, "frame_number": 15218, "display_filter": "frame.number == 15218", "timestamp_epoch": "1550950827.277293000" }, { "udp_stream": 97, "frame_number": 15236, "display_filter": "frame.number == 15236", "timestamp_epoch": "1550950828.291339000" }, { "udp_stream": 97, "frame_number": 15255, "display_filter": "frame.number == 15255", "timestamp_epoch": "1550950830.303739000" }, { "udp_stream": 97, "frame_number": 15455, "display_filter": "frame.number == 15455", "timestamp_epoch": "1550950834.312890000" }, { "udp_stream": 97, "frame_number": 15656, "display_filter": "frame.number == 15656", "timestamp_epoch": "1550950837.917035000" }, { "udp_stream": 98, "frame_number": 15999, "display_filter": "frame.number == 15999", "timestamp_epoch": "1550950846.470491000" }, { "udp_stream": 98, "frame_number": 16108, "display_filter": "frame.number == 16108", "timestamp_epoch": "1550950846.527507000" }, { "tcp_stream": 184, "frame_number": 16113, "display_filter": "frame.number == 16113", "timestamp_epoch": "1550950846.604756000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:20.711416+00:00" }, { "observable_id": "observable-1e65c65416804373bbda2b82", "type": "domain", "value": "dicarkadar.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 6142, "display_filter": "frame.number == 6142", "timestamp_epoch": "1550950376.282884000" }, { "udp_stream": 70, "frame_number": 6143, "display_filter": "frame.number == 6143", "timestamp_epoch": "1550950376.813125000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a4fcf991cd88b6640e5f2785", "type": "domain", "value": "dns.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 1440, "display_filter": "frame.number == 1440", "timestamp_epoch": "1550949997.825696000" }, { "udp_stream": 62, "frame_number": 1441, "display_filter": "frame.number == 1441", "timestamp_epoch": "1550949997.877899000" }, { "udp_stream": 63, "frame_number": 1442, "display_filter": "frame.number == 1442", "timestamp_epoch": "1550949997.878519000" }, { "udp_stream": 63, "frame_number": 1443, "display_filter": "frame.number == 1443", "timestamp_epoch": "1550949997.932320000" }, { "udp_stream": 71, "frame_number": 6150, "display_filter": "frame.number == 6150", "timestamp_epoch": "1550950399.114908000" }, { "udp_stream": 71, "frame_number": 6151, "display_filter": "frame.number == 6151", "timestamp_epoch": "1550950399.176094000" }, { "udp_stream": 72, "frame_number": 6152, "display_filter": "frame.number == 6152", "timestamp_epoch": "1550950399.176507000" }, { "udp_stream": 72, "frame_number": 6153, "display_filter": "frame.number == 6153", "timestamp_epoch": "1550950399.176718000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec8db8d5f7e2dbe9274dc2be", "type": "domain", "value": "ferguson-win-pc.stormtheory.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:21.714054+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.712513+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 18, "frame_number": 319, "display_filter": "frame.number == 319", "timestamp_epoch": "1550949884.482276000" }, { "udp_stream": 18, "frame_number": 320, "display_filter": "frame.number == 320", "timestamp_epoch": "1550949884.482553000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:21.710901+00:00" }, { "observable_id": "observable-e3faf4dc0228f563742dc0b4", "type": "domain", "value": "fonts.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:19.818148+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.856841+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 50, "frame_number": 1206, "display_filter": "frame.number == 1206", "timestamp_epoch": "1550949985.987562000" }, { "udp_stream": 50, "frame_number": 1267, "display_filter": "frame.number == 1267", "timestamp_epoch": "1550949986.996665000" }, { "udp_stream": 50, "frame_number": 1302, "display_filter": "frame.number == 1302", "timestamp_epoch": "1550949988.010465000" }, { "udp_stream": 50, "frame_number": 1391, "display_filter": "frame.number == 1391", "timestamp_epoch": "1550949990.022897000" }, { "udp_stream": 50, "frame_number": 1417, "display_filter": "frame.number == 1417", "timestamp_epoch": "1550949994.032676000" }, { "udp_stream": 50, "frame_number": 1423, "display_filter": "frame.number == 1423", "timestamp_epoch": "1550949997.308863000" }, { "udp_stream": 61, "frame_number": 1426, "display_filter": "frame.number == 1426", "timestamp_epoch": "1550949997.310632000" }, { "udp_stream": 61, "frame_number": 1427, "display_filter": "frame.number == 1427", "timestamp_epoch": "1550949997.401197000" }, { "udp_stream": 113, "frame_number": 24733, "display_filter": "frame.number == 24733", "timestamp_epoch": "1550951426.961286000" }, { "udp_stream": 113, "frame_number": 24868, "display_filter": "frame.number == 24868", "timestamp_epoch": "1550951427.964847000" }, { "udp_stream": 113, "frame_number": 24990, "display_filter": "frame.number == 24990", "timestamp_epoch": "1550951428.980007000" }, { "udp_stream": 113, "frame_number": 25109, "display_filter": "frame.number == 25109", "timestamp_epoch": "1550951430.255035000" }, { "tcp_stream": 81, "frame_number": 1438, "display_filter": "frame.number == 1438", "timestamp_epoch": "1550949997.768948000" }, { "tcp_stream": 227, "frame_number": 25114, "display_filter": "frame.number == 25114", "timestamp_epoch": "1550951430.317878000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:20.853839+00:00" }, { "observable_id": "observable-bb89ee470e00769946f1a702", "type": "domain", "value": "fonts.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:19.985832+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.860900+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 2059, "display_filter": "frame.number == 2059", "timestamp_epoch": "1550950019.929210000" }, { "udp_stream": 66, "frame_number": 2092, "display_filter": "frame.number == 2092", "timestamp_epoch": "1550950020.020502000" }, { "tcp_stream": 95, "frame_number": 2105, "display_filter": "frame.number == 2105", "timestamp_epoch": "1550950020.078881000" }, { "tcp_stream": 94, "frame_number": 2107, "display_filter": "frame.number == 2107", "timestamp_epoch": "1550950020.079078000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:20.858929+00:00" }, { "observable_id": "observable-46ebb9788f7adeed0b75f76d", "type": "domain", "value": "googleadapis.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 1427, "display_filter": "frame.number == 1427", "timestamp_epoch": "1550949997.401197000" }, { "udp_stream": 113, "frame_number": 25109, "display_filter": "frame.number == 25109", "timestamp_epoch": "1550951430.255035000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2aebd2b43c6c317efa5ebaae", "type": "domain", "value": "gstaticadssl.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 2092, "display_filter": "frame.number == 2092", "timestamp_epoch": "1550950020.020502000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-606a7c320d51cf139ee55455", "type": "domain", "value": "iecvlist.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:00.584505+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.865497+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 1839, "display_filter": "frame.number == 1839", "timestamp_epoch": "1550950013.988524000" }, { "udp_stream": 65, "frame_number": 1840, "display_filter": "frame.number == 1840", "timestamp_epoch": "1550950014.051797000" }, { "udp_stream": 121, "frame_number": 27599, "display_filter": "frame.number == 27599", "timestamp_epoch": "1550951456.440109000" }, { "udp_stream": 121, "frame_number": 27600, "display_filter": "frame.number == 27600", "timestamp_epoch": "1550951456.504409000" }, { "tcp_stream": 84, "frame_number": 1851, "display_filter": "frame.number == 1851", "timestamp_epoch": "1550950014.113030000" }, { "tcp_stream": 85, "frame_number": 1894, "display_filter": "frame.number == 1894", "timestamp_epoch": "1550950015.124585000" }, { "tcp_stream": 240, "frame_number": 27607, "display_filter": "frame.number == 27607", "timestamp_epoch": "1550951456.564916000" }, { "tcp_stream": 239, "frame_number": 27609, "display_filter": "frame.number == 27609", "timestamp_epoch": "1550951456.565048000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:20.863020+00:00" }, { "observable_id": "observable-a2ef48f518d95db53489c9fa", "type": "domain", "value": "ipecho.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:20.872730+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.870249+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 19780, "display_filter": "frame.number == 19780", "timestamp_epoch": "1550950931.732645000" }, { "udp_stream": 103, "frame_number": 19781, "display_filter": "frame.number == 19781", "timestamp_epoch": "1550950931.792794000" }, { "tcp_stream": 196, "frame_number": 19795, "display_filter": "frame.number == 19795", "timestamp_epoch": "1550950931.858061000" }, { "tcp_stream": 197, "frame_number": 19926, "display_filter": "frame.number == 19926", "timestamp_epoch": "1550950933.352228000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:20.867763+00:00" }, { "observable_id": "observable-fe46453221fcc838826394aa", "type": "domain", "value": "isatap.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 300, "display_filter": "frame.number == 300", "timestamp_epoch": "1550949879.597368000" }, { "udp_stream": 16, "frame_number": 301, "display_filter": "frame.number == 301", "timestamp_epoch": "1550949879.597678000" }, { "udp_stream": 22, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1550949914.332048000" }, { "udp_stream": 22, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1550949914.332445000" }, { "udp_stream": 37, "frame_number": 541, "display_filter": "frame.number == 541", "timestamp_epoch": "1550949919.833437000" }, { "udp_stream": 37, "frame_number": 542, "display_filter": "frame.number == 542", "timestamp_epoch": "1550949919.833781000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8ccf22fe83184534659d4ca0", "type": "domain", "value": "p.typekit.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:44.093662+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.031731+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 67, "frame_number": 2383, "display_filter": "frame.number == 2383", "timestamp_epoch": "1550950021.748523000" }, { "udp_stream": 67, "frame_number": 2408, "display_filter": "frame.number == 2408", "timestamp_epoch": "1550950021.846199000" }, { "tcp_stream": 99, "frame_number": 2545, "display_filter": "frame.number == 2545", "timestamp_epoch": "1550950022.959876000" }, { "tcp_stream": 98, "frame_number": 2664, "display_filter": "frame.number == 2664", "timestamp_epoch": "1550950023.985041000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:21.028907+00:00" }, { "observable_id": "observable-967a4a2b1d3bf9c410bea3c5", "type": "domain", "value": "prod.squarespace.map.fastly.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 1213, "display_filter": "frame.number == 1213", "timestamp_epoch": "1550949986.211340000" }, { "udp_stream": 60, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1550949997.407985000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b5d5a351649d461723ab370c", "type": "domain", "value": "rootscafeslc.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:21.038658+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.036357+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 47, "frame_number": 1176, "display_filter": "frame.number == 1176", "timestamp_epoch": "1550949983.441602000" }, { "udp_stream": 47, "frame_number": 1177, "display_filter": "frame.number == 1177", "timestamp_epoch": "1550949983.592832000" }, { "tcp_stream": 72, "frame_number": 1185, "display_filter": "frame.number == 1185", "timestamp_epoch": "1550949984.295684000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:21.034182+00:00" }, { "observable_id": "observable-9841ed77476bc3ffaa1fd325", "type": "domain", "value": "static.squarespace.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:18.848539+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:18.683817+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:18.681975+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 51, "frame_number": 1207, "display_filter": "frame.number == 1207", "timestamp_epoch": "1550949985.989617000" }, { "udp_stream": 51, "frame_number": 1268, "display_filter": "frame.number == 1268", "timestamp_epoch": "1550949986.996850000" }, { "udp_stream": 51, "frame_number": 1301, "display_filter": "frame.number == 1301", "timestamp_epoch": "1550949988.010365000" }, { "udp_stream": 51, "frame_number": 1390, "display_filter": "frame.number == 1390", "timestamp_epoch": "1550949990.022735000" }, { "udp_stream": 51, "frame_number": 1418, "display_filter": "frame.number == 1418", "timestamp_epoch": "1550949994.032774000" }, { "udp_stream": 51, "frame_number": 1421, "display_filter": "frame.number == 1421", "timestamp_epoch": "1550949997.308649000" }, { "udp_stream": 60, "frame_number": 1425, "display_filter": "frame.number == 1425", "timestamp_epoch": "1550949997.309683000" }, { "udp_stream": 60, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1550949997.407985000" }, { "tcp_stream": 82, "frame_number": 1433, "display_filter": "frame.number == 1433", "timestamp_epoch": "1550949997.471468000" }, { "tcp_stream": 92, "frame_number": 2097, "display_filter": "frame.number == 2097", "timestamp_epoch": "1550950020.040042000" }, { "tcp_stream": 93, "frame_number": 2441, "display_filter": "frame.number == 2441", "timestamp_epoch": "1550950022.110604000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:18.679595+00:00" }, { "observable_id": "observable-477c941c36c1541ea82aee04", "type": "domain", "value": "static1.squarespace.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:18.861159+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:44.719891+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:18.853082+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 1212, "display_filter": "frame.number == 1212", "timestamp_epoch": "1550949986.109212000" }, { "udp_stream": 52, "frame_number": 1213, "display_filter": "frame.number == 1213", "timestamp_epoch": "1550949986.211340000" }, { "tcp_stream": 76, "frame_number": 1219, "display_filter": "frame.number == 1219", "timestamp_epoch": "1550949986.299380000" }, { "tcp_stream": 76, "frame_number": 1309, "display_filter": "frame.number == 1309", "timestamp_epoch": "1550949988.157275000" }, { "tcp_stream": 78, "frame_number": 1279, "display_filter": "frame.number == 1279", "timestamp_epoch": "1550949987.324811000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:18.848598+00:00" }, { "observable_id": "observable-3617b48879e18c4b7bb80ddd", "type": "domain", "value": "stormtheory-dc.stormtheory.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:21.884295+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.880129+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 3, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1550949876.448007000" }, { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1550949876.448229000" }, { "udp_stream": 20, "frame_number": 323, "display_filter": "frame.number == 323", "timestamp_epoch": "1550949889.106247000" }, { "udp_stream": 20, "frame_number": 324, "display_filter": "frame.number == 324", "timestamp_epoch": "1550949889.106593000" }, { "udp_stream": 25, "frame_number": 407, "display_filter": "frame.number == 407", "timestamp_epoch": "1550949914.608879000" }, { "udp_stream": 25, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1550949914.609075000" }, { "udp_stream": 38, "frame_number": 545, "display_filter": "frame.number == 545", "timestamp_epoch": "1550949919.924923000" }, { "udp_stream": 38, "frame_number": 546, "display_filter": "frame.number == 546", "timestamp_epoch": "1550949919.925158000" }, { "udp_stream": 82, "frame_number": 10621, "display_filter": "frame.number == 10621", "timestamp_epoch": "1550950711.062623000" }, { "udp_stream": 82, "frame_number": 10622, "display_filter": "frame.number == 10622", "timestamp_epoch": "1550950711.062834000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:21.875458+00:00" }, { "observable_id": "observable-8cc696a71919c005a1cbd1b9", "type": "domain", "value": "stormtheory.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:20.034930+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.032927+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 9, "frame_number": 179, "display_filter": "frame.number == 179", "timestamp_epoch": "1550949877.534398000" }, { "udp_stream": 9, "frame_number": 180, "display_filter": "frame.number == 180", "timestamp_epoch": "1550949877.534662000" }, { "udp_stream": 19, "frame_number": 321, "display_filter": "frame.number == 321", "timestamp_epoch": "1550949884.483779000" }, { "udp_stream": 19, "frame_number": 322, "display_filter": "frame.number == 322", "timestamp_epoch": "1550949884.485879000" }, { "udp_stream": 41, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1550949920.141213000" }, { "udp_stream": 41, "frame_number": 663, "display_filter": "frame.number == 663", "timestamp_epoch": "1550949920.141407000" }, { "udp_stream": 43, "frame_number": 727, "display_filter": "frame.number == 727", "timestamp_epoch": "1550949922.539960000" }, { "udp_stream": 43, "frame_number": 728, "display_filter": "frame.number == 728", "timestamp_epoch": "1550949922.541944000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:20.030694+00:00" }, { "observable_id": "observable-ba8cf8986a1d6f66b96f7c5e", "type": "domain", "value": "superhaps.pw", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:21.193630+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.191472+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 7506, "display_filter": "frame.number == 7506", "timestamp_epoch": "1550950467.015679000" }, { "udp_stream": 75, "frame_number": 7515, "display_filter": "frame.number == 7515", "timestamp_epoch": "1550950467.267304000" }, { "udp_stream": 79, "frame_number": 10362, "display_filter": "frame.number == 10362", "timestamp_epoch": "1550950709.945992000" }, { "udp_stream": 79, "frame_number": 10363, "display_filter": "frame.number == 10363", "timestamp_epoch": "1550950709.946337000" }, { "udp_stream": 104, "frame_number": 23725, "display_filter": "frame.number == 23725", "timestamp_epoch": "1550951314.065320000" }, { "udp_stream": 104, "frame_number": 23726, "display_filter": "frame.number == 23726", "timestamp_epoch": "1550951314.312083000" }, { "udp_stream": 122, "frame_number": 28423, "display_filter": "frame.number == 28423", "timestamp_epoch": "1550951918.502707000" }, { "udp_stream": 122, "frame_number": 28424, "display_filter": "frame.number == 28424", "timestamp_epoch": "1550951918.866154000" }, { "udp_stream": 123, "frame_number": 28847, "display_filter": "frame.number == 28847", "timestamp_epoch": "1550952526.030101000" }, { "udp_stream": 123, "frame_number": 28848, "display_filter": "frame.number == 28848", "timestamp_epoch": "1550952526.309792000" }, { "tcp_stream": 119, "frame_number": 7524, "display_filter": "frame.number == 7524", "timestamp_epoch": "1550950467.586401000" }, { "tcp_stream": 126, "frame_number": 10375, "display_filter": "frame.number == 10375", "timestamp_epoch": "1550950710.265164000" }, { "tcp_stream": 152, "frame_number": 10992, "display_filter": "frame.number == 10992", "timestamp_epoch": "1550950712.340467000" }, { "tcp_stream": 153, "frame_number": 11017, "display_filter": "frame.number == 11017", "timestamp_epoch": "1550950713.344469000" }, { "tcp_stream": 154, "frame_number": 11019, "display_filter": "frame.number == 11019", "timestamp_epoch": "1550950713.344870000" }, { "tcp_stream": 201, "frame_number": 21130, "display_filter": "frame.number == 21130", "timestamp_epoch": "1550951012.339404000" }, { "tcp_stream": 206, "frame_number": 23730, "display_filter": "frame.number == 23730", "timestamp_epoch": "1550951314.626672000" }, { "tcp_stream": 241, "frame_number": 28298, "display_filter": "frame.number == 28298", "timestamp_epoch": "1550951616.116842000" }, { "tcp_stream": 245, "frame_number": 28428, "display_filter": "frame.number == 28428", "timestamp_epoch": "1550951919.190239000" }, { "tcp_stream": 248, "frame_number": 28538, "display_filter": "frame.number == 28538", "timestamp_epoch": "1550952224.317550000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:21.189465+00:00" }, { "observable_id": "observable-578c64f12d70c1da1c45cab8", "type": "domain", "value": "sutton-win-pc.stormtheory.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:20.189415+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.187147+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 725, "display_filter": "frame.number == 725", "timestamp_epoch": "1550949922.538276000" }, { "udp_stream": 42, "frame_number": 726, "display_filter": "frame.number == 726", "timestamp_epoch": "1550949922.538610000" }, { "udp_stream": 83, "frame_number": 10955, "display_filter": "frame.number == 10955", "timestamp_epoch": "1550950711.105255000" }, { "udp_stream": 83, "frame_number": 10956, "display_filter": "frame.number == 10956", "timestamp_epoch": "1550950711.107122000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:20.184910+00:00" }, { "observable_id": "observable-265dac48fe690c1f74a8a65e", "type": "domain", "value": "use.typekit.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:45.087539+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.355444+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 1205, "display_filter": "frame.number == 1205", "timestamp_epoch": "1550949985.985154000" }, { "udp_stream": 49, "frame_number": 1269, "display_filter": "frame.number == 1269", "timestamp_epoch": "1550949986.996939000" }, { "udp_stream": 49, "frame_number": 1300, "display_filter": "frame.number == 1300", "timestamp_epoch": "1550949988.010225000" }, { "udp_stream": 49, "frame_number": 1392, "display_filter": "frame.number == 1392", "timestamp_epoch": "1550949990.023081000" }, { "udp_stream": 49, "frame_number": 1419, "display_filter": "frame.number == 1419", "timestamp_epoch": "1550949994.032866000" }, { "udp_stream": 49, "frame_number": 1422, "display_filter": "frame.number == 1422", "timestamp_epoch": "1550949997.308765000" }, { "udp_stream": 64, "frame_number": 1512, "display_filter": "frame.number == 1512", "timestamp_epoch": "1550949999.603647000" }, { "udp_stream": 64, "frame_number": 1515, "display_filter": "frame.number == 1515", "timestamp_epoch": "1550949999.720570000" }, { "tcp_stream": 83, "frame_number": 1526, "display_filter": "frame.number == 1526", "timestamp_epoch": "1550949999.780623000" }, { "tcp_stream": 87, "frame_number": 2072, "display_filter": "frame.number == 2072", "timestamp_epoch": "1550950019.948062000" }, { "tcp_stream": 89, "frame_number": 2074, "display_filter": "frame.number == 2074", "timestamp_epoch": "1550950019.948370000" }, { "tcp_stream": 90, "frame_number": 2076, "display_filter": "frame.number == 2076", "timestamp_epoch": "1550950019.948506000" }, { "tcp_stream": 91, "frame_number": 2078, "display_filter": "frame.number == 2078", "timestamp_epoch": "1550950019.948761000" }, { "tcp_stream": 88, "frame_number": 2080, "display_filter": "frame.number == 2080", "timestamp_epoch": "1550950019.948922000" }, { "tcp_stream": 86, "frame_number": 2082, "display_filter": "frame.number == 2082", "timestamp_epoch": "1550950019.949113000" }, { "tcp_stream": 96, "frame_number": 2208, "display_filter": "frame.number == 2208", "timestamp_epoch": "1550950020.677958000" }, { "tcp_stream": 97, "frame_number": 2381, "display_filter": "frame.number == 2381", "timestamp_epoch": "1550950021.703192000" }, { "tcp_stream": 101, "frame_number": 2551, "display_filter": "frame.number == 2551", "timestamp_epoch": "1550950022.978231000" }, { "tcp_stream": 100, "frame_number": 2552, "display_filter": "frame.number == 2552", "timestamp_epoch": "1550950022.978311000" }, { "tcp_stream": 102, "frame_number": 2709, "display_filter": "frame.number == 2709", "timestamp_epoch": "1550950024.296158000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:21.350497+00:00" }, { "observable_id": "observable-27e886cdddc72b4a17e68f0a", "type": "domain", "value": "wpad.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 14, "frame_number": 296, "display_filter": "frame.number == 296", "timestamp_epoch": "1550949879.500798000" }, { "udp_stream": 14, "frame_number": 297, "display_filter": "frame.number == 297", "timestamp_epoch": "1550949879.553934000" }, { "udp_stream": 34, "frame_number": 497, "display_filter": "frame.number == 497", "timestamp_epoch": "1550949917.550716000" }, { "udp_stream": 34, "frame_number": 498, "display_filter": "frame.number == 498", "timestamp_epoch": "1550949917.550893000" }, { "udp_stream": 95, "frame_number": 15023, "display_filter": "frame.number == 15023", "timestamp_epoch": "1550950823.597824000" }, { "udp_stream": 95, "frame_number": 15024, "display_filter": "frame.number == 15024", "timestamp_epoch": "1550950823.662806000" }, { "udp_stream": 100, "frame_number": 19107, "display_filter": "frame.number == 19107", "timestamp_epoch": "1550950915.530943000" }, { "udp_stream": 100, "frame_number": 19114, "display_filter": "frame.number == 19114", "timestamp_epoch": "1550950915.620746000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-97e21e2b8e37edf9510a5e04", "type": "domain", "value": "wpad.stormtheory.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 13, "frame_number": 294, "display_filter": "frame.number == 294", "timestamp_epoch": "1550949879.499617000" }, { "udp_stream": 13, "frame_number": 295, "display_filter": "frame.number == 295", "timestamp_epoch": "1550949879.499844000" }, { "udp_stream": 33, "frame_number": 495, "display_filter": "frame.number == 495", "timestamp_epoch": "1550949917.549427000" }, { "udp_stream": 33, "frame_number": 496, "display_filter": "frame.number == 496", "timestamp_epoch": "1550949917.549677000" }, { "udp_stream": 94, "frame_number": 15021, "display_filter": "frame.number == 15021", "timestamp_epoch": "1550950823.596888000" }, { "udp_stream": 94, "frame_number": 15022, "display_filter": "frame.number == 15022", "timestamp_epoch": "1550950823.597365000" }, { "udp_stream": 99, "frame_number": 19105, "display_filter": "frame.number == 19105", "timestamp_epoch": "1550950915.530407000" }, { "udp_stream": 99, "frame_number": 19106, "display_filter": "frame.number == 19106", "timestamp_epoch": "1550950915.530640000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f5e080f6ca048a178c54a862", "type": "domain", "value": "www-googletagmanager.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 114, "frame_number": 24759, "display_filter": "frame.number == 24759", "timestamp_epoch": "1550951427.053264000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d552fe92508b5d9f64198eb3", "type": "domain", "value": "www.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:28.166581+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.363526+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 55, "frame_number": 1292, "display_filter": "frame.number == 1292", "timestamp_epoch": "1550949987.935983000" }, { "udp_stream": 56, "frame_number": 1293, "display_filter": "frame.number == 1293", "timestamp_epoch": "1550949987.937966000" }, { "udp_stream": 57, "frame_number": 1294, "display_filter": "frame.number == 1294", "timestamp_epoch": "1550949987.938668000" }, { "udp_stream": 58, "frame_number": 1295, "display_filter": "frame.number == 1295", "timestamp_epoch": "1550949987.939588000" }, { "udp_stream": 56, "frame_number": 1303, "display_filter": "frame.number == 1303", "timestamp_epoch": "1550949988.034813000" }, { "udp_stream": 57, "frame_number": 1304, "display_filter": "frame.number == 1304", "timestamp_epoch": "1550949988.034951000" }, { "udp_stream": 58, "frame_number": 1305, "display_filter": "frame.number == 1305", "timestamp_epoch": "1550949988.035045000" }, { "udp_stream": 55, "frame_number": 1306, "display_filter": "frame.number == 1306", "timestamp_epoch": "1550949988.035122000" }, { "udp_stream": 117, "frame_number": 25120, "display_filter": "frame.number == 25120", "timestamp_epoch": "1550951430.384807000" }, { "udp_stream": 118, "frame_number": 25121, "display_filter": "frame.number == 25121", "timestamp_epoch": "1550951430.385017000" }, { "udp_stream": 119, "frame_number": 25122, "display_filter": "frame.number == 25122", "timestamp_epoch": "1550951430.385119000" }, { "udp_stream": 120, "frame_number": 25123, "display_filter": "frame.number == 25123", "timestamp_epoch": "1550951430.385453000" }, { "udp_stream": 118, "frame_number": 25145, "display_filter": "frame.number == 25145", "timestamp_epoch": "1550951430.455991000" }, { "udp_stream": 119, "frame_number": 25147, "display_filter": "frame.number == 25147", "timestamp_epoch": "1550951430.456116000" }, { "udp_stream": 120, "frame_number": 25148, "display_filter": "frame.number == 25148", "timestamp_epoch": "1550951430.456236000" }, { "udp_stream": 117, "frame_number": 25151, "display_filter": "frame.number == 25151", "timestamp_epoch": "1550951430.456347000" }, { "tcp_stream": 79, "frame_number": 1357, "display_filter": "frame.number == 1357", "timestamp_epoch": "1550949989.086110000" }, { "tcp_stream": 232, "frame_number": 25256, "display_filter": "frame.number == 25256", "timestamp_epoch": "1550951431.532822000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:21.360024+00:00" }, { "observable_id": "observable-17d8c2f8ade680b12ad505b5", "type": "domain", "value": "www.co.utah.ut.us", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:21.369016+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.367211+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 112, "frame_number": 24713, "display_filter": "frame.number == 24713", "timestamp_epoch": "1550951426.323411000" }, { "udp_stream": 112, "frame_number": 24717, "display_filter": "frame.number == 24717", "timestamp_epoch": "1550951426.486292000" }, { "tcp_stream": 215, "frame_number": 24724, "display_filter": "frame.number == 24724", "timestamp_epoch": "1550951426.570470000" }, { "tcp_stream": 216, "frame_number": 24734, "display_filter": "frame.number == 24734", "timestamp_epoch": "1550951426.966829000" }, { "tcp_stream": 217, "frame_number": 24753, "display_filter": "frame.number == 24753", "timestamp_epoch": "1550951427.031893000" }, { "tcp_stream": 223, "frame_number": 24828, "display_filter": "frame.number == 24828", "timestamp_epoch": "1550951427.595681000" }, { "tcp_stream": 224, "frame_number": 24829, "display_filter": "frame.number == 24829", "timestamp_epoch": "1550951427.595969000" }, { "tcp_stream": 215, "frame_number": 25050, "display_filter": "frame.number == 25050", "timestamp_epoch": "1550951429.285375000" }, { "tcp_stream": 219, "frame_number": 25099, "display_filter": "frame.number == 25099", "timestamp_epoch": "1550951430.033640000" }, { "tcp_stream": 220, "frame_number": 25103, "display_filter": "frame.number == 25103", "timestamp_epoch": "1550951430.057131000" }, { "tcp_stream": 229, "frame_number": 25144, "display_filter": "frame.number == 25144", "timestamp_epoch": "1550951430.455912000" }, { "tcp_stream": 230, "frame_number": 25149, "display_filter": "frame.number == 25149", "timestamp_epoch": "1550951430.456252000" }, { "tcp_stream": 215, "frame_number": 25168, "display_filter": "frame.number == 25168", "timestamp_epoch": "1550951430.605082000" }, { "tcp_stream": 229, "frame_number": 25234, "display_filter": "frame.number == 25234", "timestamp_epoch": "1550951431.173776000" }, { "tcp_stream": 219, "frame_number": 25413, "display_filter": "frame.number == 25413", "timestamp_epoch": "1550951433.296277000" }, { "tcp_stream": 223, "frame_number": 25450, "display_filter": "frame.number == 25450", "timestamp_epoch": "1550951433.801767000" }, { "tcp_stream": 229, "frame_number": 25505, "display_filter": "frame.number == 25505", "timestamp_epoch": "1550951434.213427000" }, { "tcp_stream": 224, "frame_number": 25571, "display_filter": "frame.number == 25571", "timestamp_epoch": "1550951434.984633000" }, { "tcp_stream": 223, "frame_number": 25573, "display_filter": "frame.number == 25573", "timestamp_epoch": "1550951434.984812000" }, { "tcp_stream": 226, "frame_number": 25868, "display_filter": "frame.number == 25868", "timestamp_epoch": "1550951438.897816000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:21.365438+00:00" }, { "observable_id": "observable-3fcb0ac9c3ed85076cd3545a", "type": "domain", "value": "www.download.windowsupdate.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:30.124643+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.697553+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 6165, "display_filter": "frame.number == 6165", "timestamp_epoch": "1550950404.337831000" }, { "udp_stream": 74, "frame_number": 6167, "display_filter": "frame.number == 6167", "timestamp_epoch": "1550950404.667581000" }, { "udp_stream": 102, "frame_number": 19573, "display_filter": "frame.number == 19573", "timestamp_epoch": "1550950925.101210000" }, { "udp_stream": 102, "frame_number": 19574, "display_filter": "frame.number == 19574", "timestamp_epoch": "1550950925.250935000" }, { "tcp_stream": 108, "frame_number": 6171, "display_filter": "frame.number == 6171", "timestamp_epoch": "1550950405.720515000" }, { "tcp_stream": 195, "frame_number": 19578, "display_filter": "frame.number == 19578", "timestamp_epoch": "1550950926.328163000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:21.693783+00:00" }, { "observable_id": "observable-b2384aeb152db2b10f2ac643", "type": "domain", "value": "www.googletagmanager.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:38.593969+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.703346+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 114, "frame_number": 24740, "display_filter": "frame.number == 24740", "timestamp_epoch": "1550951426.973506000" }, { "udp_stream": 114, "frame_number": 24759, "display_filter": "frame.number == 24759", "timestamp_epoch": "1550951427.053264000" }, { "tcp_stream": 221, "frame_number": 24769, "display_filter": "frame.number == 24769", "timestamp_epoch": "1550951427.112102000" }, { "tcp_stream": 222, "frame_number": 24771, "display_filter": "frame.number == 24771", "timestamp_epoch": "1550951427.112412000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:21.700744+00:00" }, { "observable_id": "observable-2ad38cbf0ff8f61b2e6a365d", "type": "domain", "value": "www.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.709134+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 307, "display_filter": "frame.number == 307", "timestamp_epoch": "1550949882.140710000" }, { "udp_stream": 17, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1550949882.246164000" }, { "udp_stream": 44, "frame_number": 745, "display_filter": "frame.number == 745", "timestamp_epoch": "1550949924.687316000" }, { "udp_stream": 44, "frame_number": 746, "display_filter": "frame.number == 746", "timestamp_epoch": "1550949924.782455000" }, { "tcp_stream": 19, "frame_number": 312, "display_filter": "frame.number == 312", "timestamp_epoch": "1550949882.465719000" }, { "tcp_stream": 45, "frame_number": 752, "display_filter": "frame.number == 752", "timestamp_epoch": "1550949924.873662000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:21.706519+00:00" }, { "observable_id": "observable-eaa97753aa0254526dca06e4", "type": "domain", "value": "www.rootscafeslc.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:19.869321+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.863855+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 48, "frame_number": 1191, "display_filter": "frame.number == 1191", "timestamp_epoch": "1550949984.840704000" }, { "udp_stream": 48, "frame_number": 1192, "display_filter": "frame.number == 1192", "timestamp_epoch": "1550949985.000129000" }, { "tcp_stream": 74, "frame_number": 1197, "display_filter": "frame.number == 1197", "timestamp_epoch": "1550949985.110142000" }, { "tcp_stream": 75, "frame_number": 2099, "display_filter": "frame.number == 2099", "timestamp_epoch": "1550950020.077660000" }, { "tcp_stream": 75, "frame_number": 3456, "display_filter": "frame.number == 3456", "timestamp_epoch": "1550950037.861633000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:19.858369+00:00" }, { "observable_id": "observable-0816b34b0863a11574b5e875", "type": "ipv4", "value": "10.2.23.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-839453eabbe12e4213fa1c0c", "type": "ipv4", "value": "10.2.23.109", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 727, "display_filter": "frame.number == 727", "timestamp_epoch": "1550949922.539960000" }, { "udp_stream": 43, "frame_number": 728, "display_filter": "frame.number == 728", "timestamp_epoch": "1550949922.541944000" }, { "udp_stream": 83, "frame_number": 10956, "display_filter": "frame.number == 10956", "timestamp_epoch": "1550950711.107122000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0697f932c1161922eba9f1f3", "type": "ipv4", "value": "10.2.23.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 2, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1550949876.446376000" }, { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1550949876.448229000" }, { "udp_stream": 5, "frame_number": 11, "display_filter": "frame.number == 11", "timestamp_epoch": "1550949876.550993000" }, { "udp_stream": 9, "frame_number": 180, "display_filter": "frame.number == 180", "timestamp_epoch": "1550949877.534662000" }, { "udp_stream": 18, "frame_number": 320, "display_filter": "frame.number == 320", "timestamp_epoch": "1550949884.482553000" }, { "udp_stream": 20, "frame_number": 324, "display_filter": "frame.number == 324", "timestamp_epoch": "1550949889.106593000" }, { "udp_stream": 24, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1550949914.606513000" }, { "udp_stream": 25, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1550949914.609075000" }, { "udp_stream": 27, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1550949914.710748000" }, { "udp_stream": 38, "frame_number": 546, "display_filter": "frame.number == 546", "timestamp_epoch": "1550949919.925158000" }, { "udp_stream": 41, "frame_number": 663, "display_filter": "frame.number == 663", "timestamp_epoch": "1550949920.141407000" }, { "udp_stream": 42, "frame_number": 726, "display_filter": "frame.number == 726", "timestamp_epoch": "1550949922.538610000" }, { "udp_stream": 68, "frame_number": 4396, "display_filter": "frame.number == 4396", "timestamp_epoch": "1550950076.073886000" }, { "udp_stream": 80, "frame_number": 10389, "display_filter": "frame.number == 10389", "timestamp_epoch": "1550950710.839666000" }, { "udp_stream": 82, "frame_number": 10622, "display_filter": "frame.number == 10622", "timestamp_epoch": "1550950711.062834000" }, { "udp_stream": 84, "frame_number": 11291, "display_filter": "frame.number == 11291", "timestamp_epoch": "1550950724.603463000" }, { "udp_stream": 86, "frame_number": 11303, "display_filter": "frame.number == 11303", "timestamp_epoch": "1550950724.706232000" }, { "udp_stream": 88, "frame_number": 12445, "display_filter": "frame.number == 12445", "timestamp_epoch": "1550950760.052750000" }, { "udp_stream": 90, "frame_number": 12458, "display_filter": "frame.number == 12458", "timestamp_epoch": "1550950760.159942000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5bac2608fb52f33033ab2c02", "type": "ipv4", "value": "10.2.23.231", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 19, "frame_number": 321, "display_filter": "frame.number == 321", "timestamp_epoch": "1550949884.483779000" }, { "udp_stream": 19, "frame_number": 322, "display_filter": "frame.number == 322", "timestamp_epoch": "1550949884.485879000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b34e3efa0c38bf0ca50c0f80", "type": "ipv4", "value": "10.2.23.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-601e9ae3c9c92d28cd0043bb", "type": "ipv4", "value": "10.2.23.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-72f93d5d58f456e9328aa6c5", "type": "ipv4", "value": "13.107.21.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 56, "frame_number": 1303, "display_filter": "frame.number == 1303", "timestamp_epoch": "1550949988.034813000" }, { "udp_stream": 57, "frame_number": 1304, "display_filter": "frame.number == 1304", "timestamp_epoch": "1550949988.034951000" }, { "udp_stream": 58, "frame_number": 1305, "display_filter": "frame.number == 1305", "timestamp_epoch": "1550949988.035045000" }, { "udp_stream": 55, "frame_number": 1306, "display_filter": "frame.number == 1306", "timestamp_epoch": "1550949988.035122000" }, { "udp_stream": 118, "frame_number": 25145, "display_filter": "frame.number == 25145", "timestamp_epoch": "1550951430.455991000" }, { "udp_stream": 119, "frame_number": 25147, "display_filter": "frame.number == 25147", "timestamp_epoch": "1550951430.456116000" }, { "udp_stream": 120, "frame_number": 25148, "display_filter": "frame.number == 25148", "timestamp_epoch": "1550951430.456236000" }, { "udp_stream": 117, "frame_number": 25151, "display_filter": "frame.number == 25151", "timestamp_epoch": "1550951430.456347000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-965f3d7b22b1aaac55e15d60", "type": "ipv4", "value": "13.107.5.80", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 54, "frame_number": 1298, "display_filter": "frame.number == 1298", "timestamp_epoch": "1550949987.996656000" }, { "udp_stream": 53, "frame_number": 1299, "display_filter": "frame.number == 1299", "timestamp_epoch": "1550949987.996754000" }, { "udp_stream": 116, "frame_number": 25140, "display_filter": "frame.number == 25140", "timestamp_epoch": "1550951430.455619000" }, { "udp_stream": 115, "frame_number": 25142, "display_filter": "frame.number == 25142", "timestamp_epoch": "1550951430.455767000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4555b48b0e93d4e1089077dd", "type": "ipv4", "value": "131.107.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 1441, "display_filter": "frame.number == 1441", "timestamp_epoch": "1550949997.877899000" }, { "udp_stream": 71, "frame_number": 6151, "display_filter": "frame.number == 6151", "timestamp_epoch": "1550950399.176094000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fc42e550e0da4b24c149e154", "type": "ipv4", "value": "151.101.0.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:48.263653+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.043988+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 1213, "display_filter": "frame.number == 1213", "timestamp_epoch": "1550949986.211340000" }, { "udp_stream": 60, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1550949997.407985000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:22.039441+00:00" }, { "observable_id": "observable-ef2c107b10edc7271a3b3586", "type": "ipv4", "value": "151.101.128.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 1213, "display_filter": "frame.number == 1213", "timestamp_epoch": "1550949986.211340000" }, { "udp_stream": 60, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1550949997.407985000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c0eac9e32352500dc84ff5a7", "type": "ipv4", "value": "151.101.192.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 1213, "display_filter": "frame.number == 1213", "timestamp_epoch": "1550949986.211340000" }, { "udp_stream": 60, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1550949997.407985000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a9bd11f53acfa0814c11c929", "type": "ipv4", "value": "151.101.64.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:19.066489+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.062619+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 1213, "display_filter": "frame.number == 1213", "timestamp_epoch": "1550949986.211340000" }, { "udp_stream": 60, "frame_number": 1429, "display_filter": "frame.number == 1429", "timestamp_epoch": "1550949997.407985000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:19.057755+00:00" }, { "observable_id": "observable-ec4096f0b104f8e5d0b3391a", "type": "ipv4", "value": "161.119.42.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:22.057486+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.053269+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 112, "frame_number": 24717, "display_filter": "frame.number == 24717", "timestamp_epoch": "1550951426.486292000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:22.048229+00:00" }, { "observable_id": "observable-15ff862b800c0d39d1b700fc", "type": "ipv4", "value": "172.217.1.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:22.245979+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.242792+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 114, "frame_number": 24759, "display_filter": "frame.number == 24759", "timestamp_epoch": "1550951427.053264000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:22.239321+00:00" }, { "observable_id": "observable-74d9217689ef7b84c3039cc4", "type": "ipv4", "value": "172.217.2.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:22.435873+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.433673+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 1427, "display_filter": "frame.number == 1427", "timestamp_epoch": "1550949997.401197000" }, { "udp_stream": 113, "frame_number": 25109, "display_filter": "frame.number == 25109", "timestamp_epoch": "1550951430.255035000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:22.430856+00:00" }, { "observable_id": "observable-fb353827abc42e775c29e637", "type": "ipv4", "value": "172.217.2.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:22.620221+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.618315+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 2092, "display_filter": "frame.number == 2092", "timestamp_epoch": "1550950020.020502000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:22.615754+00:00" }, { "observable_id": "observable-6e3a5454404bd81f6744e3c3", "type": "ipv4", "value": "181.215.47.171", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 6143, "display_filter": "frame.number == 6143", "timestamp_epoch": "1550950376.813125000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cb55a28a3892556f716734f3", "type": "ipv4", "value": "185.246.116.239", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:22.932613+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.930697+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 6155, "display_filter": "frame.number == 6155", "timestamp_epoch": "1550950403.232285000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:22.927873+00:00" }, { "observable_id": "observable-db1013cdbef509ee4266e470", "type": "ipv4", "value": "190.146.112.216", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-1ba21054ed92beb68817dd71", "rule_id": "sensitive-data-in-cleartext", "frame_number": 23816 } ], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:15.002056+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:14.827573+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:14.825386+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 207, "frame_number": 23794, "display_filter": "frame.number == 23794", "timestamp_epoch": "1550951353.371777000" }, { "tcp_stream": 208, "frame_number": 23816, "display_filter": "frame.number == 23816", "timestamp_epoch": "1550951355.921398000" }, { "tcp_stream": 212, "frame_number": 24666, "display_filter": "frame.number == 24666", "timestamp_epoch": "1550951415.192699000" }, { "tcp_stream": 237, "frame_number": 26591, "display_filter": "frame.number == 26591", "timestamp_epoch": "1550951444.371220000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:14.821769+00:00" }, { "observable_id": "observable-40ec586e098e0a020e3adfcb", "type": "ipv4", "value": "195.123.246.99", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:23.126548+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.124487+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:23.122161+00:00" }, { "observable_id": "observable-59ca07ea1d2bb1e7a63315cb", "type": "ipv4", "value": "198.185.159.135", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:20.349280+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.347438+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 48, "frame_number": 1192, "display_filter": "frame.number == 1192", "timestamp_epoch": "1550949985.000129000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:20.344946+00:00" }, { "observable_id": "observable-d834e098bb2a986ace1f42f7", "type": "ipv4", "value": "198.185.159.136", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:23.304777+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.301388+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 47, "frame_number": 1177, "display_filter": "frame.number == 1177", "timestamp_epoch": "1550949983.592832000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:23.297393+00:00" }, { "observable_id": "observable-144b1028560c7a04c96dc444", "type": "ipv4", "value": "204.79.197.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:30.957464+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.496275+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 56, "frame_number": 1303, "display_filter": "frame.number == 1303", "timestamp_epoch": "1550949988.034813000" }, { "udp_stream": 57, "frame_number": 1304, "display_filter": "frame.number == 1304", "timestamp_epoch": "1550949988.034951000" }, { "udp_stream": 58, "frame_number": 1305, "display_filter": "frame.number == 1305", "timestamp_epoch": "1550949988.035045000" }, { "udp_stream": 55, "frame_number": 1306, "display_filter": "frame.number == 1306", "timestamp_epoch": "1550949988.035122000" }, { "udp_stream": 118, "frame_number": 25145, "display_filter": "frame.number == 25145", "timestamp_epoch": "1550951430.455991000" }, { "udp_stream": 119, "frame_number": 25147, "display_filter": "frame.number == 25147", "timestamp_epoch": "1550951430.456116000" }, { "udp_stream": 120, "frame_number": 25148, "display_filter": "frame.number == 25148", "timestamp_epoch": "1550951430.456236000" }, { "udp_stream": 117, "frame_number": 25151, "display_filter": "frame.number == 25151", "timestamp_epoch": "1550951430.456347000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:23.494017+00:00" }, { "observable_id": "observable-170b01c66f1a9e349c03023e", "type": "ipv4", "value": "209.141.55.226", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:19.268932+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.264950+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 3119, "display_filter": "frame.number == 3119", "timestamp_epoch": "1550950028.171418000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:19.260361+00:00" }, { "observable_id": "observable-b2925bf1f32b2e52d2ea1ae1", "type": "ipv4", "value": "213.226.68.112", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:23.504134+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.501589+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:23.498930+00:00" }, { "observable_id": "observable-f7bd398c4b34d04a8d8294dd", "type": "ipv4", "value": "216.239.32.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:23.683350+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.681090+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 19781, "display_filter": "frame.number == 19781", "timestamp_epoch": "1550950931.792794000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:23.678696+00:00" }, { "observable_id": "observable-ed81a714cbdde9f234a46d95", "type": "ipv4", "value": "216.239.34.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 19781, "display_filter": "frame.number == 19781", "timestamp_epoch": "1550950931.792794000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-54a5cb27a21a943e24e2ccd3", "type": "ipv4", "value": "216.239.36.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 19781, "display_filter": "frame.number == 19781", "timestamp_epoch": "1550950931.792794000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-33b33e296d4261b8060fa538", "type": "ipv4", "value": "216.239.38.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 19781, "display_filter": "frame.number == 19781", "timestamp_epoch": "1550950931.792794000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ee77a7ead2aca761a3661c86", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c53e7cb4b8bee40eec6e9b26", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3a035cb96b9ba098546424af", "type": "ipv4", "value": "23.218.156.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 16108, "display_filter": "frame.number == 16108", "timestamp_epoch": "1550950846.527507000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e2b4867c1c13ccbe22856007", "type": "ipv4", "value": "23.218.156.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:23.874293+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.869994+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 16108, "display_filter": "frame.number == 16108", "timestamp_epoch": "1550950846.527507000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:23.865284+00:00" }, { "observable_id": "observable-4b1e9edaf92aa129b16e4ac7", "type": "ipv4", "value": "23.223.195.33", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1550949882.246164000" }, { "udp_stream": 44, "frame_number": 746, "display_filter": "frame.number == 746", "timestamp_epoch": "1550949924.782455000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2a1cfdd7864de2960d62d226", "type": "ipv4", "value": "23.223.195.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:24.075998+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.070436+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1550949882.246164000" }, { "udp_stream": 44, "frame_number": 746, "display_filter": "frame.number == 746", "timestamp_epoch": "1550949924.782455000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:24.065452+00:00" }, { "observable_id": "observable-0a40093d25eeafd62d8aa4fa", "type": "ipv4", "value": "23.63.25.226", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:24.293075+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.288238+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 1515, "display_filter": "frame.number == 1515", "timestamp_epoch": "1550949999.720570000" }, { "udp_stream": 67, "frame_number": 2408, "display_filter": "frame.number == 2408", "timestamp_epoch": "1550950021.846199000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:24.282276+00:00" }, { "observable_id": "observable-4ca24b6b1a0abbc75229999b", "type": "ipv4", "value": "255.255.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6684b889cd33370be446e822", "type": "ipv4", "value": "46.249.62.199", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:19.464445+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.457648+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 110, "frame_number": 6249, "display_filter": "frame.number == 6249", "timestamp_epoch": "1550950410.137505000" }, { "tcp_stream": 109, "frame_number": 6262, "display_filter": "frame.number == 6262", "timestamp_epoch": "1550950411.127146000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:19.452692+00:00" }, { "observable_id": "observable-512eb42e3e8dbc3ed82c3589", "type": "ipv4", "value": "67.26.187.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 6167, "display_filter": "frame.number == 6167", "timestamp_epoch": "1550950404.667581000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-506125efb62da8b3e2661904", "type": "ipv4", "value": "72.21.81.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:35.712902+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.486132+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 1840, "display_filter": "frame.number == 1840", "timestamp_epoch": "1550950014.051797000" }, { "udp_stream": 121, "frame_number": 27600, "display_filter": "frame.number == 27600", "timestamp_epoch": "1550951456.504409000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:24.480153+00:00" }, { "observable_id": "observable-6f6acdb0395da1c4f28c9d34", "type": "ipv4", "value": "72.21.81.240", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:24.689881+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.686536+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 19574, "display_filter": "frame.number == 19574", "timestamp_epoch": "1550950925.250935000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:24.676598+00:00" }, { "observable_id": "observable-b30d57f8a81a6fcd6bfdfacf", "type": "ipv4", "value": "8.252.15.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 6167, "display_filter": "frame.number == 6167", "timestamp_epoch": "1550950404.667581000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-afb24c987db76f525ded2f87", "type": "ipv4", "value": "8.252.250.126", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 6167, "display_filter": "frame.number == 6167", "timestamp_epoch": "1550950404.667581000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b5b72c3e2dc64df2121cb66d", "type": "ipv4", "value": "8.253.129.66", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:24.878011+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.874065+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 6167, "display_filter": "frame.number == 6167", "timestamp_epoch": "1550950404.667581000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:24.869273+00:00" }, { "observable_id": "observable-0831296c9c4fbe988381749a", "type": "ipv4", "value": "8.253.203.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 6167, "display_filter": "frame.number == 6167", "timestamp_epoch": "1550950404.667581000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-25485a8aa76cec11e08dbcf8", "type": "ipv4", "value": "85.143.218.7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:19.682532+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.680774+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 150, "frame_number": 10966, "display_filter": "frame.number == 10966", "timestamp_epoch": "1550950711.324212000" }, { "tcp_stream": 161, "frame_number": 11986, "display_filter": "frame.number == 11986", "timestamp_epoch": "1550950744.487874000" }, { "tcp_stream": 200, "frame_number": 20146, "display_filter": "frame.number == 20146", "timestamp_epoch": "1550950940.188912000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:19.678529+00:00" }, { "observable_id": "observable-f9b8591529ee2e2b16c6d3f0", "type": "ipv4", "value": "87.236.22.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:25.063869+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:25.059517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 7515, "display_filter": "frame.number == 7515", "timestamp_epoch": "1550950467.267304000" }, { "udp_stream": 79, "frame_number": 10363, "display_filter": "frame.number == 10363", "timestamp_epoch": "1550950709.946337000" }, { "udp_stream": 104, "frame_number": 23726, "display_filter": "frame.number == 23726", "timestamp_epoch": "1550951314.312083000" }, { "udp_stream": 122, "frame_number": 28424, "display_filter": "frame.number == 28424", "timestamp_epoch": "1550951918.866154000" }, { "udp_stream": 123, "frame_number": 28848, "display_filter": "frame.number == 28848", "timestamp_epoch": "1550952526.309792000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:25.054995+00:00" }, { "observable_id": "observable-94d626ba8a5a2d89fc0903db", "type": "ipv4", "value": "92.223.105.176", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1fadd1d0c842aa14150fafcf", "type": "ipv4", "value": "94.103.95.185", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f26d44700504b0160296b9d0", "type": "ipv6", "value": "fd3e:4f5a:5b81::1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 1443, "display_filter": "frame.number == 1443", "timestamp_epoch": "1550949997.932320000" }, { "udp_stream": 72, "frame_number": 6153, "display_filter": "frame.number == 6153", "timestamp_epoch": "1550950399.176718000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4fcc2ba9609091979e1d64ab", "type": "sha256", "value": "152f05b79c5f8ae61dce111c5415be105396ad820f3fc3cd537b0aaa2acd8d58", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ff7f6c8a102e82f6d0b85ae5", "type": "sha256", "value": "17ef1c0ff8515ab325b5976632264553118a2618e5e8dcf3ff058dee515ab738", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-98b2a62ec437856e716017b5", "type": "sha256", "value": "1fee1ef37060734fe38728af41fad66a827abb34151a3658ceee6000d4df40b2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1bb8b8543606b4e692ca3b8e", "type": "sha256", "value": "3362bbc3aeca0b9a3e74c27568033c566350d30214cfa383b470327ec2ac8c07", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-71add15f2538ccd5ef9de531", "type": "sha256", "value": "33c2fde7c0162c50e4450e874c99a13a086a56db266d8962bd7d31bdb08956f3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ce74f34c8bbf4a023011258e", "type": "sha256", "value": "351e3c9dadd0128ea718633173e073a6f7a3d9bf6a1ce173bff2221cb3b0afae", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-464a66892443e3879ed5011c", "type": "sha256", "value": "360daaf74aa6a7e36952e66764a76de6b6a1a48bcbbad611288396ead6f733bb", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b20ca00bbd92de471ea68adb", "type": "sha256", "value": "38c6c5b8d6fa71d9856758a5c0c2ac9d0a0a1450f75bb1004dd988e23d73a312", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "static-review", "artifact_id": "artifact-a44db5d69b9bc8f3fdaaff4e", "features": [ "pe-bytes-under-non-executable-url-extension" ], "frames": [ 12777 ], "interpretation": "A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict." } ], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:15.215066+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:15.007191+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:15.004527+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:15.002090+00:00" }, { "observable_id": "observable-280ea17d1444a818aab8c47f", "type": "sha256", "value": "3abae6dd2ddae23b2de2ccbcc160a4a5773bef8934d0e6896d50197c3d3c417f", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "static-review", "artifact_id": "artifact-64c04b868e21280de7169f44", "features": [ "pe-bytes-under-non-executable-url-extension" ], "frames": [ 20903 ], "interpretation": "A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict." } ], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:15.787778+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:15.585895+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:15.582091+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:15.577670+00:00" }, { "observable_id": "observable-39f209a6bba2310f670a2f55", "type": "sha256", "value": "3c4ec495f17d21cc236bc7238bc02728bd945c07157fbf875cac340269afc207", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c883ceb6c60bac3290b24648", "type": "sha256", "value": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-759cc4bbb8f93091e01ee60b", "type": "sha256", "value": "44373d4e4bea5c974656b41b630eae6519b62aeb4889277034ba7925c01bb60f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3269f326bdd038cdfa2e9421", "type": "sha256", "value": "4c957072ab097d3474039f432466cd251d1dc7d91559b76d4e5ead4a8bd499d5", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "static-review", "artifact_id": "artifact-c300c6cc1195496e5d11e6e0", "features": [ "pe-bytes-under-non-executable-url-extension" ], "frames": [ 13356 ], "interpretation": "A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict." } ], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:16.230788+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:16.006256+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:16.001945+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:15.997485+00:00" }, { "observable_id": "observable-8d528f0af13bd19e60a6b362", "type": "sha256", "value": "51cd2200fde479b2d57db744c846f9c83dbefe967e10efa510a0eecf644ac2ac", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-13c8a47dcfaa750a6273854f", "type": "sha256", "value": "592e7fa07596b36f577e4a703c8614d98c6602b3fbafd6cf94026aadc109ee42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-402a6641caaad340f1a9dc42", "type": "sha256", "value": "5aeb07f9980663c2501c9620371e11ae7aa6e320d94dd753d0ef56d8308c74b3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e187e6ddd23eff995a401b14", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9381476bf76d8b483b2ed59b", "type": "sha256", "value": "6281f4b88789d78a3520cea62298a5d76562a5ac5a265c915f58ab46e90773bf", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fc2a01bc43e4811640783d76", "type": "sha256", "value": "63e2dc2b85defb87378e12ecd7d0f4631d37fcf42152acf2a28ae7453b40633c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:16.791045+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:16.586274+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:16.584448+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:16.581574+00:00" }, { "observable_id": "observable-76ca49464d86ec49c6f5b9cf", "type": "sha256", "value": "640994b0bf9615de96e00f0344d84c56ff04eff2f47e99ebf0c9ea7fa6ba3502", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e23a3dc785f0cd3636c156a0", "type": "sha256", "value": "6736e7a0746fbcfef21feae864dda1ae4e888d3ea1d5cea115c71849e47e787a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d6ac6571e1acb2b39b239f05", "type": "sha256", "value": "6b6bf68b59a71f79863bf3b342b6dba38c2dbb76814deea82250c513517ddb19", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f6e3a3080e5a04bef75002bd", "type": "sha256", "value": "6bb03471d2a729fd037bb0f8b42854c3b9d14e87e7bc9b337ed2274a74a0a3c4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-101e0cfd50734ea8aad47853", "type": "sha256", "value": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ce7e08bcc569633103c37756", "type": "sha256", "value": "6ee67e7ec3881929e6d6f2bf4e761fb44d04b84b5e77f1df7ef3c05a698484ee", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-319bb4a74f7ce96c55ad8104", "type": "sha256", "value": "71a22598eedbbdedd0ba95f9fbf4a19726abf69681462f56cf535f4fd505a079", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3973f8623feb3c413e031a75", "type": "sha256", "value": "77ab5e18a4c52fe1b402ca8907ad3315c19e1fb7ed19aaa03f1fb3070cd286b1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c0495ef846493aaddfbcdc28", "type": "sha256", "value": "7898a2dbfd52591cf085b2743c0f2eaa750143b77a8cfebfbbf23d692bc4d846", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3d5edcd90db3b223e66cc36e", "type": "sha256", "value": "810151e2aa23d212c5105db84e9eb16a76bb589eacfd4bc5a287a092c2ef71fa", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7e5e4969aa04010eaee019e3", "type": "sha256", "value": "8cf2cddda8522975a22da3da429339be471234eacc0e11c099d6dcb732cf3cbb", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "static-review", "artifact_id": "artifact-162a2189c16314dce4cad0b7", "features": [ "pe-bytes-under-non-executable-url-extension" ], "frames": [ 3542 ], "interpretation": "A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict." } ], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:17.242801+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:17.031444+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:17.029641+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:17.024542+00:00" }, { "observable_id": "observable-c33d3cc0b06519b804273a79", "type": "sha256", "value": "9801c1c9ecc18a5361fbb2188614518c84837fd23cdcc5dafde214c7efc5ba61", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-08dac1f725f9cf7701f6b7ef", "type": "sha256", "value": "9a9eef92488fae7c9199a57abe8fe52dfbabfd4884a150cde674f86304748c84", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5e02afc119160ffd710e0df4", "type": "sha256", "value": "a7325536819e47e298d38720b60ecb4c6ca63ebf07df04e768ee95d92c854e17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d40592f77fb4cc0459d8cd9", "type": "sha256", "value": "aaa1afd7ae3a37dd93a8b19408e2770eaee666932366bf4e1703533148914076", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-772d2d988483709a1c33da14", "type": "sha256", "value": "adc225a50d7a314341a7c857f092b962e3967d4addb7d2b48ff335c7bedad350", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-da542c8fb1418024ac36e724", "type": "sha256", "value": "b577d12d1f8eaacf060db96a7b2bcc0009d0c3fd8d4842bd85175a50b2a1f972", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7130ab373fdabb704a58cd2e", "type": "sha256", "value": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b41952158d05172d5d5d773", "type": "sha256", "value": "ce3a22f1ccba5bbeebb0a9fd49c3e72fbde9e1816959b67e5b1fb248c1e1041a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a07c5cd31310fda8829f8a07", "type": "sha256", "value": "d43159c8bf2e1bd866abdbb1687911e2282b1f98a7c063f85ffd53a7f51efed4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:17.773715+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:17.584224+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:17.582387+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:17.580057+00:00" }, { "observable_id": "observable-649927f34fb9787dad86eb3c", "type": "sha256", "value": "d7b2de7a314f64ab62777494d3f9587dd679d637fd8e68783b68977bbb3df29e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cb1d2139c306b1ebe0e3e17b", "type": "sha256", "value": "d7c9595737524bc5febd4507cbe47457dbd59ce733315f1ada59a91c6754c193", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b3189899e9b16fbccc24f145", "type": "sha256", "value": "d95a35fac8425ed6c010066a81b4330ade8dd325713e077d67fcfd33e7cafcac", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-80edf00724bb934b24f0df6c", "type": "sha256", "value": "de799971c904cfabc587484202b8d4bd4b40414ac6b23d1e51b16196bf100013", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-968dae5b323d3142b8b7f4b4", "type": "sha256", "value": "df5f5ce34c9cf3edd665586295e356d6b56d9ef3e54614001f4b178217ec92fe", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ae021e095ec69c6fc7aa1a1a", "type": "sha256", "value": "e32d0b53c63fe1a6b0759ebc8824b97661d369004213853438faaa34134967e6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c1946ed796846985b738b150", "type": "sha256", "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3fdb374ab8b6ecdb20e04b3c", "type": "sha256", "value": "ec0a5627751851db7afed684f83dde6178c3e6b2114adc24a1294fb2bb1d40e8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dc7f7f2c3cc7f6901993e10e", "type": "sha256", "value": "ed001f8b45a9191508e79be37b5a0003faaf3bc356eb241fe11f2b56ab9f60ae", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1ab215ceb3cf11de4f9a2a7f", "type": "sha256", "value": "f0c4a8877fe0d8ed1f7350d20d476d37601fb6c6119eb986fce4d8ae2852061c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0d8e695ab072cfe7dcc72a77", "type": "sha256", "value": "f1b789be1126b557240dd0dfe98fc5f3ad6341bb1a5d8be0a954f65b486ad32a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:18.342103+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:18.123193+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:18.118340+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:18.113206+00:00" }, { "observable_id": "observable-736e65d2692d41acda941b16", "type": "sha256", "value": "f7b0061ce2ceec8a73a0957dc975d2dde0f4de8c0b63c041cd78a29414d2645c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fa073d9c0ce8fb6569371e2d", "type": "sha256", "value": "fbf3439d0eb209ab2bdf6794da01485836e5bb0910c4624ac2d43dead3ff10d9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3b67ebf8fe21997043fe676e", "type": "url", "value": "http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/81/", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-1ba21054ed92beb68817dd71", "rule_id": "sensitive-data-in-cleartext", "frame_number": 23816 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 208, "frame_number": 23816, "display_filter": "frame.number == 23816", "timestamp_epoch": "1550951355.921398000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d85a116081326c38b2c3a16e", "type": "url", "value": "http://190.146.112.216/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/83/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 207, "frame_number": 23794, "display_filter": "frame.number == 23794", "timestamp_epoch": "1550951353.371777000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-228d7a3a6afd97e6c0e8e085", "type": "url", "value": "http://190.146.112.216:8082/win14/FERGUSON-WIN-PC_W617601.A224CA97286EF57013D71844B4630473/90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 212, "frame_number": 24666, "display_filter": "frame.number == 24666", "timestamp_epoch": "1550951415.192699000" }, { "tcp_stream": 237, "frame_number": 26591, "display_filter": "frame.number == 26591", "timestamp_epoch": "1550951444.371220000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c17b4f48a53da84765b0aed4", "type": "url", "value": "http://209.141.55.226/troll1.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 105, "frame_number": 3119, "display_filter": "frame.number == 3119", "timestamp_epoch": "1550950028.171418000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0f637827ead5bfb10acf8369", "type": "url", "value": "http://46.249.62.199/Sw9JKmXqaSj.exe", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 109, "frame_number": 6262, "display_filter": "frame.number == 6262", "timestamp_epoch": "1550950411.127146000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f4859bb7df681e1f342875de", "type": "url", "value": "http://46.249.62.199/Tinx86_14.exe", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 110, "frame_number": 6249, "display_filter": "frame.number == 6249", "timestamp_epoch": "1550950410.137505000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-512678c4062635d244ef1f1a", "type": "url", "value": "http://85.143.218.7/sin.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 200, "frame_number": 20146, "display_filter": "frame.number == 20146", "timestamp_epoch": "1550950940.188912000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d71816509b6d177f9eb8ec8b", "type": "url", "value": "http://85.143.218.7/tin.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 161, "frame_number": 11986, "display_filter": "frame.number == 11986", "timestamp_epoch": "1550950744.487874000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f4364408a935dbfd2e32ce2b", "type": "url", "value": "http://85.143.218.7/win.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 150, "frame_number": 10966, "display_filter": "frame.number == 10966", "timestamp_epoch": "1550950711.324212000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6ac88152528db3d3a2bd4873", "type": "url", "value": "http://crl.microsoft.com/pki/crl/products/CSPCA.crl", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 184, "frame_number": 16113, "display_filter": "frame.number == 16113", "timestamp_epoch": "1550950846.604756000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a68ec87830f38926c7380e25", "type": "url", "value": "http://fonts.googleapis.com/css?family=Lato:100,400", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 81, "frame_number": 1438, "display_filter": "frame.number == 1438", "timestamp_epoch": "1550949997.768948000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-47ff539e4ea523045fe2d034", "type": "url", "value": "http://fonts.googleapis.com/css?family=Lato:300,400,400italic,600,700|Raleway:300,400,500,600,700|Crete+Round:400italic", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 227, "frame_number": 25114, "display_filter": "frame.number == 25114", "timestamp_epoch": "1550951430.317878000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ab36e678bcc2b118442e5d6d", "type": "url", "value": "http://fonts.gstatic.com/s/lato/v14/S6u8w4BMUTPHh30AXC-s.woff", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 95, "frame_number": 2105, "display_filter": "frame.number == 2105", "timestamp_epoch": "1550950020.078881000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-049b7fffe4759c4e84e95c4a", "type": "url", "value": "http://fonts.gstatic.com/s/lato/v14/S6uyw4BMUTPHjx4wWA.woff", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 94, "frame_number": 2107, "display_filter": "frame.number == 2107", "timestamp_epoch": "1550950020.079078000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d3f429118b422d4a7c345e30", "type": "url", "value": "http://ipecho.net/plain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 196, "frame_number": 19795, "display_filter": "frame.number == 19795", "timestamp_epoch": "1550950931.858061000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2ad57d1c491957465dac93f0", "type": "url", "value": "http://rootscafeslc.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 72, "frame_number": 1185, "display_filter": "frame.number == 1185", "timestamp_epoch": "1550949984.295684000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-752ce33925275481a1a7bf59", "type": "url", "value": "http://static.squarespace.com/universal/scripts-compressed/common-c2a92195cbc0a2d6aed1-min.en-US.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 82, "frame_number": 1433, "display_filter": "frame.number == 1433", "timestamp_epoch": "1550949997.471468000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-23c4114c50019f53a6c776e7", "type": "url", "value": "http://static1.squarespace.com/static/53176ac0e4b0cc8a54026440/t/53597593e4b0bb8f10e2db9a/1503949442424/?format=1500w", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 76, "frame_number": 1219, "display_filter": "frame.number == 1219", "timestamp_epoch": "1550949986.299380000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b5f3bf91f56c182c2d061f1c", "type": "url", "value": "http://static1.squarespace.com/static/sitecss/53176ac0e4b0cc8a54026440/47/507c1fdf84ae362b5e7be44e/53176ac0e4b0cc8a54026444/2141-05142015/1418412276795/site.css?&filterFeatures=false", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 76, "frame_number": 1309, "display_filter": "frame.number == 1309", "timestamp_epoch": "1550949988.157275000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7bf557c85934a638d0fdb7a9", "type": "url", "value": "http://superhaps.pw/data2.php?C68FF38437D96CED", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 119, "frame_number": 7524, "display_filter": "frame.number == 7524", "timestamp_epoch": "1550950467.586401000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0d116571c566ea2b21e8a654", "type": "url", "value": "http://use.typekit.net/ik/qtSfIe0hWL1wtEbIsJFPUsITCi0N4DUQd5Tzt0wJ8s6feGw2fFHN4UJLFRbh52jhWD9DwQShjAw3ZQsKweFR5eIuF2MkFRbXwgTuiaiaO14zdasDjhBcZWFCjkoRdhXCScNziYFRjAZ8ShUROcFzdPUCiAoTdkuqZWZ8deN3dAm0ifuE-QJUO1FUiABkZWF3jAF8OcFzdP37OcUudc8zOAs8icmCdaglZAoXOWTTwRI0SaBujW48Sagyjh90jhNlJ6U3ScNt-AuyOAozicIKgcBqZAUCZPG4fHCgIMMjMPMfH6qJtKGbMg62JMJ7fbKzMsMMeMb6MKG4fHXgIMMjgKMfH6qJK3IbMg6YJMJ7fbKTMsMMeM66MKG4f5w7IMMj2PMfH6qJKbIbMg64JMJ7fbK3MsMMeMt6MKG4fHtgIMMjIfMfH6qJRMIbMg6sJMJ7fbK7MsMMegJ6MKG4fJGgIMMjIkMfH6qJXR9bMs62JMJ7fbR5FsMgeMb6MKG4fFIVIMIjgkMfH6qJXD9bMs6FJMJ7fbRVFsMgeMt6MKG4fFJVIMIjIPMf.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 83, "frame_number": 1526, "display_filter": "frame.number == 1526", "timestamp_epoch": "1550949999.780623000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-837c693c5aa5d932c2a4b2df", "type": "url", "value": "http://www.bing.com/favicon.ico", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 79, "frame_number": 1357, "display_filter": "frame.number == 1357", "timestamp_epoch": "1550949989.086110000" }, { "tcp_stream": 232, "frame_number": 25256, "display_filter": "frame.number == 25256", "timestamp_epoch": "1550951431.532822000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f3d9fd08f05a69e041de7e36", "type": "url", "value": "http://www.co.utah.ut.us/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 215, "frame_number": 24724, "display_filter": "frame.number == 24724", "timestamp_epoch": "1550951426.570470000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-057abb2fd1c51bc8f4154e31", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/animate.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 223, "frame_number": 24828, "display_filter": "frame.number == 24828", "timestamp_epoch": "1550951427.595681000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3375535c41d2317809a5fda1", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/bootstrap.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 216, "frame_number": 24734, "display_filter": "frame.number == 24734", "timestamp_epoch": "1550951426.966829000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8d0ac63fd67803f9263eda6f", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/dark.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 219, "frame_number": 25099, "display_filter": "frame.number == 25099", "timestamp_epoch": "1550951430.033640000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-edf6df46069a1bf7140f07e7", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/font-icons.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 220, "frame_number": 25103, "display_filter": "frame.number == 25103", "timestamp_epoch": "1550951430.057131000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-901b2baafa56bc91df123b9d", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/responsive.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 224, "frame_number": 24829, "display_filter": "frame.number == 24829", "timestamp_epoch": "1550951427.595969000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-670ed465bbcb9ce9694a48e2", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/css/swiper.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 215, "frame_number": 25050, "display_filter": "frame.number == 25050", "timestamp_epoch": "1550951429.285375000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f51698a1016f96d95862c423", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/1A1.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 215, "frame_number": 26237, "display_filter": "frame.number == 26237", "timestamp_epoch": "1550951443.195589000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-109ee3c2ad1403ff2a24a054", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/2A1.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 216, "frame_number": 26243, "display_filter": "frame.number == 26243", "timestamp_epoch": "1550951443.363937000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bca12960c7d63c74ab28cd27", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/3A1.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 226, "frame_number": 26843, "display_filter": "frame.number == 26843", "timestamp_epoch": "1550951447.135555000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e0b87aa5638b396cbf8bf059", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/6A1.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 216, "frame_number": 26868, "display_filter": "frame.number == 26868", "timestamp_epoch": "1550951447.371722000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1efd0eaa8598c7c918ab7490", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/7ABurn1.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 238, "frame_number": 26945, "display_filter": "frame.number == 26945", "timestamp_epoch": "1550951448.057698000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1c203b480b334074139e12af", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/clients/StormWater1.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 238, "frame_number": 27072, "display_filter": "frame.number == 27072", "timestamp_epoch": "1550951449.806280000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7fd29f9aee92755a0172aa25", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/map.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 215, "frame_number": 26103, "display_filter": "frame.number == 26103", "timestamp_epoch": "1550951441.282788000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ba0f2d0521c25dc39dd62e31", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/performance.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 215, "frame_number": 26147, "display_filter": "frame.number == 26147", "timestamp_epoch": "1550951442.235477000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-51670dd180fc2d8b2cf56b3a", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tick.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 216, "frame_number": 26008, "display_filter": "frame.number == 26008", "timestamp_epoch": "1550951440.093034000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e07d9963d19079211c5e9129", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/icons/features/tools.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 216, "frame_number": 26024, "display_filter": "frame.number == 26024", "timestamp_epoch": "1550951440.217419000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4bbf20d4ec6a15bb1d956c58", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/images/logo1.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 229, "frame_number": 25144, "display_filter": "frame.number == 25144", "timestamp_epoch": "1550951430.455912000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c8ffdc5158a7dc63095c1bb", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/functions.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 230, "frame_number": 25149, "display_filter": "frame.number == 25149", "timestamp_epoch": "1550951430.456252000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fae2920f4ed37fcaf8e46175", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/jquery.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 226, "frame_number": 25868, "display_filter": "frame.number == 25868", "timestamp_epoch": "1550951438.897816000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d94d4574ff30609a61510176", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/js/plugins.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 225, "frame_number": 25880, "display_filter": "frame.number == 25880", "timestamp_epoch": "1550951438.932666000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-930ac9040e1e1d32b55b383d", "type": "url", "value": "http://www.co.utah.ut.us/apps/LeenaCanvas/Package-HTML/HTML/style.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 217, "frame_number": 24753, "display_filter": "frame.number == 24753", "timestamp_epoch": "1550951427.031893000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b5324de2f7558708afa608d5", "type": "url", "value": "http://www.co.utah.ut.us/Dept/COMMISH/Data/WNData/default.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 229, "frame_number": 25234, "display_filter": "frame.number == 25234", "timestamp_epoch": "1550951431.173776000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9d400ba8f0d9ee8d63389fd9", "type": "url", "value": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/IMG_1047.JPG", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 224, "frame_number": 25571, "display_filter": "frame.number == 25571", "timestamp_epoch": "1550951434.984633000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-af4aafafa06ca9ef633a3adb", "type": "url", "value": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/JerikaTimpCaveTrail1.JPG", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 229, "frame_number": 25505, "display_filter": "frame.number == 25505", "timestamp_epoch": "1550951434.213427000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad13e042eab69e3316d898b2", "type": "url", "value": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/Martin_Richard.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 223, "frame_number": 25450, "display_filter": "frame.number == 25450", "timestamp_epoch": "1550951433.801767000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d07d0207e1e46cd76a98e4a5", "type": "url", "value": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/OUR_Adobe_Jon_Lines_Award.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 219, "frame_number": 25413, "display_filter": "frame.number == 25413", "timestamp_epoch": "1550951433.296277000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3b7d12f595ebcf8b2bfac90f", "type": "url", "value": "http://www.co.utah.ut.us/Dept/SHERIFF/Data/WNData/TanyaandJenna.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 223, "frame_number": 25573, "display_filter": "frame.number == 25573", "timestamp_epoch": "1550951434.984812000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4419532888cea78d71400267", "type": "url", "value": "http://www.co.utah.ut.us/Images1/custom/Opiate_ProvoTownHall.jpg", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 215, "frame_number": 25168, "display_filter": "frame.number == 25168", "timestamp_epoch": "1550951430.605082000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6c68eed0733dc2d73c76765e", "type": "url", "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 6171, "display_filter": "frame.number == 6171", "timestamp_epoch": "1550950405.720515000" }, { "tcp_stream": 195, "frame_number": 19578, "display_filter": "frame.number == 19578", "timestamp_epoch": "1550950926.328163000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9177fda301c136e2ea2bd76", "type": "url", "value": "http://www.msftncsi.com/ncsi.txt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 19, "frame_number": 312, "display_filter": "frame.number == 312", "timestamp_epoch": "1550949882.465719000" }, { "tcp_stream": 45, "frame_number": 752, "display_filter": "frame.number == 752", "timestamp_epoch": "1550949924.873662000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8c4e5f8bab2c29fce1ab67bd", "type": "url", "value": "http://www.rootscafeslc.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 74, "frame_number": 1197, "display_filter": "frame.number == 1197", "timestamp_epoch": "1550949985.110142000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3b894db358a1d895946b3f05", "type": "url", "value": "http://www.rootscafeslc.com/api/census/RecordHit?crumb=BetopJHiVtAYMGE5MDI5N2JlN2U4Zjg1MjM3ODJmNDc4NDQ1ODBi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 75, "frame_number": 2099, "display_filter": "frame.number == 2099", "timestamp_epoch": "1550950020.077660000" }, { "tcp_stream": 75, "frame_number": 3456, "display_filter": "frame.number == 3456", "timestamp_epoch": "1550950037.861633000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 189, "suspicious": 6 }, "ioc_candidate_count": 6, "summary": "195 typed observations; 6 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-4fcc2ba9609091979e1d64ab", "type": "sha256", "value": "152f05b79c5f8ae61dce111c5415be105396ad820f3fc3cd537b0aaa2acd8d58", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ff7f6c8a102e82f6d0b85ae5", "type": "sha256", "value": "17ef1c0ff8515ab325b5976632264553118a2618e5e8dcf3ff058dee515ab738", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-98b2a62ec437856e716017b5", "type": "sha256", "value": "1fee1ef37060734fe38728af41fad66a827abb34151a3658ceee6000d4df40b2", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1bb8b8543606b4e692ca3b8e", "type": "sha256", "value": "3362bbc3aeca0b9a3e74c27568033c566350d30214cfa383b470327ec2ac8c07", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-71add15f2538ccd5ef9de531", "type": "sha256", "value": "33c2fde7c0162c50e4450e874c99a13a086a56db266d8962bd7d31bdb08956f3", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ce74f34c8bbf4a023011258e", "type": "sha256", "value": "351e3c9dadd0128ea718633173e073a6f7a3d9bf6a1ce173bff2221cb3b0afae", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-464a66892443e3879ed5011c", "type": "sha256", "value": "360daaf74aa6a7e36952e66764a76de6b6a1a48bcbbad611288396ead6f733bb", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-39f209a6bba2310f670a2f55", "type": "sha256", "value": "3c4ec495f17d21cc236bc7238bc02728bd945c07157fbf875cac340269afc207", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c883ceb6c60bac3290b24648", "type": "sha256", "value": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-759cc4bbb8f93091e01ee60b", "type": "sha256", "value": "44373d4e4bea5c974656b41b630eae6519b62aeb4889277034ba7925c01bb60f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d528f0af13bd19e60a6b362", "type": "sha256", "value": "51cd2200fde479b2d57db744c846f9c83dbefe967e10efa510a0eecf644ac2ac", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-13c8a47dcfaa750a6273854f", "type": "sha256", "value": "592e7fa07596b36f577e4a703c8614d98c6602b3fbafd6cf94026aadc109ee42", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-402a6641caaad340f1a9dc42", "type": "sha256", "value": "5aeb07f9980663c2501c9620371e11ae7aa6e320d94dd753d0ef56d8308c74b3", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e187e6ddd23eff995a401b14", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9381476bf76d8b483b2ed59b", "type": "sha256", "value": "6281f4b88789d78a3520cea62298a5d76562a5ac5a265c915f58ab46e90773bf", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-76ca49464d86ec49c6f5b9cf", "type": "sha256", "value": "640994b0bf9615de96e00f0344d84c56ff04eff2f47e99ebf0c9ea7fa6ba3502", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e23a3dc785f0cd3636c156a0", "type": "sha256", "value": "6736e7a0746fbcfef21feae864dda1ae4e888d3ea1d5cea115c71849e47e787a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d6ac6571e1acb2b39b239f05", "type": "sha256", "value": "6b6bf68b59a71f79863bf3b342b6dba38c2dbb76814deea82250c513517ddb19", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f6e3a3080e5a04bef75002bd", "type": "sha256", "value": "6bb03471d2a729fd037bb0f8b42854c3b9d14e87e7bc9b337ed2274a74a0a3c4", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-101e0cfd50734ea8aad47853", "type": "sha256", "value": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ce7e08bcc569633103c37756", "type": "sha256", "value": "6ee67e7ec3881929e6d6f2bf4e761fb44d04b84b5e77f1df7ef3c05a698484ee", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-319bb4a74f7ce96c55ad8104", "type": "sha256", "value": "71a22598eedbbdedd0ba95f9fbf4a19726abf69681462f56cf535f4fd505a079", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3973f8623feb3c413e031a75", "type": "sha256", "value": "77ab5e18a4c52fe1b402ca8907ad3315c19e1fb7ed19aaa03f1fb3070cd286b1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c0495ef846493aaddfbcdc28", "type": "sha256", "value": "7898a2dbfd52591cf085b2743c0f2eaa750143b77a8cfebfbbf23d692bc4d846", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3d5edcd90db3b223e66cc36e", "type": "sha256", "value": "810151e2aa23d212c5105db84e9eb16a76bb589eacfd4bc5a287a092c2ef71fa", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c33d3cc0b06519b804273a79", "type": "sha256", "value": "9801c1c9ecc18a5361fbb2188614518c84837fd23cdcc5dafde214c7efc5ba61", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-08dac1f725f9cf7701f6b7ef", "type": "sha256", "value": "9a9eef92488fae7c9199a57abe8fe52dfbabfd4884a150cde674f86304748c84", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5e02afc119160ffd710e0df4", "type": "sha256", "value": "a7325536819e47e298d38720b60ecb4c6ca63ebf07df04e768ee95d92c854e17", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6d40592f77fb4cc0459d8cd9", "type": "sha256", "value": "aaa1afd7ae3a37dd93a8b19408e2770eaee666932366bf4e1703533148914076", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-772d2d988483709a1c33da14", "type": "sha256", "value": "adc225a50d7a314341a7c857f092b962e3967d4addb7d2b48ff335c7bedad350", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-da542c8fb1418024ac36e724", "type": "sha256", "value": "b577d12d1f8eaacf060db96a7b2bcc0009d0c3fd8d4842bd85175a50b2a1f972", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7130ab373fdabb704a58cd2e", "type": "sha256", "value": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2b41952158d05172d5d5d773", "type": "sha256", "value": "ce3a22f1ccba5bbeebb0a9fd49c3e72fbde9e1816959b67e5b1fb248c1e1041a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-649927f34fb9787dad86eb3c", "type": "sha256", "value": "d7b2de7a314f64ab62777494d3f9587dd679d637fd8e68783b68977bbb3df29e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cb1d2139c306b1ebe0e3e17b", "type": "sha256", "value": "d7c9595737524bc5febd4507cbe47457dbd59ce733315f1ada59a91c6754c193", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b3189899e9b16fbccc24f145", "type": "sha256", "value": "d95a35fac8425ed6c010066a81b4330ade8dd325713e077d67fcfd33e7cafcac", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-80edf00724bb934b24f0df6c", "type": "sha256", "value": "de799971c904cfabc587484202b8d4bd4b40414ac6b23d1e51b16196bf100013", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-968dae5b323d3142b8b7f4b4", "type": "sha256", "value": "df5f5ce34c9cf3edd665586295e356d6b56d9ef3e54614001f4b178217ec92fe", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ae021e095ec69c6fc7aa1a1a", "type": "sha256", "value": "e32d0b53c63fe1a6b0759ebc8824b97661d369004213853438faaa34134967e6", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c1946ed796846985b738b150", "type": "sha256", "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3fdb374ab8b6ecdb20e04b3c", "type": "sha256", "value": "ec0a5627751851db7afed684f83dde6178c3e6b2114adc24a1294fb2bb1d40e8", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dc7f7f2c3cc7f6901993e10e", "type": "sha256", "value": "ed001f8b45a9191508e79be37b5a0003faaf3bc356eb241fe11f2b56ab9f60ae", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1ab215ceb3cf11de4f9a2a7f", "type": "sha256", "value": "f0c4a8877fe0d8ed1f7350d20d476d37601fb6c6119eb986fce4d8ae2852061c", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-736e65d2692d41acda941b16", "type": "sha256", "value": "f7b0061ce2ceec8a73a0957dc975d2dde0f4de8c0b63c041cd78a29414d2645c", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fa073d9c0ce8fb6569371e2d", "type": "sha256", "value": "fbf3439d0eb209ab2bdf6794da01485836e5bb0910c4624ac2d43dead3ff10d9", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-552a33b8f7a9a6d28c3a009c", "type": "domain", "value": "112.146.166.173.b.barracudacentral.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c9b315f1a07c5f90f9231500", "type": "domain", "value": "112.146.166.173.cbl.abuseat.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-033e87a0b6e3682fa816df28", "type": "domain", "value": "112.146.166.173.dnsbl-1.uceprotect.net", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-88dc64b86c9f853789305cc4", "type": "domain", "value": "112.146.166.173.spam.dnsbl.sorbs.net", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cfab0d812d6b7ed017159f9a", "type": "domain", "value": "112.146.166.173.zen.spamhaus.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5ab88b0192618d89a1a7f6a9", "type": "domain", "value": "api.bing.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1e65c65416804373bbda2b82", "type": "domain", "value": "dicarkadar.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a4fcf991cd88b6640e5f2785", "type": "domain", "value": "dns.msftncsi.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fe46453221fcc838826394aa", "type": "domain", "value": "isatap.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-27e886cdddc72b4a17e68f0a", "type": "domain", "value": "wpad.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-97e21e2b8e37edf9510a5e04", "type": "domain", "value": "wpad.stormtheory.info", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-46ebb9788f7adeed0b75f76d", "type": "domain", "value": "googleadapis.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2aebd2b43c6c317efa5ebaae", "type": "domain", "value": "gstaticadssl.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-967a4a2b1d3bf9c410bea3c5", "type": "domain", "value": "prod.squarespace.map.fastly.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f5e080f6ca048a178c54a862", "type": "domain", "value": "www-googletagmanager.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-72f93d5d58f456e9328aa6c5", "type": "ipv4", "value": "13.107.21.200", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-965f3d7b22b1aaac55e15d60", "type": "ipv4", "value": "13.107.5.80", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4555b48b0e93d4e1089077dd", "type": "ipv4", "value": "131.107.255.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef2c107b10edc7271a3b3586", "type": "ipv4", "value": "151.101.128.238", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c0eac9e32352500dc84ff5a7", "type": "ipv4", "value": "151.101.192.238", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6e3a5454404bd81f6744e3c3", "type": "ipv4", "value": "181.215.47.171", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ed81a714cbdde9f234a46d95", "type": "ipv4", "value": "216.239.34.21", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-54a5cb27a21a943e24e2ccd3", "type": "ipv4", "value": "216.239.36.21", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-33b33e296d4261b8060fa538", "type": "ipv4", "value": "216.239.38.21", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a035cb96b9ba098546424af", "type": "ipv4", "value": "23.218.156.10", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4b1e9edaf92aa129b16e4ac7", "type": "ipv4", "value": "23.223.195.33", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-512eb42e3e8dbc3ed82c3589", "type": "ipv4", "value": "67.26.187.254", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b30d57f8a81a6fcd6bfdfacf", "type": "ipv4", "value": "8.252.15.254", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-afb24c987db76f525ded2f87", "type": "ipv4", "value": "8.252.250.126", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0831296c9c4fbe988381749a", "type": "ipv4", "value": "8.253.203.254", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-94d626ba8a5a2d89fc0903db", "type": "ipv4", "value": "92.223.105.176", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1fadd1d0c842aa14150fafcf", "type": "ipv4", "value": "94.103.95.185", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-db1013cdbef509ee4266e470", "type": "ipv4", "value": "190.146.112.216", "priority": 100, "reasons": [ "existing-evidence-candidate", "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-b20ca00bbd92de471ea68adb", "type": "sha256", "value": "38c6c5b8d6fa71d9856758a5c0c2ac9d0a0a1450f75bb1004dd988e23d73a312", "priority": 100, "reasons": [ "existing-evidence-candidate", "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-280ea17d1444a818aab8c47f", "type": "sha256", "value": "3abae6dd2ddae23b2de2ccbcc160a4a5773bef8934d0e6896d50197c3d3c417f", "priority": 100, "reasons": [ "existing-evidence-candidate", "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-3269f326bdd038cdfa2e9421", "type": "sha256", "value": "4c957072ab097d3474039f432466cd251d1dc7d91559b76d4e5ead4a8bd499d5", "priority": 100, "reasons": [ "existing-evidence-candidate", "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-7e5e4969aa04010eaee019e3", "type": "sha256", "value": "8cf2cddda8522975a22da3da429339be471234eacc0e11c099d6dcb732cf3cbb", "priority": 100, "reasons": [ "existing-evidence-candidate", "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-fc2a01bc43e4811640783d76", "type": "sha256", "value": "63e2dc2b85defb87378e12ecd7d0f4631d37fcf42152acf2a28ae7453b40633c", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a07c5cd31310fda8829f8a07", "type": "sha256", "value": "d43159c8bf2e1bd866abdbb1687911e2282b1f98a7c063f85ffd53a7f51efed4", "priority": 95, "reasons": [ "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0d8e695ab072cfe7dcc72a77", "type": "sha256", "value": "f1b789be1126b557240dd0dfe98fc5f3ad6341bb1a5d8be0a954f65b486ad32a", "priority": 95, "reasons": [ "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9841ed77476bc3ffaa1fd325", "type": "domain", "value": "static.squarespace.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-477c941c36c1541ea82aee04", "type": "domain", "value": "static1.squarespace.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a9bd11f53acfa0814c11c929", "type": "ipv4", "value": "151.101.64.238", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-170b01c66f1a9e349c03023e", "type": "ipv4", "value": "209.141.55.226", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6684b889cd33370be446e822", "type": "ipv4", "value": "46.249.62.199", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-25485a8aa76cec11e08dbcf8", "type": "ipv4", "value": "85.143.218.7", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eaa97753aa0254526dca06e4", "type": "domain", "value": "www.rootscafeslc.com", "priority": 61, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8cc696a71919c005a1cbd1b9", "type": "domain", "value": "stormtheory.info", "priority": 60, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-578c64f12d70c1da1c45cab8", "type": "domain", "value": "sutton-win-pc.stormtheory.info", "priority": 60, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-59ca07ea1d2bb1e7a63315cb", "type": "ipv4", "value": "198.185.159.135", "priority": 60, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31ab1898522d7d3c52589b1a", "type": "domain", "value": "cranetisti.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bcbc956267c597bf53b6fdad", "type": "domain", "value": "crl.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e3faf4dc0228f563742dc0b4", "type": "domain", "value": "fonts.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bb89ee470e00769946f1a702", "type": "domain", "value": "fonts.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-606a7c320d51cf139ee55455", "type": "domain", "value": "iecvlist.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a2ef48f518d95db53489c9fa", "type": "domain", "value": "ipecho.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8ccf22fe83184534659d4ca0", "type": "domain", "value": "p.typekit.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b5d5a351649d461723ab370c", "type": "domain", "value": "rootscafeslc.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ba8cf8986a1d6f66b96f7c5e", "type": "domain", "value": "superhaps.pw", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-265dac48fe690c1f74a8a65e", "type": "domain", "value": "use.typekit.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d552fe92508b5d9f64198eb3", "type": "domain", "value": "www.bing.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-17d8c2f8ade680b12ad505b5", "type": "domain", "value": "www.co.utah.ut.us", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3fcb0ac9c3ed85076cd3545a", "type": "domain", "value": "www.download.windowsupdate.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b2384aeb152db2b10f2ac643", "type": "domain", "value": "www.googletagmanager.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2ad38cbf0ff8f61b2e6a365d", "type": "domain", "value": "www.msftncsi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ec8db8d5f7e2dbe9274dc2be", "type": "domain", "value": "ferguson-win-pc.stormtheory.info", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3617b48879e18c4b7bb80ddd", "type": "domain", "value": "stormtheory-dc.stormtheory.info", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fc42e550e0da4b24c149e154", "type": "ipv4", "value": "151.101.0.238", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ec4096f0b104f8e5d0b3391a", "type": "ipv4", "value": "161.119.42.22", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15ff862b800c0d39d1b700fc", "type": "ipv4", "value": "172.217.1.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74d9217689ef7b84c3039cc4", "type": "ipv4", "value": "172.217.2.10", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fb353827abc42e775c29e637", "type": "ipv4", "value": "172.217.2.3", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cb55a28a3892556f716734f3", "type": "ipv4", "value": "185.246.116.239", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-40ec586e098e0a020e3adfcb", "type": "ipv4", "value": "195.123.246.99", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d834e098bb2a986ace1f42f7", "type": "ipv4", "value": "198.185.159.136", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-144b1028560c7a04c96dc444", "type": "ipv4", "value": "204.79.197.200", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b2925bf1f32b2e52d2ea1ae1", "type": "ipv4", "value": "213.226.68.112", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f7bd398c4b34d04a8d8294dd", "type": "ipv4", "value": "216.239.32.21", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e2b4867c1c13ccbe22856007", "type": "ipv4", "value": "23.218.156.17", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2a1cfdd7864de2960d62d226", "type": "ipv4", "value": "23.223.195.42", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0a40093d25eeafd62d8aa4fa", "type": "ipv4", "value": "23.63.25.226", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-506125efb62da8b3e2661904", "type": "ipv4", "value": "72.21.81.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6f6acdb0395da1c4f28c9d34", "type": "ipv4", "value": "72.21.81.240", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b5b72c3e2dc64df2121cb66d", "type": "ipv4", "value": "8.253.129.66", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f9b8591529ee2e2b16c6d3f0", "type": "ipv4", "value": "87.236.22.142", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 130, "next_batch": [ "observable-4fcc2ba9609091979e1d64ab", "observable-ff7f6c8a102e82f6d0b85ae5", "observable-98b2a62ec437856e716017b5", "observable-1bb8b8543606b4e692ca3b8e", "observable-71add15f2538ccd5ef9de531", "observable-ce74f34c8bbf4a023011258e", "observable-464a66892443e3879ed5011c", "observable-39f209a6bba2310f670a2f55", "observable-c883ceb6c60bac3290b24648", "observable-759cc4bbb8f93091e01ee60b" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "0919fcacb5737cd492749816126b2a15db764aa09bb07d11915882c72bf90ae1" }, "enrichment": { "items": [ { "type": "ipv4", "value": "87.236.22.142", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:25.063869+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:25.059517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:25.054995+00:00", "observable_id": "observable-f9b8591529ee2e2b16c6d3f0" }, { "type": "ipv4", "value": "8.253.129.66", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.878011+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.874065+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:24.869273+00:00", "observable_id": "observable-b5b72c3e2dc64df2121cb66d" }, { "type": "ipv4", "value": "72.21.81.240", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.689881+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.686536+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:24.676598+00:00", "observable_id": "observable-6f6acdb0395da1c4f28c9d34" }, { "type": "ipv4", "value": "72.21.81.200", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:35.712902+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.486132+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:24.480153+00:00", "observable_id": "observable-506125efb62da8b3e2661904" }, { "type": "ipv4", "value": "23.63.25.226", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.293075+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.288238+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:24.282276+00:00", "observable_id": "observable-0a40093d25eeafd62d8aa4fa" }, { "type": "ipv4", "value": "23.223.195.42", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.075998+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:24.070436+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:24.065452+00:00", "observable_id": "observable-2a1cfdd7864de2960d62d226" }, { "type": "ipv4", "value": "23.218.156.17", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.874293+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.869994+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:23.865284+00:00", "observable_id": "observable-e2b4867c1c13ccbe22856007" }, { "type": "ipv4", "value": "216.239.32.21", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.683350+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.681090+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:23.678696+00:00", "observable_id": "observable-f7bd398c4b34d04a8d8294dd" }, { "type": "ipv4", "value": "213.226.68.112", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.504134+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.501589+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:23.498930+00:00", "observable_id": "observable-b2925bf1f32b2e52d2ea1ae1" }, { "type": "ipv4", "value": "204.79.197.200", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:30.957464+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.496275+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:23.494017+00:00", "observable_id": "observable-144b1028560c7a04c96dc444" }, { "type": "ipv4", "value": "198.185.159.136", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.304777+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.301388+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:23.297393+00:00", "observable_id": "observable-d834e098bb2a986ace1f42f7" }, { "type": "ipv4", "value": "195.123.246.99", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.126548+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:23.124487+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:23.122161+00:00", "observable_id": "observable-40ec586e098e0a020e3adfcb" }, { "type": "ipv4", "value": "185.246.116.239", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.932613+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.930697+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:22.927873+00:00", "observable_id": "observable-cb55a28a3892556f716734f3" }, { "type": "ipv4", "value": "172.217.2.3", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.620221+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.618315+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:22.615754+00:00", "observable_id": "observable-fb353827abc42e775c29e637" }, { "type": "ipv4", "value": "172.217.2.10", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.435873+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.433673+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:22.430856+00:00", "observable_id": "observable-74d9217689ef7b84c3039cc4" }, { "type": "ipv4", "value": "172.217.1.200", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.245979+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.242792+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:22.239321+00:00", "observable_id": "observable-15ff862b800c0d39d1b700fc" }, { "type": "ipv4", "value": "161.119.42.22", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.057486+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.053269+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:22.048229+00:00", "observable_id": "observable-ec4096f0b104f8e5d0b3391a" }, { "type": "ipv4", "value": "151.101.0.238", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:48.263653+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:22.043988+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:22.039441+00:00", "observable_id": "observable-fc42e550e0da4b24c149e154" }, { "type": "domain", "value": "stormtheory-dc.stormtheory.info", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.884295+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.880129+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:21.875458+00:00", "observable_id": "observable-3617b48879e18c4b7bb80ddd" }, { "type": "domain", "value": "ferguson-win-pc.stormtheory.info", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.714054+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.712513+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:21.710901+00:00", "observable_id": "observable-ec8db8d5f7e2dbe9274dc2be" }, { "type": "domain", "value": "www.msftncsi.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.709134+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:21.706519+00:00", "observable_id": "observable-2ad38cbf0ff8f61b2e6a365d" }, { "type": "domain", "value": "www.googletagmanager.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:38.593969+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.703346+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:21.700744+00:00", "observable_id": "observable-b2384aeb152db2b10f2ac643" }, { "type": "domain", "value": "www.download.windowsupdate.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:30.124643+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.697553+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:21.693783+00:00", "observable_id": "observable-3fcb0ac9c3ed85076cd3545a" }, { "type": "domain", "value": "www.co.utah.ut.us", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.369016+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.367211+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:21.365438+00:00", "observable_id": "observable-17d8c2f8ade680b12ad505b5" }, { "type": "domain", "value": "www.bing.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:28.166581+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.363526+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:21.360024+00:00", "observable_id": "observable-d552fe92508b5d9f64198eb3" }, { "type": "domain", "value": "use.typekit.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:45.087539+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.355444+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:21.350497+00:00", "observable_id": "observable-265dac48fe690c1f74a8a65e" }, { "type": "domain", "value": "superhaps.pw", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.193630+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.191472+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:21.189465+00:00", "observable_id": "observable-ba8cf8986a1d6f66b96f7c5e" }, { "type": "domain", "value": "rootscafeslc.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.038658+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.036357+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:21.034182+00:00", "observable_id": "observable-b5d5a351649d461723ab370c" }, { "type": "domain", "value": "p.typekit.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:44.093662+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:21.031731+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:21.028907+00:00", "observable_id": "observable-8ccf22fe83184534659d4ca0" }, { "type": "domain", "value": "ipecho.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.872730+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.870249+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:20.867763+00:00", "observable_id": "observable-a2ef48f518d95db53489c9fa" }, { "type": "domain", "value": "iecvlist.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:00.584505+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.865497+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:20.863020+00:00", "observable_id": "observable-606a7c320d51cf139ee55455" }, { "type": "domain", "value": "fonts.gstatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:19.985832+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.860900+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:20.858929+00:00", "observable_id": "observable-bb89ee470e00769946f1a702" }, { "type": "domain", "value": "fonts.googleapis.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:19.818148+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.856841+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:20.853839+00:00", "observable_id": "observable-e3faf4dc0228f563742dc0b4" }, { "type": "domain", "value": "crl.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:47:12.176626+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.713407+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:20.711416+00:00", "observable_id": "observable-bcbc956267c597bf53b6fdad" }, { "type": "domain", "value": "cranetisti.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.549793+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.547810+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:20.545245+00:00", "observable_id": "observable-31ab1898522d7d3c52589b1a" }, { "type": "ipv4", "value": "198.185.159.135", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.349280+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.347438+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:20.344946+00:00", "observable_id": "observable-59ca07ea1d2bb1e7a63315cb" }, { "type": "domain", "value": "sutton-win-pc.stormtheory.info", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.189415+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.187147+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:20.184910+00:00", "observable_id": "observable-578c64f12d70c1da1c45cab8" }, { "type": "domain", "value": "stormtheory.info", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.034930+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:20.032927+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:20.030694+00:00", "observable_id": "observable-8cc696a71919c005a1cbd1b9" }, { "type": "domain", "value": "www.rootscafeslc.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.869321+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.863855+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:19.858369+00:00", "observable_id": "observable-eaa97753aa0254526dca06e4" }, { "type": "ipv4", "value": "85.143.218.7", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.682532+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.680774+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:19.678529+00:00", "observable_id": "observable-25485a8aa76cec11e08dbcf8" }, { "type": "ipv4", "value": "46.249.62.199", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.464445+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.457648+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:19.452692+00:00", "observable_id": "observable-6684b889cd33370be446e822" }, { "type": "ipv4", "value": "209.141.55.226", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.268932+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.264950+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:19.260361+00:00", "observable_id": "observable-170b01c66f1a9e349c03023e" }, { "type": "ipv4", "value": "151.101.64.238", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.066489+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:19.062619+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:19.057755+00:00", "observable_id": "observable-a9bd11f53acfa0814c11c929" }, { "type": "domain", "value": "static1.squarespace.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:18.861159+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:44.719891+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:18.853082+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:18.848598+00:00", "observable_id": "observable-477c941c36c1541ea82aee04" }, { "type": "domain", "value": "static.squarespace.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:18.848539+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:18.683817+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:18.681975+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:18.679595+00:00", "observable_id": "observable-9841ed77476bc3ffaa1fd325" }, { "type": "sha256", "value": "f1b789be1126b557240dd0dfe98fc5f3ad6341bb1a5d8be0a954f65b486ad32a", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:18.342103+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:18.123193+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:18.118340+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:18.113206+00:00", "observable_id": "observable-0d8e695ab072cfe7dcc72a77" }, { "type": "sha256", "value": "d43159c8bf2e1bd866abdbb1687911e2282b1f98a7c063f85ffd53a7f51efed4", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:17.773715+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:17.584224+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:17.582387+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:17.580057+00:00", "observable_id": "observable-a07c5cd31310fda8829f8a07" }, { "type": "sha256", "value": "8cf2cddda8522975a22da3da429339be471234eacc0e11c099d6dcb732cf3cbb", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:17.242801+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:17.031444+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:17.029641+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:17.024542+00:00", "observable_id": "observable-7e5e4969aa04010eaee019e3" }, { "type": "sha256", "value": "63e2dc2b85defb87378e12ecd7d0f4631d37fcf42152acf2a28ae7453b40633c", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:16.791045+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:16.586274+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:16.584448+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:16.581574+00:00", "observable_id": "observable-fc2a01bc43e4811640783d76" }, { "type": "sha256", "value": "4c957072ab097d3474039f432466cd251d1dc7d91559b76d4e5ead4a8bd499d5", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:16.230788+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:16.006256+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:16.001945+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:15.997485+00:00", "observable_id": "observable-3269f326bdd038cdfa2e9421" }, { "type": "sha256", "value": "3abae6dd2ddae23b2de2ccbcc160a4a5773bef8934d0e6896d50197c3d3c417f", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:15.787778+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:15.585895+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:15.582091+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:15.577670+00:00", "observable_id": "observable-280ea17d1444a818aab8c47f" }, { "type": "sha256", "value": "38c6c5b8d6fa71d9856758a5c0c2ac9d0a0a1450f75bb1004dd988e23d73a312", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:15.215066+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:15.007191+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:15.004527+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:15.002090+00:00", "observable_id": "observable-b20ca00bbd92de471ea68adb" }, { "type": "ipv4", "value": "190.146.112.216", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:15.002056+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:14.827573+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:14.825386+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:14.821769+00:00", "observable_id": "observable-db1013cdbef509ee4266e470" } ], "coverage": { "cache_hits": 0, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-6f6acdb0395da1c4f28c9d34" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-6f6acdb0395da1c4f28c9d34" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-b5b72c3e2dc64df2121cb66d" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-b5b72c3e2dc64df2121cb66d" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-f9b8591529ee2e2b16c6d3f0" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-f9b8591529ee2e2b16c6d3f0" } ], "batch_targets": 3, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 53, "full_urls_disclosed": 0, "provider_lookups_started": 3 }, "updated_at": "2026-09-22T17:47:25.257060+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "0483ac6b73b8be5445b0c28bde259a6a0d09449f37e5eb36b0f4bdc7db7c5d94", "source_semantic_sha256": "6a25f7bd75a7b1f270d5c53f627231d7b0295bb014e382846fcd0e77a59bd0c8", "previous_snapshot_sha256": "946debf79750a78306daab3dbcf9e35e40da937389bfea3b011cc80d056b9f96" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "tactic": "command-and-control", "confidence": 0.8, "evidence": "T1105 Ingress Tool Transfer", "review_status": "suggested", "evidence_start": 10832, "evidence_end": 10859, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null } ], "apt_matches": [ { "group_attack_id": "G0123", "group_name": "Volatile Cedar", "similarity": 0.2, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0044", "group_name": "Winnti Group", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0130", "group_name": "Ajax Security Team", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0136", "group_name": "IndigoZebra", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0133", "group_name": "Nomadic Octopus", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G1013", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0107", "group_name": "Whitefly", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0066", "group_name": "Elderwood", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0075", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0120", "group_name": "Evilnum", "similarity": 0.0909, "shared_count": 1, "shared_techniques": [ "T1105" ] } ], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }