{ "analysis_id": "0bb7a995-231c-4046-95ec-acea419eb7b4", "session_id": "49367ac9-524c-4897-9fde-8da02d97f4cf", "status": "completed", "filename": "2019-04-15-traffic-analysis-exercise.pcap", "source_sha256": "2d27b8be5a880af7cfd5a51bd9a184e546344afe42261c323b41e34b961a288c", "source_size_bytes": 7329433, "schema_version": "pcap-analysis-v1", "semantic_sha256": "f31b5bca14bdab1bc44c0c02da4c728a1500276ab131a5fd81499a0d1ec8bc93", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 10807 packets across 28 IP endpoints and 348 transport flows. Observed 142 DNS events, 13 HTTP requests, 116 TLS ClientHello events, and 14 recovered file/message object(s). Deterministic rules produced 7 finding(s): 0 high, 3 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2019-04-15-traffic-analysis-exercise.pcap\nCapture SHA-256: `2d27b8be5a880af7cfd5a51bd9a184e546344afe42261c323b41e34b961a288c`\nSemantic result SHA-256: `f31b5bca14bdab1bc44c0c02da4c728a1500276ab131a5fd81499a0d1ec8bc93`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 10807 packets across 28 IP endpoints and 348 transport flows. Observed 142 DNS events, 13 HTTP requests, 116 TLS ClientHello events, and 14 recovered file/message object(s). Deterministic rules produced 7 finding(s): 0 high, 3 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 10807\n- Duration: 21854.441361 seconds\n- Captured bytes: 7156497\n- Endpoints: 28\n- Flows: 348\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 1931 / TCP stream 59, frame 1933 / TCP stream 59, frame 1994 / TCP stream 63, frame 1996 / TCP stream 63.\n\nMetrics: `{\"content_type\":\"\",\"declared_body_bytes\":1182,\"destination\":\"10.0.90.175\",\"response_count\":2,\"source\":\"151.106.27.208\",\"uri\":\"/client.rar\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4880 / TCP stream 196, frame 4882 / TCP stream 196.\n\nMetrics: `{\"content_type\":\"application/rar\",\"declared_body_bytes\":581,\"destination\":\"10.0.90.175\",\"response_count\":1,\"source\":\"89.163.144.224\",\"uri\":\"/klansfuuerifneiferunfasd/modules/client.rar\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4961 / TCP stream 200, frame 5365 / TCP stream 200.\n\nMetrics: `{\"content_type\":\"application/x-rar-compressed\",\"declared_body_bytes\":425549,\"destination\":\"10.0.90.175\",\"response_count\":1,\"source\":\"162.213.250.131\",\"uri\":\"/azor.rar\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 2785 / TCP stream 101, frame 2787 / TCP stream 101, frame 2789 / TCP stream 101, frame 2961 / TCP stream 109, frame 2963 / TCP stream 109.\n\nMetrics: `{\"destination\":\"10.0.90.9\",\"event_count\":21,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.90.175\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 37 / TCP stream 2, frame 72 / TCP stream 2, frame 75 / TCP stream 2, frame 77 / TCP stream 2, frame 149 / TCP stream 2.\n\nMetrics: `{\"destination\":\"10.0.90.9\",\"event_count\":97,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.0.90.175\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 2786 / TCP stream 101, frame 2788 / TCP stream 101, frame 2790 / TCP stream 101, frame 2962 / TCP stream 109, frame 2964 / TCP stream 109.\n\nMetrics: `{\"destination\":\"10.0.90.175\",\"event_count\":21,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.90.9\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 39 / TCP stream 2, frame 74 / TCP stream 2, frame 76 / TCP stream 2, frame 78 / TCP stream 2, frame 151 / TCP stream 2.\n\nMetrics: `{\"destination\":\"10.0.90.175\",\"event_count\":76,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.0.90.9\"}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `kim.jooyoung`; client IPs: 10.0.90.175; frames: 411, 419, 421, 433, 447\n- account: `seoul-4a67-pc$`; client IPs: 10.0.90.175; frames: 44, 52, 54, 66, 93\n- hostname: `Seoul-4a67-PC`; client IPs: 10.0.90.175; frames: 237, 1828, 3325, 5372, 1\n- netbios-group: `STINGRAYAHOY`; client IPs: unbound subject; frames: 2, 224, 228, 232, 3328\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `222.222.67.208.in-addr.arpa`; roles: dns-query\n- domain: `adsfinder.xyz`; roles: dns-query, tls-sni\n- domain: `api.bing.com`; roles: dns-query\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `iecvlist.microsoft.com`; roles: dns-query, tls-sni\n- domain: `isatap.localdomain`; roles: dns-query\n- domain: `isatap.stingrayahoy.com`; roles: dns-query\n- domain: `ksoniay95ee.info`; roles: dns-query, http-host\n- domain: `ljeffery54ae.top`; roles: dns-query, http-host\n- domain: `myip.opendns.com`; roles: dns-query\n- domain: `myip.opendns.com.stingrayahoy.com`; roles: dns-query\n- domain: `parolinos.xyz`; roles: dns-query, tls-sni\n- domain: `pompeiiii.org`; roles: dns-query\n- domain: `qqtube.club`; roles: dns-query, tls-sni\n- domain: `resolver1.opendns.com`; roles: dns-query\n- domain: `seoul-4a67-pc.stingrayahoy.com`; roles: dns-query\n- domain: `stingrayahoy-dc.stingrayahoy.com`; roles: dns-query\n- domain: `stingrayahoy.com`; roles: dns-query\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `wpad.stingrayahoy.com`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query\n- domain: `www.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- domain: `zindv.club`; roles: dns-query, tls-sni\n- ipv4: `10.0.90.175`; roles: dns-answer, network-endpoint\n- ipv4: `10.0.90.255`; roles: network-endpoint\n- ipv4: `10.0.90.9`; roles: dns-answer, network-endpoint\n- ipv4: `104.73.85.137`; roles: dns-answer, network-endpoint\n- ipv4: `109.230.199.24`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer\n- ipv4: `13.107.5.80`; roles: dns-answer\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `151.106.27.208`; roles: http-host, network-endpoint\n- ipv4: `162.213.250.131`; roles: http-host, network-endpoint\n- ipv4: `173.166.146.112`; roles: dns-answer\n- ipv4: `176.10.125.110`; roles: dns-answer, network-endpoint\n- ipv4: `185.136.169.160`; roles: network-endpoint\n- ipv4: `185.139.69.88`; roles: dns-answer, network-endpoint\n- ipv4: `185.158.249.39`; roles: dns-answer, network-endpoint\n- ipv4: `185.212.47.167`; roles: network-endpoint\n- ipv4: `187.188.166.192`; roles: network-endpoint\n- ipv4: `198.54.115.33`; roles: network-endpoint\n- ipv4: `198.54.125.57`; roles: network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer\n- ipv4: `208.67.222.222`; roles: dns-answer, network-endpoint\n- ipv4: `208.91.197.91`; roles: dns-answer, network-endpoint\n- ipv4: `216.98.148.157`; roles: network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.218.156.11`; roles: dns-answer, network-endpoint\n- ipv4: `23.218.156.26`; roles: dns-answer\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `37.230.112.226`; roles: dns-answer, network-endpoint\n- ipv4: `68.65.122.52`; roles: network-endpoint\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `85.114.134.49`; roles: http-host, network-endpoint\n- ipv4: `89.163.144.224`; roles: http-host, network-endpoint\n- ipv4: `91.240.87.19`; roles: dns-answer, network-endpoint\n- ipv6: `fd3e:4f5a:5b81::1`; roles: dns-answer\n- ja3: `4d7a28d6f2263ed61de88ca66eb011e3`; roles: tls-client-fingerprint\n- ja3: `74927e242d6c3febf8cb9cab10a7f889`; roles: tls-client-fingerprint\n- sha256: `2c60e1e69aeca03fb562c0597bd404df118151e6782d7cfefcbcefb5a1505d21`; roles: exported-object\n- sha256: `4017ffd0c17a9fbaebd74c6b75b6e8898d53ce401f16a64881bd0ee5837f6591`; roles: exported-object\n- sha256: `4c9c4d831d61c8c38b2513f9b431ef4f4cf6af9fb18a2317cd2178d6e0997822`; roles: exported-object\n- sha256: `50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2`; roles: exported-object\n- sha256: `565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3`; roles: exported-object\n- sha256: `5f1ea837b7530af44e85e0198beab49e0f2cf9e60a75d76c044313985de822ff`; roles: exported-object\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- sha256: `637ccbba391788d61f87d86caf06bdd4c6c03c43aa9386c42bdf2543a072619c`; roles: exported-object\n- sha256: `6aed702963283420db151840cb48374f6c48b4f9dc933f7a6c9fdb1d77ce88e1`; roles: exported-object\n- sha256: `6d48f7ed8bafb7e147b7438a21362220adcc24e83a4f9942f6ccf9c09b3b4b02`; roles: exported-object\n- sha256: `91cba2f5400a35c849783d307e016002144c96c9ee817b7a375e225c57b1ff80`; roles: exported-object\n- sha256: `aa2f524d89ce598b990d3c8cd74cdc31cfaa9a7c6a63596b0e5b394dc7ede10b`; roles: exported-object\n- sha256: `e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a`; roles: exported-object\n- sha256: `f07dbc57bb41792248061012e6479b00ba046d6631e1734bdbbd01bc421ecba4`; roles: exported-object\n- url: `http://151.106.27.208/client.rar`; roles: http-request\n- url: `http://162.213.250.131/azor.rar`; roles: http-request\n- url: `http://85.114.134.49/index.php`; roles: http-request\n- url: `http://89.163.144.224/klansfuuerifneiferunfasd/modules/client.rar`; roles: http-request\n- url: `http://ksoniay95ee.info/favicon.ico`; roles: http-request\n- url: `http://ksoniay95ee.info/images/CI9BVzd6AqB/ZNUmRFBAKmX4q_/2FIAs9nQJlVF7_2BTvRU5/ZPqTgOgLDp8JzrCL/_2Fcm_2BF41yLbk/eclytPd8CmogXhag5f/iJKuzzkmf/M1zwJZUnnnK6LJcptL1S/m6Hl99BQ3fNUdtPt9So/0Zzs4gdqrhrs/_2FJr.avi`; roles: http-request\n- url: `http://ksoniay95ee.info/images/k1bBds2o/QmLUr43VFSfi6mVN0k_2Fri/aRq5qJ_2Bb/9pn_2FrlWUAEwA3DA/8_2BlKV4KDN_/2B_2BLZHLEa/vLvK_2F5G0A625/hGoDuTo8Bf7h2KRBD9vOP/gcTRbqx7bC5Q89C6/6YYly9yOp3zpx2r/BwphZTlcwHbBf1/hYP.avi`; roles: http-request\n- url: `http://ksoniay95ee.info/images/zqt4lIX7/WURokuO9vh89Yy_2BsUJrS9/PjffqPwJdE/ySWjXv6UbPaKFMooy/6X5boj6wckcc/Ucw3dM3Mi_2/FznVDXGp2L3Py2/JxFQvMX4xN_2FzOJs9Vmk/BMKiWvw71S3sGLtJ/XPIlWh5f6mD5BYu/asfVMoi7/c.avi`; roles: http-request\n- url: `http://ljeffery54ae.top/skoex/po2.php?l=cupk6.fgs`; roles: http-request\n- url: `http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/6.1`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko`; roles: http-client\n- exported object `po2.php%3fl=cupk6.fgs`; SHA-256 `50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2`; size 328192 bytes\n SHA-1: `890292f25372e6e896a9f600685e7a61854e95bf`; MD5: `3abe239c43ad55054578884f6a796ba5`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.175\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":668,\"response_frame\":997,\"server_ip\":\"91.240.87.19\",\"status_code\":\"200\",\"tcp_stream\":45,\"url\":\"http://ljeffery54ae.top/skoex/po2.php?l=cupk6.fgs\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `index(1).php`; SHA-256 `2c60e1e69aeca03fb562c0597bd404df118151e6782d7cfefcbcefb5a1505d21`; size 4473518 bytes\n SHA-1: `47e1584216c5484011607e01a3aafa33dedaf4dd`; MD5: `3d5f9ae33c8af83ed784ac5834a3e420`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.90.175\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5380,\"response_frame\":9793,\"server_ip\":\"85.114.134.49\",\"status_code\":\"200\",\"tcp_stream\":201,\"url\":\"http://85.114.134.49/index.php\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `azor.rar`; SHA-256 `aa2f524d89ce598b990d3c8cd74cdc31cfaa9a7c6a63596b0e5b394dc7ede10b`; size 425549 bytes\n SHA-1: `73135a017a6e5a1db8e5d1a4b277b8c9437558e0`; MD5: `b7a3e32bcf7e805220b86c4d7df9ccbd`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.175\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4961,\"response_frame\":5365,\"server_ip\":\"162.213.250.131\",\"status_code\":\"200\",\"tcp_stream\":200,\"url\":\"http://162.213.250.131/azor.rar\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `c.avi`; SHA-256 `6aed702963283420db151840cb48374f6c48b4f9dc933f7a6c9fdb1d77ce88e1`; size 274540 bytes\n SHA-1: `962afbf6a2aab43ca4cbcebf9a24ab89b4676d61`; MD5: `822827d7e6c48a851becb04476e73569`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.90.175\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1329,\"response_frame\":1666,\"server_ip\":\"37.230.112.226\",\"status_code\":\"200\",\"tcp_stream\":49,\"url\":\"http://ksoniay95ee.info/images/zqt4lIX7/WURokuO9vh89Yy_2BsUJrS9/PjffqPwJdE/ySWjXv6UbPaKFMooy/6X5boj6wckcc/Ucw3dM3Mi_2/FznVDXGp2L3Py2/JxFQvMX4xN_2FzOJs9Vmk/BMKiWvw71S3sGLtJ/XPIlWh5f6mD5BYu/asfVMoi7/c.avi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `_2FJr.avi`; SHA-256 `637ccbba391788d61f87d86caf06bdd4c6c03c43aa9386c42bdf2543a072619c`; size 218556 bytes\n SHA-1: `c33b76ddbad8193f77e7dff82764efed920cbe7c`; MD5: `0dba75ce98d0f926b510400a7cc7ddac`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.90.175\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1032,\"response_frame\":1311,\"server_ip\":\"37.230.112.226\",\"status_code\":\"200\",\"tcp_stream\":46,\"url\":\"http://ksoniay95ee.info/images/CI9BVzd6AqB/ZNUmRFBAKmX4q_/2FIAs9nQJlVF7_2BTvRU5/ZPqTgOgLDp8JzrCL/_2Fcm_2BF41yLbk/eclytPd8CmogXhag5f/iJKuzzkmf/M1zwJZUnnnK6LJcptL1S/m6Hl99BQ3fNUdtPt9So/0Zzs4gdqrhrs/_2FJr.avi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":218556,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `authrootstl.cab`; SHA-256 `4c9c4d831d61c8c38b2513f9b431ef4f4cf6af9fb18a2317cd2178d6e0997822`; size 56952 bytes\n SHA-1: `cf925fc512b936fe7d44ceb6e999e4a020ed6ff0`; MD5: `04d79a0dc77a8f449cbff6252862d398`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.175\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1848,\"response_frame\":1906,\"server_ip\":\"104.73.85.137\",\"status_code\":\"200\",\"tcp_stream\":57,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":56952,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `index(2).php`; SHA-256 `4017ffd0c17a9fbaebd74c6b75b6e8898d53ce401f16a64881bd0ee5837f6591`; size 6962 bytes\n SHA-1: `e09450ecfa1eac3ba598feb22cb04cfa938fde4a`; MD5: `0b3123b2497523a10d60e7eed8c1a88f`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `favicon.ico`; SHA-256 `e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a`; size 5430 bytes\n SHA-1: `0bcbe73d6a198f6e5ebafa035b734a12809cefa6`; MD5: `f74755b4757448d71fdcb4650a701816`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.175\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1314,\"response_frame\":1320,\"server_ip\":\"37.230.112.226\",\"status_code\":\"200\",\"tcp_stream\":46,\"url\":\"http://ksoniay95ee.info/favicon.ico\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5430,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `hYP.avi`; SHA-256 `91cba2f5400a35c849783d307e016002144c96c9ee817b7a375e225c57b1ff80`; size 2396 bytes\n SHA-1: `db25053f419c688b0b022501a93e546a9f1bd876`; MD5: `f7b705c04efd3ed44edd51759b9b72b0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.175\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1669,\"response_frame\":1674,\"server_ip\":\"37.230.112.226\",\"status_code\":\"200\",\"tcp_stream\":46,\"url\":\"http://ksoniay95ee.info/images/k1bBds2o/QmLUr43VFSfi6mVN0k_2Fri/aRq5qJ_2Bb/9pn_2FrlWUAEwA3DA/8_2BlKV4KDN_/2B_2BLZHLEa/vLvK_2F5G0A625/hGoDuTo8Bf7h2KRBD9vOP/gcTRbqx7bC5Q89C6/6YYly9yOp3zpx2r/BwphZTlcwHbBf1/hYP.avi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2396,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `client(1).rar`; SHA-256 `5f1ea837b7530af44e85e0198beab49e0f2cf9e60a75d76c044313985de822ff`; size 591 bytes\n SHA-1: `103f8194dd1b0084455ae49abbe60e344b3582bb`; MD5: `19bd86fcf50b4fa2be877dbd494cf5a8`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.175\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1931,\"response_frame\":1933,\"server_ip\":\"151.106.27.208\",\"status_code\":\"200\",\"tcp_stream\":59,\"url\":\"http://151.106.27.208/client.rar\"},{\"client_ip\":\"10.0.90.175\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1994,\"response_frame\":1996,\"server_ip\":\"151.106.27.208\",\"status_code\":\"200\",\"tcp_stream\":63,\"url\":\"http://151.106.27.208/client.rar\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":591,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `client(2).rar`; SHA-256 `6d48f7ed8bafb7e147b7438a21362220adcc24e83a4f9942f6ccf9c09b3b4b02`; size 581 bytes\n SHA-1: `3d00bdb8061856bdd99141427f22ab09e1f61bb6`; MD5: `2bde371506e2548b06a95a3dbd6b2be1`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.175\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4880,\"response_frame\":4882,\"server_ip\":\"89.163.144.224\",\"status_code\":\"200\",\"tcp_stream\":196,\"url\":\"http://89.163.144.224/klansfuuerifneiferunfasd/modules/client.rar\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":581,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `index.php`; SHA-256 `f07dbc57bb41792248061012e6479b00ba046d6631e1734bdbbd01bc421ecba4`; size 107 bytes\n SHA-1: `a5cb8b1f01ba1a6e996a786308af1d19b233f0ce`; MD5: `a23dae90dd11ca638414ceddc8565e20`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `ncsi.txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n SHA-1: `33bf88d5b82df3723d5863c7d23445e345828904`; MD5: `cd5a4d3fdd5bffc16bf959ef75cf37bc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.175\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":402,\"response_frame\":404,\"server_ip\":\"23.218.156.11\",\"status_code\":\"200\",\"tcp_stream\":28,\"url\":\"http://www.msftncsi.com/ncsi.txt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `index(3).php`; SHA-256 `565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3`; size 2 bytes\n SHA-1: `9ce3bd4224c8c1780db56b4125ecf3f24bf748b7`; MD5: `e0aa021e21dddbd6d8cecec71e9cf564`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.175\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9830,\"response_frame\":9834,\"server_ip\":\"85.114.134.49\",\"status_code\":\"200\",\"tcp_stream\":201,\"url\":\"http://85.114.134.49/index.php\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `3b677f25614218ea03df7893b8d36aceb874c1019ad8455a970414edb2faf68c`; recorded 2026-09-22T16:08:27.698915+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":91,\"observable_limit\":5000,\"observables_checked\":91,\"observables_total\":91,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `d4027bcf-0ef6-4e3c-a68a-68dfe35adb33` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `8879e360-655c-4073-beb9-68018699a4d4` shares 16 observations. This does not establish a common campaign.\n- Prior analysis `961bdc9a-7460-440f-a246-f55748149bcc` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `1c2e6d58-c62a-4009-939b-3aa82de281a2` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `76f521c2-4e4a-41d5-95ad-a44fd9887dd8` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `fa0da8be-03fb-404d-a526-6c99c6b4f000` shares 17 observations. This does not establish a common campaign.\n- Prior analysis `05851801-c224-489b-b9da-9e5d035c60b4` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `31f265dc-3055-4628-8df4-136d4058e842` shares 1 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `8174eaa7-e189-467f-b05e-fb7397bfcf16` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `e37603cf-d241-45ee-95ec-bcf92a063147` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `7c54479c-cce3-4570-80c9-69d03571a645` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `21da2cda-3a07-4c03-b352-af8740c84bc0` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `eb5ccbc6-145e-4422-8b9a-f42ae48aad5c` shares 1 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":14,\"export_status\":\"completed\",\"exported_objects\":15,\"hashed_bytes\":5793981,\"hashed_objects\":15,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":14,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":14}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 7/7, identities 4/4, observables 91/91, artifacts 14/14. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n84 typed observations; 1 evidence-backed IOC candidates for review, including 1 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `ad14ae51c3f66cbc89ab3442f705b93256a6f178a0dec940d3b8c682f9e63b15`.\n\n- sha256 `50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2` — provider-reported-malicious; evidence: `[]`; provider signals: `[{\"actors\":[],\"basis\":\"Exact typed artifact match in malwarebazaar\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{\"records\":[{\"first_seen\":\"2022-04-20 16:52:23\",\"last_seen\":null,\"md5_hash\":\"3abe239c43ad55054578884f6a796ba5\",\"sha1_hash\":\"890292f25372e6e896a9f600685e7a61854e95bf\",\"sha256_hash\":\"50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2\",\"signature\":\"Gozi\"}]},\"queried_at\":\"2026-09-22T17:47:04.432229+00:00\",\"relationship_context\":[{\"evidence\":\"malwarebazaar field sha256_hash\",\"evidence_source\":\"malwarebazaar\",\"source\":\"50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2\",\"target\":\"50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2\",\"target_type\":\"hash\",\"tier\":1},{\"evidence\":\"malwarebazaar field sha1_hash\",\"evidence_source\":\"malwarebazaar\",\"source\":\"50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2\",\"target\":\"890292f25372e6e896a9f600685e7a61854e95bf\",\"target_type\":\"hash\",\"tier\":1},{\"evidence\":\"malwarebazaar field md5_hash\",\"evidence_source\":\"malwarebazaar\",\"source\":\"50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2\",\"target\":\"3abe239c43ad55054578884f6a796ba5\",\"target_type\":\"hash\",\"tier\":1},{\"evidence\":\"malwarebazaar field file_name\",\"evidence_source\":\"malwarebazaar\",\"source\":\"50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2\",\"target\":\"ra3.php%3fq=cupf7.svg\",\"target_type\":\"file\",\"tier\":1}],\"source\":\"malwarebazaar\",\"status\":\"ok\",\"technique_ids\":[],\"verdict\":\"provider-reported-malicious\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:04.229971+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:47:04.226175+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `6dd4ab555394e9bd349512a04ecf3e33274872473f8b0f2fdb5a42169f60911b`; updated 2026-09-22T17:47:10.406659+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-92e075b5d6c7750a77b0eabf\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-92e075b5d6c7750a77b0eabf\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":1,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":1,\"retained_targets\":31,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 4296, "stream": 0, "flow_id": "flow-7665ed7a3291ae4219c3ef78", "packets": 42, "transport": "udp", "last_frame": 6234, "first_frame": 1, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 4296, "last_seen_epoch": "1555363520.680436", "responder_bytes": 0, "first_seen_epoch": "1555346526.210024" }, { "bytes": 324, "stream": 1, "flow_id": "flow-9e6c6b52d13a724a4f471aa5", "packets": 2, "transport": "udp", "last_frame": 4, "first_frame": 3, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 52727, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1555346526.219414", "responder_bytes": 196, "first_seen_epoch": "1555346526.219136" }, { "bytes": 200, "stream": 2, "flow_id": "flow-ed03629083665244d575e89d", "packets": 2, "transport": "udp", "last_frame": 6, "first_frame": 5, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 60967, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1555346526.221554", "responder_bytes": 108, "first_seen_epoch": "1555346526.221397" }, { "bytes": 458, "stream": 3, "flow_id": "flow-3cdee7428b99ed7b0550bb70", "packets": 2, "transport": "udp", "last_frame": 8, "first_frame": 7, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 60969, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1555346526.22514", "responder_bytes": 244, "first_seen_epoch": "1555346526.224882" }, { "bytes": 501, "stream": 4, "flow_id": "flow-97bab256fb106b38586d3127", "packets": 2, "transport": "udp", "last_frame": 10, "first_frame": 9, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 60970, "responder_port": 389, "initiator_bytes": 257, "last_seen_epoch": "1555346526.233645", "responder_bytes": 244, "first_seen_epoch": "1555346526.233338" }, { "bytes": 2380, "stream": 0, "flow_id": "flow-d7f57578b00df8934fbaa6a0", "packets": 18, "transport": "tcp", "last_frame": 1016, "first_frame": 12, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49155, "responder_port": 135, "initiator_bytes": 1270, "last_seen_epoch": "1555346555.330305", "responder_bytes": 1110, "first_seen_epoch": "1555346526.330119" }, { "bytes": 4520, "stream": 1, "flow_id": "flow-661b114e9a81f3d758615537", "packets": 20, "transport": "tcp", "last_frame": 1015, "first_frame": 19, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49156, "responder_port": 49158, "initiator_bytes": 2622, "last_seen_epoch": "1555346555.33018", "responder_bytes": 1898, "first_seen_epoch": "1555346526.3424" }, { "bytes": 9109, "stream": 2, "flow_id": "flow-66942d81dea2b4a7d9acae95", "packets": 29, "transport": "tcp", "last_frame": 214, "first_frame": 34, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49157, "responder_port": 389, "initiator_bytes": 4388, "last_seen_epoch": "1555346526.625231", "responder_bytes": 4721, "first_seen_epoch": "1555346526.354098" }, { "bytes": 1002, "stream": 3, "flow_id": "flow-2869692422907e70fb48065a", "packets": 8, "transport": "tcp", "last_frame": 48, "first_frame": 41, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49158, "responder_port": 88, "initiator_bytes": 474, "last_seen_epoch": "1555346526.368546", "responder_bytes": 528, "first_seen_epoch": "1555346526.362745" }, { "bytes": 2511, "stream": 4, "flow_id": "flow-2a91983329fb805437841bd2", "packets": 10, "transport": "tcp", "last_frame": 58, "first_frame": 49, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49159, "responder_port": 88, "initiator_bytes": 608, "last_seen_epoch": "1555346526.397171", "responder_bytes": 1903, "first_seen_epoch": "1555346526.390561" }, { "bytes": 3935, "stream": 5, "flow_id": "flow-a90dc3b1e94f2947b307c22e", "packets": 12, "transport": "tcp", "last_frame": 70, "first_frame": 59, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49160, "responder_port": 88, "initiator_bytes": 1977, "last_seen_epoch": "1555346526.407191", "responder_bytes": 1958, "first_seen_epoch": "1555346526.398293" }, { "bytes": 334, "stream": 5, "flow_id": "flow-7d9ba51a49ffed039e4db6ad", "packets": 2, "transport": "udp", "last_frame": 80, "first_frame": 79, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 59790, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1555346526.415189", "responder_bytes": 201, "first_seen_epoch": "1555346526.414974" }, { "bytes": 438, "stream": 6, "flow_id": "flow-11a46bc76282eddb2c1b4989", "packets": 2, "transport": "udp", "last_frame": 82, "first_frame": 81, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 59791, "responder_port": 389, "initiator_bytes": 192, "last_seen_epoch": "1555346526.417401", "responder_bytes": 246, "first_seen_epoch": "1555346526.41717" }, { "bytes": 6811, "stream": 6, "flow_id": "flow-92d7b46cb7b5da9619c6ace0", "packets": 24, "transport": "tcp", "last_frame": 645, "first_frame": 83, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49161, "responder_port": 445, "initiator_bytes": 4819, "last_seen_epoch": "1555346543.269843", "responder_bytes": 1992, "first_seen_epoch": "1555346526.418025" }, { "bytes": 1002, "stream": 7, "flow_id": "flow-40c161efdb070ddcfa6e30b8", "packets": 8, "transport": "tcp", "last_frame": 97, "first_frame": 90, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49162, "responder_port": 88, "initiator_bytes": 474, "last_seen_epoch": "1555346526.44214", "responder_bytes": 528, "first_seen_epoch": "1555346526.440157" }, { "bytes": 2457, "stream": 8, "flow_id": "flow-ad6a4f344ce7546536b1674d", "packets": 9, "transport": "tcp", "last_frame": 106, "first_frame": 98, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49163, "responder_port": 88, "initiator_bytes": 554, "last_seen_epoch": "1555346526.461264", "responder_bytes": 1903, "first_seen_epoch": "1555346526.459272" }, { "bytes": 3935, "stream": 9, "flow_id": "flow-d0c52f9a66d984e02e101daf", "packets": 12, "transport": "tcp", "last_frame": 118, "first_frame": 107, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49164, "responder_port": 88, "initiator_bytes": 1977, "last_seen_epoch": "1555346526.464917", "responder_bytes": 1958, "first_seen_epoch": "1555346526.462067" }, { "bytes": 3631, "stream": 10, "flow_id": "flow-fa2339d7103a0f30bc160b93", "packets": 12, "transport": "tcp", "last_frame": 130, "first_frame": 119, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49165, "responder_port": 88, "initiator_bytes": 1809, "last_seen_epoch": "1555346526.466452", "responder_bytes": 1822, "first_seen_epoch": "1555346526.465039" }, { "bytes": 304, "stream": 7, "flow_id": "flow-4474090509fc15911757bf55", "packets": 2, "transport": "udp", "last_frame": 135, "first_frame": 133, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 61885, "responder_port": 53, "initiator_bytes": 118, "last_seen_epoch": "1555346526.467039", "responder_bytes": 186, "first_seen_epoch": "1555346526.466875" }, { "bytes": 458, "stream": 8, "flow_id": "flow-35191bc94135363ae1cc9504", "packets": 2, "transport": "udp", "last_frame": 138, "first_frame": 137, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 61886, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1555346526.468111", "responder_bytes": 244, "first_seen_epoch": "1555346526.467752" }, { "bytes": 348, "stream": 11, "flow_id": "flow-09eda94ac47b959203074f4f", "packets": 6, "transport": "tcp", "last_frame": 150, "first_frame": 144, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49166, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1555346526.521271", "responder_bytes": 174, "first_seen_epoch": "1555346526.518046" }, { "bytes": 334, "stream": 9, "flow_id": "flow-bc94d5688794086a4050657b", "packets": 2, "transport": "udp", "last_frame": 153, "first_frame": 152, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 54226, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1555346526.522279", "responder_bytes": 201, "first_seen_epoch": "1555346526.522086" }, { "bytes": 438, "stream": 10, "flow_id": "flow-6310f995f7a406974c2acb39", "packets": 2, "transport": "udp", "last_frame": 155, "first_frame": 154, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 54227, "responder_port": 389, "initiator_bytes": 192, "last_seen_epoch": "1555346526.523172", "responder_bytes": 246, "first_seen_epoch": "1555346526.52297" }, { "bytes": 5577, "stream": 12, "flow_id": "flow-a526574254c1da30f4f92cde", "packets": 15, "transport": "tcp", "last_frame": 183, "first_frame": 157, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49167, "responder_port": 389, "initiator_bytes": 2605, "last_seen_epoch": "1555346526.582131", "responder_bytes": 2972, "first_seen_epoch": "1555346526.567771" }, { "bytes": 3969, "stream": 13, "flow_id": "flow-b23f5a7f773d17b4a902506d", "packets": 12, "transport": "tcp", "last_frame": 175, "first_frame": 164, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49168, "responder_port": 88, "initiator_bytes": 1995, "last_seen_epoch": "1555346526.575356", "responder_bytes": 1974, "first_seen_epoch": "1555346526.573138" }, { "bytes": 348, "stream": 14, "flow_id": "flow-7e9545d96c924aea262f4731", "packets": 6, "transport": "tcp", "last_frame": 191, "first_frame": 185, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49170, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1555346526.619924", "responder_bytes": 174, "first_seen_epoch": "1555346526.617351" }, { "bytes": 348, "stream": 15, "flow_id": "flow-584ee81962281cfcc843448e", "packets": 6, "transport": "tcp", "last_frame": 199, "first_frame": 193, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49171, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1555346526.621596", "responder_bytes": 174, "first_seen_epoch": "1555346526.6206" }, { "bytes": 348, "stream": 16, "flow_id": "flow-d373fa7405021d1aaf77a769", "packets": 6, "transport": "tcp", "last_frame": 207, "first_frame": 201, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49172, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1555346526.623996", "responder_bytes": 174, "first_seen_epoch": "1555346526.623005" }, { "bytes": 186, "stream": 17, "flow_id": "flow-5364996500202c7e67220f25", "packets": 3, "transport": "tcp", "last_frame": 222, "first_frame": 220, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49173, "responder_port": 49155, "initiator_bytes": 120, "last_seen_epoch": "1555346526.911207", "responder_bytes": 66, "first_seen_epoch": "1555346526.910665" }, { "bytes": 146, "stream": 11, "flow_id": "flow-1ec932600c8beaa1b080f403", "packets": 2, "transport": "udp", "last_frame": 242, "first_frame": 236, "initiator_ip": "10.0.90.175", "responder_ip": "224.0.0.252", "initiator_port": 52750, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1555346529.378627", "responder_bytes": 0, "first_seen_epoch": "1555346529.285859" }, { "bytes": 1368, "stream": 12, "flow_id": "flow-e619e8236b4ee9f06546fb91", "packets": 4, "transport": "udp", "last_frame": 5372, "first_frame": 237, "initiator_ip": "10.0.90.175", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 1368, "last_seen_epoch": "1555363518.816531", "responder_bytes": 0, "first_seen_epoch": "1555346529.292738" }, { "bytes": 1368, "stream": 13, "flow_id": "flow-627a0821999d5996f44f8e57", "packets": 4, "transport": "udp", "last_frame": 5373, "first_frame": 238, "initiator_ip": "10.0.90.9", "responder_ip": "10.0.90.175", "initiator_port": 67, "responder_port": 68, "initiator_bytes": 1368, "last_seen_epoch": "1555363518.817063", "responder_bytes": 0, "first_seen_epoch": "1555346529.293034" }, { "bytes": 241, "stream": 14, "flow_id": "flow-5eb3835c30a64a9deba0def1", "packets": 2, "transport": "udp", "last_frame": 240, "first_frame": 239, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 57385, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1555346529.296857", "responder_bytes": 160, "first_seen_epoch": "1555346529.296617" }, { "bytes": 128, "stream": 15, "flow_id": "flow-d7842c55e73eb126f574c59f", "packets": 2, "transport": "udp", "last_frame": 243, "first_frame": 241, "initiator_ip": "10.0.90.175", "responder_ip": "224.0.0.252", "initiator_port": 60681, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1555346529.38856", "responder_bytes": 0, "first_seen_epoch": "1555346529.297465" }, { "bytes": 200, "stream": 16, "flow_id": "flow-332e14ec00b8168100b1610c", "packets": 2, "transport": "udp", "last_frame": 246, "first_frame": 245, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 53996, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1555346529.737389", "responder_bytes": 108, "first_seen_epoch": "1555346529.737066" }, { "bytes": 245, "stream": 17, "flow_id": "flow-92b4014cb10f00e4cf564dd0", "packets": 2, "transport": "udp", "last_frame": 248, "first_frame": 247, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 61413, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1555346529.742371", "responder_bytes": 162, "first_seen_epoch": "1555346529.742162" }, { "bytes": 156, "stream": 18, "flow_id": "flow-f7ed3703cdcdb53223b9b0fa", "packets": 2, "transport": "udp", "last_frame": 251, "first_frame": 250, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 56239, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1555346529.886235", "responder_bytes": 78, "first_seen_epoch": "1555346529.885969" }, { "bytes": 4114, "stream": 18, "flow_id": "flow-f3a9720fdf64a4bb5f68efa1", "packets": 22, "transport": "tcp", "last_frame": 1020, "first_frame": 252, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49173, "responder_port": 49155, "initiator_bytes": 282, "last_seen_epoch": "1555346585.345479", "responder_bytes": 3832, "first_seen_epoch": "1555346529.919661" }, { "bytes": 3969, "stream": 19, "flow_id": "flow-618b7c7966bd43b4a4f8c15c", "packets": 12, "transport": "tcp", "last_frame": 266, "first_frame": 255, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49174, "responder_port": 88, "initiator_bytes": 1995, "last_seen_epoch": "1555346529.922316", "responder_bytes": 1974, "first_seen_epoch": "1555346529.920655" }, { "bytes": 347, "stream": 19, "flow_id": "flow-080e6bd03a67b6fe521a59b0", "packets": 2, "transport": "udp", "last_frame": 275, "first_frame": 274, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 60369, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1555346530.101872", "responder_bytes": 213, "first_seen_epoch": "1555346530.101594" }, { "bytes": 285, "stream": 20, "flow_id": "flow-5a352ddb1bfb1dd4b531b019", "packets": 2, "transport": "udp", "last_frame": 277, "first_frame": 276, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 55773, "responder_port": 53, "initiator_bytes": 103, "last_seen_epoch": "1555346530.10259", "responder_bytes": 182, "first_seen_epoch": "1555346530.102406" }, { "bytes": 8220, "stream": 20, "flow_id": "flow-42d641557cbc207eb9b5c7fe", "packets": 20, "transport": "tcp", "last_frame": 394, "first_frame": 278, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49175, "responder_port": 389, "initiator_bytes": 3406, "last_seen_epoch": "1555346531.112568", "responder_bytes": 4814, "first_seen_epoch": "1555346530.104132" }, { "bytes": 3861, "stream": 21, "flow_id": "flow-8c43778c79c64e99dca25589", "packets": 12, "transport": "tcp", "last_frame": 300, "first_frame": 289, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49176, "responder_port": 88, "initiator_bytes": 1953, "last_seen_epoch": "1555346530.114527", "responder_bytes": 1908, "first_seen_epoch": "1555346530.112405" }, { "bytes": 3650, "stream": 22, "flow_id": "flow-a5270abe9511eb0c0f444905", "packets": 12, "transport": "tcp", "last_frame": 318, "first_frame": 304, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49177, "responder_port": 88, "initiator_bytes": 1813, "last_seen_epoch": "1555346530.120552", "responder_bytes": 1837, "first_seen_epoch": "1555346530.118763" }, { "bytes": 3387, "stream": 23, "flow_id": "flow-5cb8427cc4484733fa75dc83", "packets": 13, "transport": "tcp", "last_frame": 386, "first_frame": 310, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49178, "responder_port": 389, "initiator_bytes": 2531, "last_seen_epoch": "1555346530.133922", "responder_bytes": 856, "first_seen_epoch": "1555346530.119374" }, { "bytes": 3313, "stream": 24, "flow_id": "flow-84fa9c974160c57cc4efccbb", "packets": 10, "transport": "tcp", "last_frame": 332, "first_frame": 319, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49179, "responder_port": 88, "initiator_bytes": 2887, "last_seen_epoch": "1555346530.122236", "responder_bytes": 426, "first_seen_epoch": "1555346530.120779" }, { "bytes": 8693, "stream": 25, "flow_id": "flow-9f7438a36b8c6a33f83a6398", "packets": 33, "transport": "tcp", "last_frame": 652, "first_frame": 339, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49180, "responder_port": 445, "initiator_bytes": 5861, "last_seen_epoch": "1555346543.271337", "responder_bytes": 2832, "first_seen_epoch": "1555346530.126081" }, { "bytes": 3935, "stream": 26, "flow_id": "flow-bb307234463c1964448e490f", "packets": 12, "transport": "tcp", "last_frame": 355, "first_frame": 344, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49181, "responder_port": 88, "initiator_bytes": 1977, "last_seen_epoch": "1555346530.128566", "responder_bytes": 1958, "first_seen_epoch": "1555346530.127128" }, { "bytes": 3631, "stream": 27, "flow_id": "flow-170226bbde20fdbf6b4f727f", "packets": 12, "transport": "tcp", "last_frame": 367, "first_frame": 356, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49182, "responder_port": 88, "initiator_bytes": 1809, "last_seen_epoch": "1555346530.12968", "responder_bytes": 1822, "first_seen_epoch": "1555346530.128716" }, { "bytes": 3300, "stream": 21, "flow_id": "flow-16feb8b4bc12cfb9987c6ea9", "packets": 30, "transport": "udp", "last_frame": 10553, "first_frame": 395, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 1650, "last_seen_epoch": "1555366533.328627", "responder_bytes": 1650, "first_seen_epoch": "1555346531.245208" }, { "bytes": 258, "stream": 22, "flow_id": "flow-b9151e1611c584af0189f018", "packets": 2, "transport": "udp", "last_frame": 398, "first_frame": 397, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 50013, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1555346531.908365", "responder_bytes": 182, "first_seen_epoch": "1555346531.866514" }, { "bytes": 778, "stream": 28, "flow_id": "flow-0e0073bc5d4ba694bf0b323f", "packets": 9, "transport": "tcp", "last_frame": 407, "first_frame": 399, "initiator_ip": "10.0.90.175", "responder_ip": "23.218.156.11", "initiator_port": 49183, "responder_port": 80, "initiator_bytes": 379, "last_seen_epoch": "1555346531.961634", "responder_bytes": 399, "first_seen_epoch": "1555346531.913475" }, { "bytes": 934, "stream": 29, "flow_id": "flow-f6ff2944b653bcd3f9d91bca", "packets": 8, "transport": "tcp", "last_frame": 415, "first_frame": 408, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49184, "responder_port": 88, "initiator_bytes": 464, "last_seen_epoch": "1555346532.839673", "responder_bytes": 470, "first_seen_epoch": "1555346532.838036" }, { "bytes": 2499, "stream": 30, "flow_id": "flow-d93aca3410ef4bcb6f176499", "packets": 10, "transport": "tcp", "last_frame": 425, "first_frame": 416, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49185, "responder_port": 88, "initiator_bytes": 598, "last_seen_epoch": "1555346532.859676", "responder_bytes": 1901, "first_seen_epoch": "1555346532.858164" }, { "bytes": 3707, "stream": 31, "flow_id": "flow-b1f531fe7b9c15400257f539", "packets": 12, "transport": "tcp", "last_frame": 437, "first_frame": 426, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49186, "responder_port": 88, "initiator_bytes": 1839, "last_seen_epoch": "1555346532.861368", "responder_bytes": 1868, "first_seen_epoch": "1555346532.859845" }, { "bytes": 4009, "stream": 32, "flow_id": "flow-197418646a4a90cc3bf147f6", "packets": 12, "transport": "tcp", "last_frame": 451, "first_frame": 440, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49187, "responder_port": 88, "initiator_bytes": 2015, "last_seen_epoch": "1555346532.900334", "responder_bytes": 1994, "first_seen_epoch": "1555346532.898836" }, { "bytes": 8783, "stream": 33, "flow_id": "flow-9d1f95ca550901cac4e0a293", "packets": 48, "transport": "tcp", "last_frame": 2101, "first_frame": 459, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49188, "responder_port": 445, "initiator_bytes": 6239, "last_seen_epoch": "1555347474.80606", "responder_bytes": 2544, "first_seen_epoch": "1555346532.930134" }, { "bytes": 3975, "stream": 34, "flow_id": "flow-91d199de05dc2d659a822a41", "packets": 12, "transport": "tcp", "last_frame": 477, "first_frame": 466, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49189, "responder_port": 88, "initiator_bytes": 1997, "last_seen_epoch": "1555346532.932599", "responder_bytes": 1978, "first_seen_epoch": "1555346532.931402" }, { "bytes": 3671, "stream": 35, "flow_id": "flow-75331d5b37ce04bc3809d2bb", "packets": 12, "transport": "tcp", "last_frame": 489, "first_frame": 478, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49190, "responder_port": 88, "initiator_bytes": 1829, "last_seen_epoch": "1555346532.933501", "responder_bytes": 1842, "first_seen_epoch": "1555346532.932665" }, { "bytes": 5308, "stream": 36, "flow_id": "flow-386ab7a71546005d44b56b48", "packets": 16, "transport": "tcp", "last_frame": 564, "first_frame": 507, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49191, "responder_port": 389, "initiator_bytes": 2974, "last_seen_epoch": "1555346534.010481", "responder_bytes": 2334, "first_seen_epoch": "1555346533.410411" }, { "bytes": 3975, "stream": 37, "flow_id": "flow-d3ff02dffe7fbd521653ac69", "packets": 12, "transport": "tcp", "last_frame": 521, "first_frame": 510, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49192, "responder_port": 88, "initiator_bytes": 1997, "last_seen_epoch": "1555346533.413155", "responder_bytes": 1978, "first_seen_epoch": "1555346533.411273" }, { "bytes": 3431, "stream": 38, "flow_id": "flow-226154a7326d205af3651cf9", "packets": 13, "transport": "tcp", "last_frame": 558, "first_frame": 528, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49193, "responder_port": 389, "initiator_bytes": 2575, "last_seen_epoch": "1555346533.429088", "responder_bytes": 856, "first_seen_epoch": "1555346533.417926" }, { "bytes": 6981, "stream": 39, "flow_id": "flow-54c6bb51070d2232c6f6cbb4", "packets": 25, "transport": "tcp", "last_frame": 1007, "first_frame": 541, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49194, "responder_port": 445, "initiator_bytes": 5123, "last_seen_epoch": "1555346555.271968", "responder_bytes": 1858, "first_seen_epoch": "1555346533.424432" }, { "bytes": 168, "stream": 23, "flow_id": "flow-21ce432bf24d05f9c503e250", "packets": 2, "transport": "udp", "last_frame": 566, "first_frame": 565, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 54715, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1555346534.042221", "responder_bytes": 92, "first_seen_epoch": "1555346534.015562" }, { "bytes": 180, "stream": 24, "flow_id": "flow-4f5daff1e4e1c898a70d7fad", "packets": 2, "transport": "udp", "last_frame": 568, "first_frame": 567, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 55983, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1555346534.067372", "responder_bytes": 104, "first_seen_epoch": "1555346534.042568" }, { "bytes": 259, "stream": 25, "flow_id": "flow-9d3718f26a80ce37db4b0f30", "packets": 2, "transport": "udp", "last_frame": 570, "first_frame": 569, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 62142, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1555346534.297105", "responder_bytes": 169, "first_seen_epoch": "1555346534.296811" }, { "bytes": 316, "stream": 26, "flow_id": "flow-432c44b89a47d9d9e7adabd3", "packets": 2, "transport": "udp", "last_frame": 572, "first_frame": 571, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 55465, "responder_port": 53, "initiator_bytes": 158, "last_seen_epoch": "1555346534.299123", "responder_bytes": 158, "first_seen_epoch": "1555346534.298446" }, { "bytes": 7228, "stream": 40, "flow_id": "flow-c9727dccf35abbbe124c50b3", "packets": 21, "transport": "tcp", "last_frame": 638, "first_frame": 575, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49196, "responder_port": 389, "initiator_bytes": 3411, "last_seen_epoch": "1555346537.181909", "responder_bytes": 3817, "first_seen_epoch": "1555346537.138888" }, { "bytes": 4172, "stream": 41, "flow_id": "flow-1ccf1b96d1a2f2fce280df82", "packets": 13, "transport": "tcp", "last_frame": 636, "first_frame": 594, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49197, "responder_port": 389, "initiator_bytes": 3356, "last_seen_epoch": "1555346537.181359", "responder_bytes": 816, "first_seen_epoch": "1555346537.149965" }, { "bytes": 1002, "stream": 42, "flow_id": "flow-cbde286e0e60d22a986c824e", "packets": 8, "transport": "tcp", "last_frame": 610, "first_frame": 603, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49198, "responder_port": 88, "initiator_bytes": 474, "last_seen_epoch": "1555346537.156851", "responder_bytes": 528, "first_seen_epoch": "1555346537.155554" }, { "bytes": 2511, "stream": 43, "flow_id": "flow-16ea32965ace6fb7d033ac4c", "packets": 10, "transport": "tcp", "last_frame": 620, "first_frame": 611, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49199, "responder_port": 88, "initiator_bytes": 608, "last_seen_epoch": "1555346537.174622", "responder_bytes": 1903, "first_seen_epoch": "1555346537.172154" }, { "bytes": 3799, "stream": 44, "flow_id": "flow-38a0030777bbfab288cbf98a", "packets": 12, "transport": "tcp", "last_frame": 632, "first_frame": 621, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49200, "responder_port": 88, "initiator_bytes": 1919, "last_seen_epoch": "1555346537.177497", "responder_bytes": 1880, "first_seen_epoch": "1555346537.17529" }, { "bytes": 168, "stream": 27, "flow_id": "flow-36221f61ca0c68b07a52d33c", "packets": 2, "transport": "udp", "last_frame": 664, "first_frame": 663, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 64355, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1555346549.748518", "responder_bytes": 92, "first_seen_epoch": "1555346549.360603" }, { "bytes": 346845, "stream": 45, "flow_id": "flow-60727ca8dd15c90c802e2fb7", "packets": 337, "transport": "tcp", "last_frame": 1001, "first_frame": 665, "initiator_ip": "10.0.90.175", "responder_ip": "91.240.87.19", "initiator_port": 49201, "responder_port": 80, "initiator_bytes": 4909, "last_seen_epoch": "1555346551.047497", "responder_bytes": 341936, "first_seen_epoch": "1555346549.768835" }, { "bytes": 320, "stream": 28, "flow_id": "flow-ddcc5a1c64c038618a83cbe1", "packets": 4, "transport": "udp", "last_frame": 1027, "first_frame": 1022, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 53775, "responder_port": 53, "initiator_bytes": 228, "last_seen_epoch": "1555346588.429073", "responder_bytes": 92, "first_seen_epoch": "1555346586.179739" }, { "bytes": 244469, "stream": 46, "flow_id": "flow-9e45c8ab737f5cfdf797b946", "packets": 288, "transport": "tcp", "last_frame": 1679, "first_frame": 1028, "initiator_ip": "10.0.90.175", "responder_ip": "37.230.112.226", "initiator_port": 49203, "responder_port": 80, "initiator_bytes": 7283, "last_seen_epoch": "1555346594.374807", "responder_bytes": 237186, "first_seen_epoch": "1555346588.433001" }, { "bytes": 232, "stream": 47, "flow_id": "flow-9d4afdc09510792522b1c40f", "packets": 4, "transport": "tcp", "last_frame": 1678, "first_frame": 1029, "initiator_ip": "10.0.90.175", "responder_ip": "37.230.112.226", "initiator_port": 49202, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1555346594.374692", "responder_bytes": 58, "first_seen_epoch": "1555346588.433065" }, { "bytes": 220, "stream": 29, "flow_id": "flow-d98c5c725b708bc62fa2e8bb", "packets": 2, "transport": "udp", "last_frame": 1264, "first_frame": 1253, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 60014, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1555346589.804242", "responder_bytes": 148, "first_seen_epoch": "1555346589.77719" }, { "bytes": 265, "stream": 30, "flow_id": "flow-d503cc6af889a5d89f2b29d1", "packets": 2, "transport": "udp", "last_frame": 1268, "first_frame": 1254, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 59671, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1555346589.847659", "responder_bytes": 193, "first_seen_epoch": "1555346589.785106" }, { "bytes": 231, "stream": 31, "flow_id": "flow-015175298670f2b7fe55265c", "packets": 2, "transport": "udp", "last_frame": 1263, "first_frame": 1255, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 61436, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1555346589.804161", "responder_bytes": 159, "first_seen_epoch": "1555346589.786325" }, { "bytes": 276, "stream": 32, "flow_id": "flow-67db8860fa8d11434fd7ad37", "packets": 2, "transport": "udp", "last_frame": 1265, "first_frame": 1256, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 52393, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1555346589.847335", "responder_bytes": 204, "first_seen_epoch": "1555346589.787265" }, { "bytes": 276, "stream": 33, "flow_id": "flow-47ab23d331cbedd37b463b4d", "packets": 2, "transport": "udp", "last_frame": 1266, "first_frame": 1257, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 60509, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1555346589.847476", "responder_bytes": 204, "first_seen_epoch": "1555346589.787594" }, { "bytes": 276, "stream": 34, "flow_id": "flow-6a9a27f5dcab849b45a8fed2", "packets": 2, "transport": "udp", "last_frame": 1267, "first_frame": 1258, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 55382, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1555346589.847567", "responder_bytes": 204, "first_seen_epoch": "1555346589.788166" }, { "bytes": 232, "stream": 48, "flow_id": "flow-6734dd8970370eeb659a9b66", "packets": 4, "transport": "tcp", "last_frame": 1676, "first_frame": 1323, "initiator_ip": "10.0.90.175", "responder_ip": "37.230.112.226", "initiator_port": 49204, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1555346594.366138", "responder_bytes": 58, "first_seen_epoch": "1555346591.049365" }, { "bytes": 294069, "stream": 49, "flow_id": "flow-f049895b6b947edfc9da1344", "packets": 344, "transport": "tcp", "last_frame": 1677, "first_frame": 1324, "initiator_ip": "10.0.90.175", "responder_ip": "37.230.112.226", "initiator_port": 49205, "responder_port": 80, "initiator_bytes": 7918, "last_seen_epoch": "1555346594.36625", "responder_bytes": 286151, "first_seen_epoch": "1555346591.049456" }, { "bytes": 246, "stream": 35, "flow_id": "flow-b64abe695bdfd33501664bec", "packets": 2, "transport": "udp", "last_frame": 1681, "first_frame": 1680, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 61041, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1555346616.090612", "responder_bytes": 164, "first_seen_epoch": "1555346616.038986" }, { "bytes": 45327, "stream": 50, "flow_id": "flow-f8af16b911036471b72fc4dd", "packets": 66, "transport": "tcp", "last_frame": 1768, "first_frame": 1682, "initiator_ip": "10.0.90.175", "responder_ip": "72.21.81.200", "initiator_port": 49206, "responder_port": 443, "initiator_bytes": 2179, "last_seen_epoch": "1555346620.079171", "responder_bytes": 43148, "first_seen_epoch": "1555346616.092131" }, { "bytes": 8573, "stream": 51, "flow_id": "flow-7dc253baf627dfe2bd090001", "packets": 20, "transport": "tcp", "last_frame": 1767, "first_frame": 1683, "initiator_ip": "10.0.90.175", "responder_ip": "72.21.81.200", "initiator_port": 49207, "responder_port": 443, "initiator_bytes": 882, "last_seen_epoch": "1555346620.078725", "responder_bytes": 7691, "first_seen_epoch": "1555346616.092215" }, { "bytes": 604, "stream": 52, "flow_id": "flow-031e3419bb8ec5367d9d4978", "packets": 11, "transport": "tcp", "last_frame": 1799, "first_frame": 1766, "initiator_ip": "10.0.90.9", "responder_ip": "10.0.90.175", "initiator_port": 445, "responder_port": 49189, "initiator_bytes": 604, "last_seen_epoch": "1555346638.581509", "responder_bytes": 0, "first_seen_epoch": "1555346618.520492" }, { "bytes": 604, "stream": 53, "flow_id": "flow-63aa6ee88ba35dbcfe15ef6a", "packets": 11, "transport": "tcp", "last_frame": 1805, "first_frame": 1774, "initiator_ip": "10.0.90.9", "responder_ip": "10.0.90.175", "initiator_port": 445, "responder_port": 49201, "initiator_bytes": 604, "last_seen_epoch": "1555346650.01614", "responder_bytes": 0, "first_seen_epoch": "1555346629.909537" }, { "bytes": 1280, "stream": 54, "flow_id": "flow-4db0b0a2baa1b790ed621e69", "packets": 12, "transport": "tcp", "last_frame": 1813, "first_frame": 1783, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49208, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1555346653.310784", "responder_bytes": 562, "first_seen_epoch": "1555346638.316182" }, { "bytes": 1468, "stream": 55, "flow_id": "flow-c67277d9a5528080c2174eab", "packets": 12, "transport": "tcp", "last_frame": 1811, "first_frame": 1790, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49209, "responder_port": 49155, "initiator_bytes": 874, "last_seen_epoch": "1555346653.310697", "responder_bytes": 594, "first_seen_epoch": "1555346638.31786" }, { "bytes": 178, "stream": 36, "flow_id": "flow-8c3fb492fef41ffadbf2c65c", "packets": 2, "transport": "udp", "last_frame": 1815, "first_frame": 1814, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 56761, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1555346658.357872", "responder_bytes": 97, "first_seen_epoch": "1555346658.33568" }, { "bytes": 209, "stream": 37, "flow_id": "flow-a31acf10cee3a6405c68488e", "packets": 2, "transport": "udp", "last_frame": 1817, "first_frame": 1816, "initiator_ip": "10.0.90.175", "responder_ip": "208.67.222.222", "initiator_port": 56762, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1555346658.38566", "responder_bytes": 122, "first_seen_epoch": "1555346658.362882" }, { "bytes": 259, "stream": 38, "flow_id": "flow-8d7ad8ac63dfa31c6efdddb3", "packets": 2, "transport": "udp", "last_frame": 1819, "first_frame": 1818, "initiator_ip": "10.0.90.175", "responder_ip": "208.67.222.222", "initiator_port": 56763, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1555346658.452204", "responder_bytes": 166, "first_seen_epoch": "1555346658.386451" }, { "bytes": 259, "stream": 39, "flow_id": "flow-d6b0b1b5af1475acbc58b056", "packets": 2, "transport": "udp", "last_frame": 1821, "first_frame": 1820, "initiator_ip": "10.0.90.175", "responder_ip": "208.67.222.222", "initiator_port": 56764, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1555346658.499622", "responder_bytes": 166, "first_seen_epoch": "1555346658.452945" }, { "bytes": 168, "stream": 40, "flow_id": "flow-bf05a03001178d6f6a0104e8", "packets": 2, "transport": "udp", "last_frame": 1823, "first_frame": 1822, "initiator_ip": "10.0.90.175", "responder_ip": "208.67.222.222", "initiator_port": 56765, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1555346658.525048", "responder_bytes": 92, "first_seen_epoch": "1555346658.500468" }, { "bytes": 198, "stream": 41, "flow_id": "flow-e257b589cab864ef3d1cb31b", "packets": 2, "transport": "udp", "last_frame": 1825, "first_frame": 1824, "initiator_ip": "10.0.90.175", "responder_ip": "208.67.222.222", "initiator_port": 56766, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1555346658.554522", "responder_bytes": 122, "first_seen_epoch": "1555346658.529168" }, { "bytes": 156, "stream": 42, "flow_id": "flow-65f7d50b0eb6de4cf314ed03", "packets": 2, "transport": "udp", "last_frame": 1830, "first_frame": 1827, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 50073, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1555346658.882999", "responder_bytes": 86, "first_seen_epoch": "1555346658.623534" }, { "bytes": 3153, "stream": 56, "flow_id": "flow-7a8b0c89de0843dafb66bfb5", "packets": 19, "transport": "tcp", "last_frame": 1941, "first_frame": 1831, "initiator_ip": "10.0.90.175", "responder_ip": "185.139.69.88", "initiator_port": 49210, "responder_port": 443, "initiator_bytes": 1323, "last_seen_epoch": "1555346672.219957", "responder_bytes": 1830, "first_seen_epoch": "1555346658.887264" }, { "bytes": 324, "stream": 43, "flow_id": "flow-fd87495a0fc463f449eb02d4", "packets": 2, "transport": "udp", "last_frame": 1844, "first_frame": 1843, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 65497, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1555346659.532735", "responder_bytes": 234, "first_seen_epoch": "1555346659.484357" }, { "bytes": 60991, "stream": 57, "flow_id": "flow-693516c1206777bb8a09edf8", "packets": 64, "transport": "tcp", "last_frame": 1959, "first_frame": 1845, "initiator_ip": "10.0.90.175", "responder_ip": "104.73.85.137", "initiator_port": 49211, "responder_port": 80, "initiator_bytes": 1255, "last_seen_epoch": "1555346719.626317", "responder_bytes": 59736, "first_seen_epoch": "1555346659.534769" }, { "bytes": 3404, "stream": 58, "flow_id": "flow-3410b9b02e801b6456ed04ac", "packets": 20, "transport": "tcp", "last_frame": 1971, "first_frame": 1913, "initiator_ip": "10.0.90.175", "responder_ip": "185.139.69.88", "initiator_port": 49212, "responder_port": 443, "initiator_bytes": 1409, "last_seen_epoch": "1555346778.591322", "responder_bytes": 1995, "first_seen_epoch": "1555346660.324155" }, { "bytes": 1635, "stream": 59, "flow_id": "flow-1c1a0954b086f4fc68187b5e", "packets": 11, "transport": "tcp", "last_frame": 1965, "first_frame": 1928, "initiator_ip": "10.0.90.175", "responder_ip": "151.106.27.208", "initiator_port": 49213, "responder_port": 80, "initiator_bytes": 511, "last_seen_epoch": "1555346778.590188", "responder_bytes": 1124, "first_seen_epoch": "1555346661.765642" }, { "bytes": 3676, "stream": 60, "flow_id": "flow-7f136f58671da6e361e6fde2", "packets": 20, "transport": "tcp", "last_frame": 1968, "first_frame": 1939, "initiator_ip": "10.0.90.175", "responder_ip": "185.139.69.88", "initiator_port": 49214, "responder_port": 443, "initiator_bytes": 1905, "last_seen_epoch": "1555346778.590686", "responder_bytes": 1771, "first_seen_epoch": "1555346672.046483" }, { "bytes": 54, "stream": 61, "flow_id": "flow-f84ce93eddc30ef97a344c21", "packets": 1, "transport": "tcp", "last_frame": 1958, "first_frame": 1958, "initiator_ip": "187.188.166.192", "responder_ip": "10.0.90.175", "initiator_port": 80, "responder_port": 49209, "initiator_bytes": 54, "last_seen_epoch": "1555346710.250677", "responder_bytes": 0, "first_seen_epoch": "1555346710.250677" }, { "bytes": 3381, "stream": 62, "flow_id": "flow-8d0e79b16648d6731a0f9466", "packets": 21, "transport": "tcp", "last_frame": 2009, "first_frame": 1976, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49215, "responder_port": 443, "initiator_bytes": 1502, "last_seen_epoch": "1555347080.331532", "responder_bytes": 1879, "first_seen_epoch": "1555346960.346447" }, { "bytes": 1635, "stream": 63, "flow_id": "flow-e8eced9a85ae609d91694b65", "packets": 11, "transport": "tcp", "last_frame": 2006, "first_frame": 1991, "initiator_ip": "10.0.90.175", "responder_ip": "151.106.27.208", "initiator_port": 49216, "responder_port": 80, "initiator_bytes": 511, "last_seen_epoch": "1555347080.331221", "responder_bytes": 1124, "first_seen_epoch": "1555346969.471243" }, { "bytes": 5792, "stream": 64, "flow_id": "flow-b21284befe5377132710f760", "packets": 21, "transport": "tcp", "last_frame": 2050, "first_frame": 2012, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49217, "responder_port": 443, "initiator_bytes": 1416, "last_seen_epoch": "1555347306.204558", "responder_bytes": 4376, "first_seen_epoch": "1555347260.326947" }, { "bytes": 3231, "stream": 65, "flow_id": "flow-740ceb090171cbcfd5d89b31", "packets": 20, "transport": "tcp", "last_frame": 2076, "first_frame": 2031, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49218, "responder_port": 443, "initiator_bytes": 1534, "last_seen_epoch": "1555347380.338546", "responder_bytes": 1697, "first_seen_epoch": "1555347280.696342" }, { "bytes": 3904, "stream": 66, "flow_id": "flow-597a87fc820187925e84cd35", "packets": 22, "transport": "tcp", "last_frame": 2073, "first_frame": 2048, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49219, "responder_port": 443, "initiator_bytes": 2249, "last_seen_epoch": "1555347380.338122", "responder_bytes": 1655, "first_seen_epoch": "1555347306.064833" }, { "bytes": 6351, "stream": 67, "flow_id": "flow-cc81db3dfda8da4e60e3ee36", "packets": 22, "transport": "tcp", "last_frame": 2100, "first_frame": 2079, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49220, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555347437.276185", "responder_bytes": 1714, "first_seen_epoch": "1555347426.785705" }, { "bytes": 3291, "stream": 68, "flow_id": "flow-f824311d961ace576d584405", "packets": 22, "transport": "tcp", "last_frame": 2147, "first_frame": 2104, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49221, "responder_port": 443, "initiator_bytes": 1540, "last_seen_epoch": "1555347700.700329", "responder_bytes": 1751, "first_seen_epoch": "1555347580.702927" }, { "bytes": 3627, "stream": 69, "flow_id": "flow-69f31a63634a0dd62451260c", "packets": 22, "transport": "tcp", "last_frame": 2144, "first_frame": 2119, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49222, "responder_port": 443, "initiator_bytes": 1972, "last_seen_epoch": "1555347700.699602", "responder_bytes": 1655, "first_seen_epoch": "1555347595.102166" }, { "bytes": 3183, "stream": 70, "flow_id": "flow-371ba3e1eb540e65aa3542f4", "packets": 20, "transport": "tcp", "last_frame": 2187, "first_frame": 2148, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49223, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555347980.344652", "responder_bytes": 1697, "first_seen_epoch": "1555347860.335822" }, { "bytes": 3183, "stream": 71, "flow_id": "flow-53257e51e2211ce1c80b1ee7", "packets": 20, "transport": "tcp", "last_frame": 2184, "first_frame": 2163, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49224, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555347980.34397", "responder_bytes": 1697, "first_seen_epoch": "1555347884.394311" }, { "bytes": 3167, "stream": 72, "flow_id": "flow-3f88e88d7e512fbaa529f2e3", "packets": 20, "transport": "tcp", "last_frame": 2207, "first_frame": 2188, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49225, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555348304.403445", "responder_bytes": 1697, "first_seen_epoch": "1555348184.396361" }, { "bytes": 200, "stream": 44, "flow_id": "flow-567d592c72f036a15eb82d86", "packets": 2, "transport": "udp", "last_frame": 2209, "first_frame": 2208, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 57450, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1555348326.795828", "responder_bytes": 108, "first_seen_epoch": "1555348326.795358" }, { "bytes": 6351, "stream": 73, "flow_id": "flow-37336b96490d353ee4b8da43", "packets": 22, "transport": "tcp", "last_frame": 2231, "first_frame": 2210, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49226, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555348337.273632", "responder_bytes": 1714, "first_seen_epoch": "1555348326.798412" }, { "bytes": 3291, "stream": 74, "flow_id": "flow-9a1996dc263cb2969edcf317", "packets": 22, "transport": "tcp", "last_frame": 2275, "first_frame": 2232, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49227, "responder_port": 443, "initiator_bytes": 1540, "last_seen_epoch": "1555348580.354964", "responder_bytes": 1751, "first_seen_epoch": "1555348460.357708" }, { "bytes": 3183, "stream": 75, "flow_id": "flow-bcded2de946fadd1d58512ab", "packets": 20, "transport": "tcp", "last_frame": 2272, "first_frame": 2247, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49228, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555348580.354293", "responder_bytes": 1697, "first_seen_epoch": "1555348484.39727" }, { "bytes": 3167, "stream": 76, "flow_id": "flow-14d93180efec500d95a92d72", "packets": 20, "transport": "tcp", "last_frame": 2295, "first_frame": 2276, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49229, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555348904.411578", "responder_bytes": 1697, "first_seen_epoch": "1555348784.40084" }, { "bytes": 3291, "stream": 77, "flow_id": "flow-d182e85e6a126db08a04f939", "packets": 22, "transport": "tcp", "last_frame": 2337, "first_frame": 2296, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49230, "responder_port": 443, "initiator_bytes": 1540, "last_seen_epoch": "1555349180.361861", "responder_bytes": 1751, "first_seen_epoch": "1555349060.351399" }, { "bytes": 3167, "stream": 78, "flow_id": "flow-353490b8fd928ef9f0b301b7", "packets": 20, "transport": "tcp", "last_frame": 2334, "first_frame": 2311, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49231, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555349180.361467", "responder_bytes": 1697, "first_seen_epoch": "1555349084.405724" }, { "bytes": 6351, "stream": 79, "flow_id": "flow-d355327618449e04fe65305d", "packets": 22, "transport": "tcp", "last_frame": 2359, "first_frame": 2338, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49232, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555349237.270277", "responder_bytes": 1714, "first_seen_epoch": "1555349226.812152" }, { "bytes": 3183, "stream": 80, "flow_id": "flow-b284af2fa1bc41e34f5ba496", "packets": 20, "transport": "tcp", "last_frame": 2379, "first_frame": 2360, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49233, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555349504.421586", "responder_bytes": 1697, "first_seen_epoch": "1555349384.42615" }, { "bytes": 3183, "stream": 81, "flow_id": "flow-9d07ffa05e6eca58e7fdf845", "packets": 20, "transport": "tcp", "last_frame": 2421, "first_frame": 2382, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49234, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555349780.371223", "responder_bytes": 1697, "first_seen_epoch": "1555349660.361983" }, { "bytes": 3183, "stream": 82, "flow_id": "flow-69bd670f5b9ecca707ea35e4", "packets": 20, "transport": "tcp", "last_frame": 2418, "first_frame": 2397, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49235, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555349780.370533", "responder_bytes": 1697, "first_seen_epoch": "1555349684.413728" }, { "bytes": 3183, "stream": 83, "flow_id": "flow-7c1a065d33f1592c98242f7f", "packets": 20, "transport": "tcp", "last_frame": 2441, "first_frame": 2422, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49236, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555350104.428779", "responder_bytes": 1697, "first_seen_epoch": "1555349984.424915" }, { "bytes": 6351, "stream": 84, "flow_id": "flow-8508024d4f80f9a092440e99", "packets": 22, "transport": "tcp", "last_frame": 2463, "first_frame": 2442, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49237, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555350137.279802", "responder_bytes": 1714, "first_seen_epoch": "1555350126.839667" }, { "bytes": 3237, "stream": 85, "flow_id": "flow-8cc187fb688c56b690f45c0b", "packets": 21, "transport": "tcp", "last_frame": 2504, "first_frame": 2464, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49238, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555350380.391372", "responder_bytes": 1751, "first_seen_epoch": "1555350260.393562" }, { "bytes": 3183, "stream": 86, "flow_id": "flow-823356c7b76dbdfd0840f84c", "packets": 20, "transport": "tcp", "last_frame": 2501, "first_frame": 2479, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49239, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555350380.390852", "responder_bytes": 1697, "first_seen_epoch": "1555350284.434338" }, { "bytes": 3183, "stream": 87, "flow_id": "flow-3de7424d05c66582e4f49616", "packets": 20, "transport": "tcp", "last_frame": 2526, "first_frame": 2505, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49240, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555350704.448451", "responder_bytes": 1697, "first_seen_epoch": "1555350584.440354" }, { "bytes": 3129, "stream": 88, "flow_id": "flow-580a2fd61d100a1fd3932085", "packets": 19, "transport": "tcp", "last_frame": 2565, "first_frame": 2527, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49241, "responder_port": 443, "initiator_bytes": 1432, "last_seen_epoch": "1555350980.397985", "responder_bytes": 1697, "first_seen_epoch": "1555350860.387872" }, { "bytes": 3183, "stream": 89, "flow_id": "flow-54990759cb26a9849669eb96", "packets": 20, "transport": "tcp", "last_frame": 2563, "first_frame": 2542, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49242, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555350980.397565", "responder_bytes": 1697, "first_seen_epoch": "1555350884.443416" }, { "bytes": 6351, "stream": 90, "flow_id": "flow-c434e8c1966a7506c3c797fd", "packets": 22, "transport": "tcp", "last_frame": 2587, "first_frame": 2566, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49243, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555351037.291108", "responder_bytes": 1714, "first_seen_epoch": "1555351026.884911" }, { "bytes": 3237, "stream": 91, "flow_id": "flow-3d5669868b09fea90c097ff8", "packets": 21, "transport": "tcp", "last_frame": 2608, "first_frame": 2588, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49244, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555351304.458246", "responder_bytes": 1751, "first_seen_epoch": "1555351184.461049" }, { "bytes": 3167, "stream": 92, "flow_id": "flow-963be2b79633a41c513d71d1", "packets": 20, "transport": "tcp", "last_frame": 2648, "first_frame": 2609, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49245, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555351580.405613", "responder_bytes": 1697, "first_seen_epoch": "1555351460.397555" }, { "bytes": 3183, "stream": 93, "flow_id": "flow-86c2b57814e27b7267b193e1", "packets": 20, "transport": "tcp", "last_frame": 2645, "first_frame": 2624, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49246, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555351580.405068", "responder_bytes": 1697, "first_seen_epoch": "1555351484.450818" }, { "bytes": 3183, "stream": 94, "flow_id": "flow-f6261d255d5ee84261cdeb62", "packets": 20, "transport": "tcp", "last_frame": 2693, "first_frame": 2651, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49247, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555351904.46596", "responder_bytes": 1697, "first_seen_epoch": "1555351784.458808" }, { "bytes": 23004, "stream": 95, "flow_id": "flow-e63240d23dec09360c0c8fd1", "packets": 297, "transport": "tcp", "last_frame": 10786, "first_frame": 2668, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49248, "responder_port": 445, "initiator_bytes": 13898, "last_seen_epoch": "1555368318.799009", "responder_bytes": 9106, "first_seen_epoch": "1555351861.966078" }, { "bytes": 200, "stream": 45, "flow_id": "flow-b0897132dd1a25caae4a3456", "packets": 2, "transport": "udp", "last_frame": 2695, "first_frame": 2694, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 64252, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1555351926.909196", "responder_bytes": 108, "first_seen_epoch": "1555351926.908657" }, { "bytes": 6351, "stream": 96, "flow_id": "flow-cc0eb09d947dce3b3419785c", "packets": 22, "transport": "tcp", "last_frame": 2717, "first_frame": 2696, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49249, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555351937.289613", "responder_bytes": 1714, "first_seen_epoch": "1555351926.911699" }, { "bytes": 3183, "stream": 97, "flow_id": "flow-3a5bb117a71a99124281ac33", "packets": 20, "transport": "tcp", "last_frame": 2861, "first_frame": 2720, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49250, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555352180.414645", "responder_bytes": 1697, "first_seen_epoch": "1555352060.419129" }, { "bytes": 3183, "stream": 98, "flow_id": "flow-ee5c7861e9828748db056e61", "packets": 20, "transport": "tcp", "last_frame": 2858, "first_frame": 2735, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49251, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555352180.414074", "responder_bytes": 1697, "first_seen_epoch": "1555352084.459586" }, { "bytes": 501, "stream": 46, "flow_id": "flow-dacacd31e553c03368349131", "packets": 2, "transport": "udp", "last_frame": 2758, "first_frame": 2756, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 64253, "responder_port": 389, "initiator_bytes": 257, "last_seen_epoch": "1555352174.023311", "responder_bytes": 244, "first_seen_epoch": "1555352174.022912" }, { "bytes": 458, "stream": 47, "flow_id": "flow-8ca7327bd5f49a7b20cfcd96", "packets": 2, "transport": "udp", "last_frame": 2759, "first_frame": 2757, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 64254, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1555352174.02355", "responder_bytes": 244, "first_seen_epoch": "1555352174.023165" }, { "bytes": 1824, "stream": 99, "flow_id": "flow-e3c69ddb0ca5c841cf8603db", "packets": 14, "transport": "tcp", "last_frame": 2869, "first_frame": 2760, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49252, "responder_port": 135, "initiator_bytes": 940, "last_seen_epoch": "1555352186.031688", "responder_bytes": 884, "first_seen_epoch": "1555352174.129095" }, { "bytes": 3084, "stream": 100, "flow_id": "flow-854a8b8eb79bfa4984548a52", "packets": 12, "transport": "tcp", "last_frame": 2868, "first_frame": 2767, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49253, "responder_port": 49158, "initiator_bytes": 1658, "last_seen_epoch": "1555352186.031545", "responder_bytes": 1426, "first_seen_epoch": "1555352174.131764" }, { "bytes": 4994, "stream": 101, "flow_id": "flow-6fccbb4256743f4ae216a658", "packets": 20, "transport": "tcp", "last_frame": 2879, "first_frame": 2776, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49254, "responder_port": 49155, "initiator_bytes": 3383, "last_seen_epoch": "1555352206.030684", "responder_bytes": 1611, "first_seen_epoch": "1555352174.237313" }, { "bytes": 347, "stream": 48, "flow_id": "flow-9bfa84fa2c77fdc24c4e6afa", "packets": 2, "transport": "udp", "last_frame": 2795, "first_frame": 2794, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 55480, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1555352174.648011", "responder_bytes": 213, "first_seen_epoch": "1555352174.64768" }, { "bytes": 285, "stream": 49, "flow_id": "flow-20f889ee02f01357e202adf7", "packets": 2, "transport": "udp", "last_frame": 2797, "first_frame": 2796, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 63956, "responder_port": 53, "initiator_bytes": 103, "last_seen_epoch": "1555352174.649008", "responder_bytes": 182, "first_seen_epoch": "1555352174.648798" }, { "bytes": 8138, "stream": 102, "flow_id": "flow-12e172ed4eff37c5033a1da8", "packets": 18, "transport": "tcp", "last_frame": 2855, "first_frame": 2798, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49255, "responder_port": 389, "initiator_bytes": 3378, "last_seen_epoch": "1555352175.299899", "responder_bytes": 4760, "first_seen_epoch": "1555352174.651314" }, { "bytes": 457, "stream": 50, "flow_id": "flow-e3573cde63a816bd7e230f5f", "packets": 2, "transport": "udp", "last_frame": 2812, "first_frame": 2811, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 63957, "responder_port": 389, "initiator_bytes": 213, "last_seen_epoch": "1555352174.659537", "responder_bytes": 244, "first_seen_epoch": "1555352174.659325" }, { "bytes": 3431, "stream": 103, "flow_id": "flow-5b2340164b9cc0e8277c7093", "packets": 13, "transport": "tcp", "last_frame": 2851, "first_frame": 2813, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49256, "responder_port": 389, "initiator_bytes": 2575, "last_seen_epoch": "1555352174.783928", "responder_bytes": 856, "first_seen_epoch": "1555352174.766378" }, { "bytes": 9306, "stream": 104, "flow_id": "flow-1b75a2368bfe31f1d27d82d4", "packets": 36, "transport": "tcp", "last_frame": 2884, "first_frame": 2826, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49257, "responder_port": 445, "initiator_bytes": 6168, "last_seen_epoch": "1555352213.284051", "responder_bytes": 3138, "first_seen_epoch": "1555352174.77625" }, { "bytes": 3183, "stream": 105, "flow_id": "flow-c14d8b3f36d3d1404ef6f603", "packets": 20, "transport": "tcp", "last_frame": 2910, "first_frame": 2889, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49258, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555352504.475075", "responder_bytes": 1697, "first_seen_epoch": "1555352384.466764" }, { "bytes": 3183, "stream": 106, "flow_id": "flow-f441b33b7b9025b80865a337", "packets": 20, "transport": "tcp", "last_frame": 3065, "first_frame": 2913, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49259, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555352780.422487", "responder_bytes": 1697, "first_seen_epoch": "1555352660.415843" }, { "bytes": 3113, "stream": 107, "flow_id": "flow-f642dbbac76552faebe0a373", "packets": 19, "transport": "tcp", "last_frame": 3062, "first_frame": 2930, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49260, "responder_port": 443, "initiator_bytes": 1416, "last_seen_epoch": "1555352780.421705", "responder_bytes": 1697, "first_seen_epoch": "1555352684.468584" }, { "bytes": 1280, "stream": 108, "flow_id": "flow-891c98231b5b7bdf1c7d5baf", "packets": 12, "transport": "tcp", "last_frame": 3044, "first_frame": 2945, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49261, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1555352723.140528", "responder_bytes": 562, "first_seen_epoch": "1555352711.133183" }, { "bytes": 4974, "stream": 109, "flow_id": "flow-748db5cf318a3130e1ae38ba", "packets": 20, "transport": "tcp", "last_frame": 3053, "first_frame": 2952, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49262, "responder_port": 49155, "initiator_bytes": 3363, "last_seen_epoch": "1555352743.13808", "responder_bytes": 1611, "first_seen_epoch": "1555352711.135308" }, { "bytes": 5174, "stream": 110, "flow_id": "flow-5530ef8700c2707a2229e172", "packets": 14, "transport": "tcp", "last_frame": 3038, "first_frame": 2969, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49263, "responder_port": 389, "initiator_bytes": 2894, "last_seen_epoch": "1555352712.283882", "responder_bytes": 2280, "first_seen_epoch": "1555352711.646138" }, { "bytes": 501, "stream": 51, "flow_id": "flow-14fa0c955af58746dd31b573", "packets": 2, "transport": "udp", "last_frame": 2977, "first_frame": 2976, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 63958, "responder_port": 389, "initiator_bytes": 257, "last_seen_epoch": "1555352711.652613", "responder_bytes": 244, "first_seen_epoch": "1555352711.652316" }, { "bytes": 3387, "stream": 111, "flow_id": "flow-5ac9f4988d962d2d099183bb", "packets": 13, "transport": "tcp", "last_frame": 3034, "first_frame": 2980, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49264, "responder_port": 389, "initiator_bytes": 2531, "last_seen_epoch": "1555352711.775389", "responder_bytes": 856, "first_seen_epoch": "1555352711.760461" }, { "bytes": 3650, "stream": 112, "flow_id": "flow-dba8bf5fbe009372f715f529", "packets": 12, "transport": "tcp", "last_frame": 3004, "first_frame": 2993, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49265, "responder_port": 88, "initiator_bytes": 1813, "last_seen_epoch": "1555352711.767161", "responder_bytes": 1837, "first_seen_epoch": "1555352711.765531" }, { "bytes": 3313, "stream": 113, "flow_id": "flow-10a7857cd8ce8a727177a9dd", "packets": 10, "transport": "tcp", "last_frame": 3014, "first_frame": 3005, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49266, "responder_port": 88, "initiator_bytes": 2887, "last_seen_epoch": "1555352711.76859", "responder_bytes": 426, "first_seen_epoch": "1555352711.767325" }, { "bytes": 7460, "stream": 114, "flow_id": "flow-2da7643981b0f7b98d6eb406", "packets": 27, "transport": "tcp", "last_frame": 3058, "first_frame": 3015, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49267, "responder_port": 445, "initiator_bytes": 5296, "last_seen_epoch": "1555352747.288426", "responder_bytes": 2164, "first_seen_epoch": "1555352711.76966" }, { "bytes": 6351, "stream": 115, "flow_id": "flow-2530aa66d3799955d02e1e31", "packets": 22, "transport": "tcp", "last_frame": 3087, "first_frame": 3066, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49268, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555352837.286995", "responder_bytes": 1714, "first_seen_epoch": "1555352826.940273" }, { "bytes": 3183, "stream": 116, "flow_id": "flow-4df964e95c8ce8686c67f080", "packets": 20, "transport": "tcp", "last_frame": 3113, "first_frame": 3092, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49269, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555353104.481781", "responder_bytes": 1697, "first_seen_epoch": "1555352984.48777" }, { "bytes": 3183, "stream": 117, "flow_id": "flow-90ddd36d1aad7225330f5380", "packets": 20, "transport": "tcp", "last_frame": 3157, "first_frame": 3116, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49270, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555353380.430872", "responder_bytes": 1697, "first_seen_epoch": "1555353260.423725" }, { "bytes": 3183, "stream": 118, "flow_id": "flow-6ac52884625a9e9fd12e1193", "packets": 20, "transport": "tcp", "last_frame": 3154, "first_frame": 3131, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49271, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555353380.43037", "responder_bytes": 1697, "first_seen_epoch": "1555353284.476771" }, { "bytes": 3167, "stream": 119, "flow_id": "flow-a7d1d7250c9152932b77c2e8", "packets": 20, "transport": "tcp", "last_frame": 3185, "first_frame": 3162, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49272, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555353704.490444", "responder_bytes": 1697, "first_seen_epoch": "1555353584.482344" }, { "bytes": 6351, "stream": 120, "flow_id": "flow-d346d0d309db67264511d8eb", "packets": 22, "transport": "tcp", "last_frame": 3207, "first_frame": 3186, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49273, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555353737.298886", "responder_bytes": 1714, "first_seen_epoch": "1555353726.967726" }, { "bytes": 3183, "stream": 121, "flow_id": "flow-149cad4e35c44c5db5ee8b56", "packets": 20, "transport": "tcp", "last_frame": 3251, "first_frame": 3210, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49274, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555353980.455143", "responder_bytes": 1697, "first_seen_epoch": "1555353860.460134" }, { "bytes": 3167, "stream": 122, "flow_id": "flow-3e4e9b7e4a6d283b3669a1bb", "packets": 20, "transport": "tcp", "last_frame": 3248, "first_frame": 3225, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49275, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555353980.454348", "responder_bytes": 1697, "first_seen_epoch": "1555353884.499314" }, { "bytes": 2882, "stream": 123, "flow_id": "flow-d53fd2122e3d566e46cc0ec2", "packets": 16, "transport": "tcp", "last_frame": 3272, "first_frame": 3256, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49276, "responder_port": 443, "initiator_bytes": 1308, "last_seen_epoch": "1555354236.347467", "responder_bytes": 1574, "first_seen_epoch": "1555354184.50596" }, { "bytes": 54, "stream": 124, "flow_id": "flow-97a2e082630511822fc68f23", "packets": 1, "transport": "tcp", "last_frame": 3271, "first_frame": 3271, "initiator_ip": "216.98.148.157", "responder_ip": "10.0.90.175", "initiator_port": 8080, "responder_port": 49210, "initiator_bytes": 54, "last_seen_epoch": "1555354236.347416", "responder_bytes": 0, "first_seen_epoch": "1555354236.347416" }, { "bytes": 422, "stream": 52, "flow_id": "flow-089073c81ad5cf21d9e8686b", "packets": 2, "transport": "udp", "last_frame": 3274, "first_frame": 3273, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 63959, "responder_port": 389, "initiator_bytes": 178, "last_seen_epoch": "1555354241.997872", "responder_bytes": 244, "first_seen_epoch": "1555354241.997282" }, { "bytes": 259, "stream": 53, "flow_id": "flow-2fd9c7544bb20fe4cf628b6a", "packets": 2, "transport": "udp", "last_frame": 3277, "first_frame": 3276, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 58664, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1555354242.022327", "responder_bytes": 169, "first_seen_epoch": "1555354242.021965" }, { "bytes": 146, "stream": 54, "flow_id": "flow-9e607e39f91adc1ebd960355", "packets": 2, "transport": "udp", "last_frame": 3286, "first_frame": 3279, "initiator_ip": "10.0.90.175", "responder_ip": "224.0.0.252", "initiator_port": 65004, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1555354242.128002", "responder_bytes": 0, "first_seen_epoch": "1555354242.02293" }, { "bytes": 316, "stream": 55, "flow_id": "flow-be826c6bd29cd8e0a856bdce", "packets": 2, "transport": "udp", "last_frame": 3281, "first_frame": 3280, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 56229, "responder_port": 53, "initiator_bytes": 158, "last_seen_epoch": "1555354242.025714", "responder_bytes": 158, "first_seen_epoch": "1555354242.024466" }, { "bytes": 259, "stream": 56, "flow_id": "flow-685f14102f692033eca05e7a", "packets": 2, "transport": "udp", "last_frame": 3283, "first_frame": 3282, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 54639, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1555354242.027468", "responder_bytes": 169, "first_seen_epoch": "1555354242.027081" }, { "bytes": 316, "stream": 57, "flow_id": "flow-0e0f066648ceb9c3976acf96", "packets": 2, "transport": "udp", "last_frame": 3285, "first_frame": 3284, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49480, "responder_port": 53, "initiator_bytes": 158, "last_seen_epoch": "1555354242.029222", "responder_bytes": 158, "first_seen_epoch": "1555354242.028227" }, { "bytes": 422, "stream": 58, "flow_id": "flow-77acd21ba057e0c6e32c1506", "packets": 2, "transport": "udp", "last_frame": 3288, "first_frame": 3287, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49481, "responder_port": 389, "initiator_bytes": 178, "last_seen_epoch": "1555354242.276437", "responder_bytes": 244, "first_seen_epoch": "1555354242.276005" }, { "bytes": 421, "stream": 59, "flow_id": "flow-296d83ceb4e32bf5a6d80f43", "packets": 2, "transport": "udp", "last_frame": 3290, "first_frame": 3289, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49482, "responder_port": 389, "initiator_bytes": 177, "last_seen_epoch": "1555354242.277573", "responder_bytes": 244, "first_seen_epoch": "1555354242.277229" }, { "bytes": 245, "stream": 60, "flow_id": "flow-18fb58fdbf1ae55889d8afb6", "packets": 2, "transport": "udp", "last_frame": 3293, "first_frame": 3292, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 54547, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1555354242.372458", "responder_bytes": 162, "first_seen_epoch": "1555354242.37215" }, { "bytes": 5469, "stream": 125, "flow_id": "flow-c7de231da17663d74931cb2a", "packets": 13, "transport": "tcp", "last_frame": 3306, "first_frame": 3294, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49277, "responder_port": 389, "initiator_bytes": 2551, "last_seen_epoch": "1555354242.38121", "responder_bytes": 2918, "first_seen_epoch": "1555354242.377891" }, { "bytes": 168, "stream": 61, "flow_id": "flow-828243599c10f5251258a280", "packets": 2, "transport": "udp", "last_frame": 3308, "first_frame": 3307, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 64150, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1555354244.556414", "responder_bytes": 92, "first_seen_epoch": "1555354244.532374" }, { "bytes": 360, "stream": 62, "flow_id": "flow-a0494d286980a75d7daf366a", "packets": 4, "transport": "udp", "last_frame": 3312, "first_frame": 3309, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 65030, "responder_port": 53, "initiator_bytes": 152, "last_seen_epoch": "1555354244.578811", "responder_bytes": 208, "first_seen_epoch": "1555354244.557459" }, { "bytes": 146, "stream": 63, "flow_id": "flow-2182856512319892570b8ae5", "packets": 2, "transport": "udp", "last_frame": 3331, "first_frame": 3315, "initiator_ip": "10.0.90.175", "responder_ip": "224.0.0.252", "initiator_port": 57910, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1555354245.419539", "responder_bytes": 0, "first_seen_epoch": "1555354245.317243" }, { "bytes": 241, "stream": 64, "flow_id": "flow-b99cdef949b0767b2b43627a", "packets": 2, "transport": "udp", "last_frame": 3317, "first_frame": 3316, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 56903, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1555354245.317662", "responder_bytes": 160, "first_seen_epoch": "1555354245.317477" }, { "bytes": 128, "stream": 65, "flow_id": "flow-014d13cce892bd9d0fdf169b", "packets": 2, "transport": "udp", "last_frame": 3330, "first_frame": 3318, "initiator_ip": "10.0.90.175", "responder_ip": "224.0.0.252", "initiator_port": 49882, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1555354245.419433", "responder_bytes": 0, "first_seen_epoch": "1555354245.317909" }, { "bytes": 200, "stream": 66, "flow_id": "flow-9fba9a3d8b625bf8da7a421d", "packets": 2, "transport": "udp", "last_frame": 3320, "first_frame": 3319, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 53640, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1555354245.31835", "responder_bytes": 108, "first_seen_epoch": "1555354245.318201" }, { "bytes": 245, "stream": 67, "flow_id": "flow-7e946b541b0a3261a5addc9f", "packets": 2, "transport": "udp", "last_frame": 3324, "first_frame": 3323, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 59964, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1555354245.320485", "responder_bytes": 162, "first_seen_epoch": "1555354245.320304" }, { "bytes": 6351, "stream": 126, "flow_id": "flow-b7af15d36e9e65bfa783cdf1", "packets": 22, "transport": "tcp", "last_frame": 3371, "first_frame": 3350, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49278, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555354313.29772", "responder_bytes": 1714, "first_seen_epoch": "1555354302.118627" }, { "bytes": 3183, "stream": 127, "flow_id": "flow-e09069061475522f62c92e69", "packets": 20, "transport": "tcp", "last_frame": 3415, "first_frame": 3374, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49279, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555354580.462764", "responder_bytes": 1697, "first_seen_epoch": "1555354460.467147" }, { "bytes": 3167, "stream": 128, "flow_id": "flow-d50aca7216ab80dd8f97f015", "packets": 20, "transport": "tcp", "last_frame": 3412, "first_frame": 3389, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49280, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555354580.462258", "responder_bytes": 1697, "first_seen_epoch": "1555354484.50645" }, { "bytes": 3291, "stream": 129, "flow_id": "flow-4b282d838eb1f0620f63d90b", "packets": 22, "transport": "tcp", "last_frame": 3443, "first_frame": 3420, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49281, "responder_port": 443, "initiator_bytes": 1540, "last_seen_epoch": "1555354904.521495", "responder_bytes": 1751, "first_seen_epoch": "1555354784.516297" }, { "bytes": 3183, "stream": 130, "flow_id": "flow-769b0bbfef5521c9202da1f7", "packets": 20, "transport": "tcp", "last_frame": 3487, "first_frame": 3446, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49282, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555355180.47092", "responder_bytes": 1697, "first_seen_epoch": "1555355060.461156" }, { "bytes": 3199, "stream": 131, "flow_id": "flow-15ab1e87fe76b2e418a9fb48", "packets": 20, "transport": "tcp", "last_frame": 3484, "first_frame": 3461, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49283, "responder_port": 443, "initiator_bytes": 1502, "last_seen_epoch": "1555355180.470309", "responder_bytes": 1697, "first_seen_epoch": "1555355084.515497" }, { "bytes": 6351, "stream": 132, "flow_id": "flow-3d2e2fed62d712d290ac87b0", "packets": 22, "transport": "tcp", "last_frame": 3509, "first_frame": 3488, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49284, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555355213.2935", "responder_bytes": 1714, "first_seen_epoch": "1555355202.140865" }, { "bytes": 3183, "stream": 133, "flow_id": "flow-5b59ed0562dfcb6bc6fe1deb", "packets": 20, "transport": "tcp", "last_frame": 3535, "first_frame": 3514, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49285, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555355504.530997", "responder_bytes": 1697, "first_seen_epoch": "1555355384.534556" }, { "bytes": 3183, "stream": 134, "flow_id": "flow-cfb26747debb15a9e1c1888b", "packets": 20, "transport": "tcp", "last_frame": 3579, "first_frame": 3538, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49286, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555355780.479614", "responder_bytes": 1697, "first_seen_epoch": "1555355660.471557" }, { "bytes": 3183, "stream": 135, "flow_id": "flow-be5fd33f49bee1e5804a8f6e", "packets": 20, "transport": "tcp", "last_frame": 3576, "first_frame": 3553, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49287, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555355780.479205", "responder_bytes": 1697, "first_seen_epoch": "1555355684.524657" }, { "bytes": 3183, "stream": 136, "flow_id": "flow-20af2048bbda65c411c36789", "packets": 20, "transport": "tcp", "last_frame": 3622, "first_frame": 3584, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49288, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555356104.540469", "responder_bytes": 1697, "first_seen_epoch": "1555355984.530761" }, { "bytes": 6351, "stream": 137, "flow_id": "flow-d0242135ab475c2029599e68", "packets": 22, "transport": "tcp", "last_frame": 3627, "first_frame": 3603, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49289, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555356113.306787", "responder_bytes": 1714, "first_seen_epoch": "1555356102.162434" }, { "bytes": 3183, "stream": 138, "flow_id": "flow-1e4b695c81d4c0243cbd6d2b", "packets": 20, "transport": "tcp", "last_frame": 3673, "first_frame": 3630, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49290, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555356380.488092", "responder_bytes": 1697, "first_seen_epoch": "1555356260.491821" }, { "bytes": 3183, "stream": 139, "flow_id": "flow-5e1197da9ff25400e74e8856", "packets": 20, "transport": "tcp", "last_frame": 3670, "first_frame": 3645, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49291, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555356380.487321", "responder_bytes": 1697, "first_seen_epoch": "1555356284.533399" }, { "bytes": 3183, "stream": 140, "flow_id": "flow-cf6726ff82a431df894f0d0a", "packets": 20, "transport": "tcp", "last_frame": 3699, "first_frame": 3678, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49292, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555356704.546721", "responder_bytes": 1697, "first_seen_epoch": "1555356584.538394" }, { "bytes": 3129, "stream": 141, "flow_id": "flow-23d478b82494f9dec92a23eb", "packets": 19, "transport": "tcp", "last_frame": 3742, "first_frame": 3702, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49293, "responder_port": 443, "initiator_bytes": 1432, "last_seen_epoch": "1555356980.496498", "responder_bytes": 1697, "first_seen_epoch": "1555356860.486842" }, { "bytes": 3183, "stream": 142, "flow_id": "flow-01b1b8fa220c4b4b16011b92", "packets": 20, "transport": "tcp", "last_frame": 3740, "first_frame": 3717, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49294, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555356980.495805", "responder_bytes": 1697, "first_seen_epoch": "1555356884.542633" }, { "bytes": 6351, "stream": 143, "flow_id": "flow-ac9f0bf53b70832c72dc6fce", "packets": 22, "transport": "tcp", "last_frame": 3764, "first_frame": 3743, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49295, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555357013.303149", "responder_bytes": 1714, "first_seen_epoch": "1555357002.19478" }, { "bytes": 3167, "stream": 144, "flow_id": "flow-5bdc8be290f6d125794f9a21", "packets": 20, "transport": "tcp", "last_frame": 3790, "first_frame": 3769, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49296, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555357304.555151", "responder_bytes": 1697, "first_seen_epoch": "1555357184.559316" }, { "bytes": 3183, "stream": 145, "flow_id": "flow-32d7238045f738f81b2dfe6c", "packets": 20, "transport": "tcp", "last_frame": 3834, "first_frame": 3793, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49297, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555357580.504624", "responder_bytes": 1697, "first_seen_epoch": "1555357460.496603" }, { "bytes": 3199, "stream": 146, "flow_id": "flow-21a8d36747a3e5519f232881", "packets": 20, "transport": "tcp", "last_frame": 3831, "first_frame": 3808, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49298, "responder_port": 443, "initiator_bytes": 1502, "last_seen_epoch": "1555357580.503864", "responder_bytes": 1697, "first_seen_epoch": "1555357484.54997" }, { "bytes": 3183, "stream": 147, "flow_id": "flow-9e515671fe508489747d5a1f", "packets": 20, "transport": "tcp", "last_frame": 3879, "first_frame": 3839, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49299, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555357904.564234", "responder_bytes": 1697, "first_seen_epoch": "1555357784.55544" }, { "bytes": 200, "stream": 68, "flow_id": "flow-3e5670f55b6b4b8910b52710", "packets": 2, "transport": "udp", "last_frame": 3859, "first_frame": 3858, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 58439, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1555357902.21702", "responder_bytes": 108, "first_seen_epoch": "1555357902.216762" }, { "bytes": 6351, "stream": 148, "flow_id": "flow-76d483745233532f8e19a904", "packets": 22, "transport": "tcp", "last_frame": 3884, "first_frame": 3860, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49300, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555357913.301226", "responder_bytes": 1714, "first_seen_epoch": "1555357902.219716" }, { "bytes": 501, "stream": 69, "flow_id": "flow-fa8d175f7bfc2fd0f953ef6a", "packets": 2, "transport": "udp", "last_frame": 3886, "first_frame": 3885, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 58440, "responder_port": 389, "initiator_bytes": 257, "last_seen_epoch": "1555357995.329697", "responder_bytes": 244, "first_seen_epoch": "1555357995.329002" }, { "bytes": 1878, "stream": 149, "flow_id": "flow-feefbcf410ae42044e464453", "packets": 15, "transport": "tcp", "last_frame": 3995, "first_frame": 3887, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49301, "responder_port": 135, "initiator_bytes": 994, "last_seen_epoch": "1555358007.33809", "responder_bytes": 884, "first_seen_epoch": "1555357995.43467" }, { "bytes": 3084, "stream": 150, "flow_id": "flow-217a249e1a9e2f20744f8f1e", "packets": 12, "transport": "tcp", "last_frame": 3994, "first_frame": 3894, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49302, "responder_port": 49158, "initiator_bytes": 1658, "last_seen_epoch": "1555358007.33788", "responder_bytes": 1426, "first_seen_epoch": "1555357995.437704" }, { "bytes": 458, "stream": 70, "flow_id": "flow-3217802b0375622df3f79d7d", "packets": 2, "transport": "udp", "last_frame": 3904, "first_frame": 3903, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 58441, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1555357995.731373", "responder_bytes": 244, "first_seen_epoch": "1555357995.73094" }, { "bytes": 4994, "stream": 151, "flow_id": "flow-929a314b165618cee77e34e0", "packets": 20, "transport": "tcp", "last_frame": 4005, "first_frame": 3907, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49303, "responder_port": 49155, "initiator_bytes": 3383, "last_seen_epoch": "1555358027.334686", "responder_bytes": 1611, "first_seen_epoch": "1555357995.840457" }, { "bytes": 347, "stream": 71, "flow_id": "flow-c7f10c4b3237dcb65f9cc34e", "packets": 2, "transport": "udp", "last_frame": 3923, "first_frame": 3922, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 60962, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1555357995.951273", "responder_bytes": 213, "first_seen_epoch": "1555357995.950976" }, { "bytes": 285, "stream": 72, "flow_id": "flow-7c49b9fc2ca1a353c80c953d", "packets": 2, "transport": "udp", "last_frame": 3925, "first_frame": 3924, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 60322, "responder_port": 53, "initiator_bytes": 103, "last_seen_epoch": "1555357995.95238", "responder_bytes": 182, "first_seen_epoch": "1555357995.952142" }, { "bytes": 8138, "stream": 152, "flow_id": "flow-cb8051812e6f30ad7ded91bd", "packets": 18, "transport": "tcp", "last_frame": 3985, "first_frame": 3926, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49304, "responder_port": 389, "initiator_bytes": 3378, "last_seen_epoch": "1555357996.607026", "responder_bytes": 4760, "first_seen_epoch": "1555357995.954305" }, { "bytes": 457, "stream": 73, "flow_id": "flow-20a1265581d33b9dcfaf914c", "packets": 2, "transport": "udp", "last_frame": 3940, "first_frame": 3939, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 60323, "responder_port": 389, "initiator_bytes": 213, "last_seen_epoch": "1555357995.963098", "responder_bytes": 244, "first_seen_epoch": "1555357995.96283" }, { "bytes": 3431, "stream": 153, "flow_id": "flow-b34586afac6a22d5367d8dd7", "packets": 13, "transport": "tcp", "last_frame": 3981, "first_frame": 3943, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49305, "responder_port": 389, "initiator_bytes": 2575, "last_seen_epoch": "1555357996.091452", "responder_bytes": 856, "first_seen_epoch": "1555357996.071873" }, { "bytes": 9306, "stream": 154, "flow_id": "flow-6bf1614ca22a4c892a23df03", "packets": 36, "transport": "tcp", "last_frame": 4010, "first_frame": 3956, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49306, "responder_port": 445, "initiator_bytes": 6168, "last_seen_epoch": "1555358033.296345", "responder_bytes": 3138, "first_seen_epoch": "1555357996.081734" }, { "bytes": 3129, "stream": 155, "flow_id": "flow-4968c1768c23e4a028fa0202", "packets": 19, "transport": "tcp", "last_frame": 4051, "first_frame": 4011, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49307, "responder_port": 443, "initiator_bytes": 1432, "last_seen_epoch": "1555358180.512285", "responder_bytes": 1697, "first_seen_epoch": "1555358060.517408" }, { "bytes": 3183, "stream": 156, "flow_id": "flow-a6e1c779169e14e8d8570c21", "packets": 20, "transport": "tcp", "last_frame": 4049, "first_frame": 4026, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49308, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555358180.511934", "responder_bytes": 1697, "first_seen_epoch": "1555358084.55784" }, { "bytes": 3129, "stream": 157, "flow_id": "flow-b11379531c2b498110155b66", "packets": 19, "transport": "tcp", "last_frame": 4078, "first_frame": 4058, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49309, "responder_port": 443, "initiator_bytes": 1432, "last_seen_epoch": "1555358504.573628", "responder_bytes": 1697, "first_seen_epoch": "1555358384.563684" }, { "bytes": 3275, "stream": 158, "flow_id": "flow-903fc47b5365530247d74822", "packets": 22, "transport": "tcp", "last_frame": 4124, "first_frame": 4081, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49310, "responder_port": 443, "initiator_bytes": 1524, "last_seen_epoch": "1555358780.521163", "responder_bytes": 1751, "first_seen_epoch": "1555358660.513457" }, { "bytes": 3183, "stream": 159, "flow_id": "flow-0933c7f640a8c47cd087d7b7", "packets": 20, "transport": "tcp", "last_frame": 4121, "first_frame": 4096, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49311, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555358780.520526", "responder_bytes": 1697, "first_seen_epoch": "1555358684.56553" }, { "bytes": 6351, "stream": 160, "flow_id": "flow-44a6656b545ad506bd85d977", "packets": 22, "transport": "tcp", "last_frame": 4146, "first_frame": 4125, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49312, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555358813.298466", "responder_bytes": 1714, "first_seen_epoch": "1555358802.247526" }, { "bytes": 3167, "stream": 161, "flow_id": "flow-5c593518c9d273536915b2f9", "packets": 20, "transport": "tcp", "last_frame": 4172, "first_frame": 4151, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49313, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555359104.579155", "responder_bytes": 1697, "first_seen_epoch": "1555358984.584445" }, { "bytes": 3167, "stream": 162, "flow_id": "flow-b4566359dbca731345815482", "packets": 20, "transport": "tcp", "last_frame": 4218, "first_frame": 4175, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49314, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555359380.53123", "responder_bytes": 1697, "first_seen_epoch": "1555359260.519247" }, { "bytes": 3291, "stream": 163, "flow_id": "flow-4c66745a9ac3816384bbd4d0", "packets": 22, "transport": "tcp", "last_frame": 4215, "first_frame": 4190, "initiator_ip": "10.0.90.175", "responder_ip": "185.136.169.160", "initiator_port": 49315, "responder_port": 443, "initiator_bytes": 1540, "last_seen_epoch": "1555359380.530699", "responder_bytes": 1751, "first_seen_epoch": "1555359284.573529" }, { "bytes": 1280, "stream": 164, "flow_id": "flow-a2b5694ee873c7afb11a9590", "packets": 12, "transport": "tcp", "last_frame": 4337, "first_frame": 4221, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49316, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1555359564.311952", "responder_bytes": 562, "first_seen_epoch": "1555359552.309171" }, { "bytes": 4974, "stream": 165, "flow_id": "flow-c6c9600ffabebbc990d9e979", "packets": 20, "transport": "tcp", "last_frame": 4344, "first_frame": 4228, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49317, "responder_port": 49155, "initiator_bytes": 3363, "last_seen_epoch": "1555359584.311266", "responder_bytes": 1611, "first_seen_epoch": "1555359552.311714" }, { "bytes": 347, "stream": 74, "flow_id": "flow-03b3c4b0263f9a96f8b9c6a3", "packets": 2, "transport": "udp", "last_frame": 4246, "first_frame": 4245, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 63637, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1555359552.818954", "responder_bytes": 213, "first_seen_epoch": "1555359552.818613" }, { "bytes": 285, "stream": 75, "flow_id": "flow-9d28a0faf19ffbf4ffa88661", "packets": 2, "transport": "udp", "last_frame": 4248, "first_frame": 4247, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 52092, "responder_port": 53, "initiator_bytes": 103, "last_seen_epoch": "1555359552.819739", "responder_bytes": 182, "first_seen_epoch": "1555359552.819516" }, { "bytes": 8112, "stream": 166, "flow_id": "flow-4fdf1e01f6d133ab08badd1f", "packets": 18, "transport": "tcp", "last_frame": 4328, "first_frame": 4249, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49318, "responder_port": 389, "initiator_bytes": 3352, "last_seen_epoch": "1555359553.456782", "responder_bytes": 4760, "first_seen_epoch": "1555359552.82162" }, { "bytes": 501, "stream": 76, "flow_id": "flow-11513698d2739f13348f1a23", "packets": 2, "transport": "udp", "last_frame": 4261, "first_frame": 4260, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 52093, "responder_port": 389, "initiator_bytes": 257, "last_seen_epoch": "1555359552.829192", "responder_bytes": 244, "first_seen_epoch": "1555359552.828885" }, { "bytes": 3387, "stream": 167, "flow_id": "flow-efdc3d3d137ab2d29fc955ba", "packets": 13, "transport": "tcp", "last_frame": 4324, "first_frame": 4264, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49319, "responder_port": 389, "initiator_bytes": 2531, "last_seen_epoch": "1555359552.950107", "responder_bytes": 856, "first_seen_epoch": "1555359552.932527" }, { "bytes": 3650, "stream": 168, "flow_id": "flow-27b86e42bbdab80ef043147b", "packets": 12, "transport": "tcp", "last_frame": 4288, "first_frame": 4277, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49320, "responder_port": 88, "initiator_bytes": 1813, "last_seen_epoch": "1555359552.940251", "responder_bytes": 1837, "first_seen_epoch": "1555359552.938554" }, { "bytes": 3313, "stream": 169, "flow_id": "flow-5a0319a047bdb1f6f27d0957", "packets": 10, "transport": "tcp", "last_frame": 4304, "first_frame": 4289, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49321, "responder_port": 88, "initiator_bytes": 2887, "last_seen_epoch": "1555359552.941679", "responder_bytes": 426, "first_seen_epoch": "1555359552.940309" }, { "bytes": 9266, "stream": 170, "flow_id": "flow-d827d7271fb28408e51c2906", "packets": 36, "transport": "tcp", "last_frame": 4357, "first_frame": 4291, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49322, "responder_port": 445, "initiator_bytes": 6128, "last_seen_epoch": "1555359587.292408", "responder_bytes": 3138, "first_seen_epoch": "1555359552.940452" }, { "bytes": 162, "stream": 77, "flow_id": "flow-951cbd1d93a967238d1ed07a", "packets": 2, "transport": "udp", "last_frame": 4346, "first_frame": 4345, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 57906, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1555359584.630094", "responder_bytes": 89, "first_seen_epoch": "1555359584.579046" }, { "bytes": 120, "stream": 171, "flow_id": "flow-92ae11dc8cf641c495304c8b", "packets": 2, "transport": "tcp", "last_frame": 4348, "first_frame": 4347, "initiator_ip": "10.0.90.175", "responder_ip": "208.91.197.91", "initiator_port": 49323, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1555359584.663329", "responder_bytes": 54, "first_seen_epoch": "1555359584.631482" }, { "bytes": 120, "stream": 172, "flow_id": "flow-269491030c9fff8a04a1390d", "packets": 2, "transport": "tcp", "last_frame": 4350, "first_frame": 4349, "initiator_ip": "10.0.90.175", "responder_ip": "208.91.197.91", "initiator_port": 49323, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1555359585.215729", "responder_bytes": 54, "first_seen_epoch": "1555359585.169729" }, { "bytes": 116, "stream": 173, "flow_id": "flow-c2165d1d7ae0075da78dcb1c", "packets": 2, "transport": "tcp", "last_frame": 4352, "first_frame": 4351, "initiator_ip": "10.0.90.175", "responder_ip": "208.91.197.91", "initiator_port": 49323, "responder_port": 443, "initiator_bytes": 62, "last_seen_epoch": "1555359585.765389", "responder_bytes": 54, "first_seen_epoch": "1555359585.73015" }, { "bytes": 168, "stream": 78, "flow_id": "flow-36b464911dfd64508cc2925a", "packets": 2, "transport": "udp", "last_frame": 4359, "first_frame": 4358, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 60407, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1555359604.55742", "responder_bytes": 92, "first_seen_epoch": "1555359604.529776" }, { "bytes": 180, "stream": 79, "flow_id": "flow-fac8acb3c6d4e1b4d34505b3", "packets": 2, "transport": "udp", "last_frame": 4361, "first_frame": 4360, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 51572, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1555359604.579475", "responder_bytes": 104, "first_seen_epoch": "1555359604.557969" }, { "bytes": 6351, "stream": 174, "flow_id": "flow-9fcbba1144b051ac761f4458", "packets": 22, "transport": "tcp", "last_frame": 4385, "first_frame": 4364, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49324, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555359713.294082", "responder_bytes": 1714, "first_seen_epoch": "1555359702.274282" }, { "bytes": 3151, "stream": 175, "flow_id": "flow-3981f2199e63b1121549aed2", "packets": 20, "transport": "tcp", "last_frame": 4429, "first_frame": 4388, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49325, "responder_port": 443, "initiator_bytes": 1454, "last_seen_epoch": "1555359980.537224", "responder_bytes": 1697, "first_seen_epoch": "1555359860.543153" }, { "bytes": 3183, "stream": 176, "flow_id": "flow-44f9026a8022dc1de42dfe97", "packets": 20, "transport": "tcp", "last_frame": 4426, "first_frame": 4403, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49326, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555359980.536652", "responder_bytes": 1697, "first_seen_epoch": "1555359884.581619" }, { "bytes": 3275, "stream": 177, "flow_id": "flow-307d63b0e8f7dc5c10014e11", "packets": 22, "transport": "tcp", "last_frame": 4457, "first_frame": 4434, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49327, "responder_port": 443, "initiator_bytes": 1524, "last_seen_epoch": "1555360304.597726", "responder_bytes": 1751, "first_seen_epoch": "1555360184.588977" }, { "bytes": 3183, "stream": 178, "flow_id": "flow-0e4d10587d45804e8e54fbea", "packets": 20, "transport": "tcp", "last_frame": 4503, "first_frame": 4462, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49328, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555360580.545015", "responder_bytes": 1697, "first_seen_epoch": "1555360460.539156" }, { "bytes": 3183, "stream": 179, "flow_id": "flow-b426350979d26f50a301c96f", "packets": 20, "transport": "tcp", "last_frame": 4500, "first_frame": 4477, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49329, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555360580.544489", "responder_bytes": 1697, "first_seen_epoch": "1555360484.590804" }, { "bytes": 6351, "stream": 180, "flow_id": "flow-5394f0c38b6df277051b2839", "packets": 22, "transport": "tcp", "last_frame": 4525, "first_frame": 4504, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49330, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555360613.305077", "responder_bytes": 1714, "first_seen_epoch": "1555360602.30568" }, { "bytes": 3291, "stream": 181, "flow_id": "flow-da511bae705e6990a67148bf", "packets": 22, "transport": "tcp", "last_frame": 4553, "first_frame": 4530, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49331, "responder_port": 443, "initiator_bytes": 1540, "last_seen_epoch": "1555360904.604074", "responder_bytes": 1751, "first_seen_epoch": "1555360784.609021" }, { "bytes": 3183, "stream": 182, "flow_id": "flow-1098dac245fda907a517fc57", "packets": 20, "transport": "tcp", "last_frame": 4596, "first_frame": 4556, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49332, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555361180.553382", "responder_bytes": 1697, "first_seen_epoch": "1555361060.544211" }, { "bytes": 3129, "stream": 183, "flow_id": "flow-bedf5aa6b02b55a2e263519c", "packets": 19, "transport": "tcp", "last_frame": 4593, "first_frame": 4571, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49333, "responder_port": 443, "initiator_bytes": 1432, "last_seen_epoch": "1555361180.552806", "responder_bytes": 1697, "first_seen_epoch": "1555361084.598233" }, { "bytes": 3291, "stream": 184, "flow_id": "flow-3b6784f919cc9d9a2d385475", "packets": 22, "transport": "tcp", "last_frame": 4643, "first_frame": 4601, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49334, "responder_port": 443, "initiator_bytes": 1540, "last_seen_epoch": "1555361504.612181", "responder_bytes": 1751, "first_seen_epoch": "1555361384.605269" }, { "bytes": 200, "stream": 80, "flow_id": "flow-5c4b4d0554e2d19d2c405165", "packets": 2, "transport": "udp", "last_frame": 4623, "first_frame": 4622, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 58900, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1555361502.329738", "responder_bytes": 108, "first_seen_epoch": "1555361502.329425" }, { "bytes": 6351, "stream": 185, "flow_id": "flow-17a90208078ed57574777ad7", "packets": 22, "transport": "tcp", "last_frame": 4648, "first_frame": 4624, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49335, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555361513.301481", "responder_bytes": 1714, "first_seen_epoch": "1555361502.332532" }, { "bytes": 3183, "stream": 186, "flow_id": "flow-90d5f22db57a28cd00160594", "packets": 20, "transport": "tcp", "last_frame": 4691, "first_frame": 4651, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49336, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555361780.561532", "responder_bytes": 1697, "first_seen_epoch": "1555361660.569156" }, { "bytes": 3129, "stream": 187, "flow_id": "flow-d40b12cda2f6954dfd16fcbf", "packets": 19, "transport": "tcp", "last_frame": 4688, "first_frame": 4666, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49337, "responder_port": 443, "initiator_bytes": 1432, "last_seen_epoch": "1555361780.560913", "responder_bytes": 1697, "first_seen_epoch": "1555361684.607586" }, { "bytes": 3183, "stream": 188, "flow_id": "flow-419eaa3feb0e25080a3dc2fe", "packets": 20, "transport": "tcp", "last_frame": 4717, "first_frame": 4696, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49338, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555362104.620227", "responder_bytes": 1697, "first_seen_epoch": "1555361984.615377" }, { "bytes": 3167, "stream": 189, "flow_id": "flow-cccf0c85826b7cd2eb0f49cc", "packets": 20, "transport": "tcp", "last_frame": 4762, "first_frame": 4720, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49339, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555362380.570831", "responder_bytes": 1697, "first_seen_epoch": "1555362260.562547" }, { "bytes": 3221, "stream": 190, "flow_id": "flow-37acc374194fd422a301e80a", "packets": 21, "transport": "tcp", "last_frame": 4759, "first_frame": 4735, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49340, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555362380.570319", "responder_bytes": 1751, "first_seen_epoch": "1555362284.615701" }, { "bytes": 6351, "stream": 191, "flow_id": "flow-2798061d1b1714a18c41a5e6", "packets": 22, "transport": "tcp", "last_frame": 4784, "first_frame": 4763, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49341, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555362413.300948", "responder_bytes": 1714, "first_seen_epoch": "1555362402.363212" }, { "bytes": 3221, "stream": 192, "flow_id": "flow-cab2910697a8473226a94d8a", "packets": 21, "transport": "tcp", "last_frame": 4813, "first_frame": 4791, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49342, "responder_port": 443, "initiator_bytes": 1470, "last_seen_epoch": "1555362704.629141", "responder_bytes": 1751, "first_seen_epoch": "1555362584.634683" }, { "bytes": 3183, "stream": 193, "flow_id": "flow-3e7d0d7ec8ffeaa3d2ec6753", "packets": 20, "transport": "tcp", "last_frame": 4857, "first_frame": 4816, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49343, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555362980.580325", "responder_bytes": 1697, "first_seen_epoch": "1555362860.571201" }, { "bytes": 3183, "stream": 194, "flow_id": "flow-5e046be7e56749c9a073d5c8", "packets": 20, "transport": "tcp", "last_frame": 4854, "first_frame": 4831, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49344, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555362980.579958", "responder_bytes": 1697, "first_seen_epoch": "1555362884.62522" }, { "bytes": 3327, "stream": 195, "flow_id": "flow-93b8e7518fb3f63ea4c743ca", "packets": 20, "transport": "tcp", "last_frame": 4911, "first_frame": 4862, "initiator_ip": "10.0.90.175", "responder_ip": "185.212.47.167", "initiator_port": 49345, "responder_port": 443, "initiator_bytes": 1486, "last_seen_epoch": "1555363304.638531", "responder_bytes": 1841, "first_seen_epoch": "1555363184.630428" }, { "bytes": 1690, "stream": 196, "flow_id": "flow-4356a3af3248157f0d9f6fb9", "packets": 11, "transport": "tcp", "last_frame": 4908, "first_frame": 4877, "initiator_ip": "10.0.90.175", "responder_ip": "89.163.144.224", "initiator_port": 49346, "responder_port": 80, "initiator_bytes": 544, "last_seen_epoch": "1555363304.637931", "responder_bytes": 1146, "first_seen_epoch": "1555363185.655082" }, { "bytes": 6351, "stream": 197, "flow_id": "flow-78f86cb959c34bb2905c002f", "packets": 22, "transport": "tcp", "last_frame": 4916, "first_frame": 4890, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49347, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555363313.296284", "responder_bytes": 1714, "first_seen_epoch": "1555363302.388864" }, { "bytes": 162, "stream": 81, "flow_id": "flow-d9f844edf5476b7a8fb98743", "packets": 2, "transport": "udp", "last_frame": 4920, "first_frame": 4919, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 63136, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1555363460.619298", "responder_bytes": 89, "first_seen_epoch": "1555363460.580569" }, { "bytes": 14351, "stream": 198, "flow_id": "flow-2f0a2af3b6ec565c7f668e1c", "packets": 27, "transport": "tcp", "last_frame": 9956, "first_frame": 4921, "initiator_ip": "10.0.90.175", "responder_ip": "185.158.249.39", "initiator_port": 49348, "responder_port": 443, "initiator_bytes": 1476, "last_seen_epoch": "1555363580.586356", "responder_bytes": 12875, "first_seen_epoch": "1555363460.62033" }, { "bytes": 3365, "stream": 199, "flow_id": "flow-dbe7e831896014ce774de372", "packets": 20, "transport": "tcp", "last_frame": 9953, "first_frame": 4943, "initiator_ip": "10.0.90.175", "responder_ip": "185.158.249.39", "initiator_port": 49349, "responder_port": 443, "initiator_bytes": 1556, "last_seen_epoch": "1555363580.585797", "responder_bytes": 1809, "first_seen_epoch": "1555363484.63415" }, { "bytes": 448303, "stream": 200, "flow_id": "flow-30288e140415a1e389a68d8b", "packets": 413, "transport": "tcp", "last_frame": 9950, "first_frame": 4958, "initiator_ip": "10.0.90.175", "responder_ip": "162.213.250.131", "initiator_port": 49350, "responder_port": 80, "initiator_bytes": 6288, "last_seen_epoch": "1555363580.585156", "responder_bytes": 442015, "first_seen_epoch": "1555363492.881919" }, { "bytes": 241, "stream": 82, "flow_id": "flow-a60dc803662580cf6e7a7cd3", "packets": 2, "transport": "udp", "last_frame": 5370, "first_frame": 5369, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 53010, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1555363518.814081", "responder_bytes": 160, "first_seen_epoch": "1555363518.813733" }, { "bytes": 227, "stream": 83, "flow_id": "flow-12a9ab889130f972edfd9d71", "packets": 2, "transport": "udp", "last_frame": 5375, "first_frame": 5371, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 62852, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1555363518.842569", "responder_bytes": 151, "first_seen_epoch": "1555363518.814523" }, { "bytes": 4720549, "stream": 201, "flow_id": "flow-fb2921bb56fc11f62ebece1b", "packets": 4431, "transport": "tcp", "last_frame": 9836, "first_frame": 5374, "initiator_ip": "10.0.90.175", "responder_ip": "85.114.134.49", "initiator_port": 49351, "responder_port": 80, "initiator_bytes": 78466, "last_seen_epoch": "1555363524.563172", "responder_bytes": 4642083, "first_seen_epoch": "1555363518.828676" }, { "bytes": 128, "stream": 84, "flow_id": "flow-a831cfd3d4fc2760f1b4badb", "packets": 2, "transport": "udp", "last_frame": 5377, "first_frame": 5376, "initiator_ip": "10.0.90.175", "responder_ip": "224.0.0.252", "initiator_port": 64205, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1555363518.948865", "responder_bytes": 0, "first_seen_epoch": "1555363518.842947" }, { "bytes": 458, "stream": 85, "flow_id": "flow-0a788bd9b5e9a0129246e5d5", "packets": 2, "transport": "udp", "last_frame": 9797, "first_frame": 9796, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 64206, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1555363523.63476", "responder_bytes": 244, "first_seen_epoch": "1555363523.634474" }, { "bytes": 1280, "stream": 202, "flow_id": "flow-38565a2f67a0bdadf3b0b827", "packets": 12, "transport": "tcp", "last_frame": 9842, "first_frame": 9798, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49352, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1555363535.487689", "responder_bytes": 562, "first_seen_epoch": "1555363523.740022" }, { "bytes": 4914, "stream": 203, "flow_id": "flow-af7db98c69b51bf3a7ffcf52", "packets": 20, "transport": "tcp", "last_frame": 9846, "first_frame": 9805, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49353, "responder_port": 49155, "initiator_bytes": 3383, "last_seen_epoch": "1555363555.486406", "responder_bytes": 1531, "first_seen_epoch": "1555363523.742121" }, { "bytes": 501, "stream": 86, "flow_id": "flow-3a4a2df97d522c3af573bf89", "packets": 2, "transport": "udp", "last_frame": 9852, "first_frame": 9851, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 64207, "responder_port": 389, "initiator_bytes": 257, "last_seen_epoch": "1555363576.611572", "responder_bytes": 244, "first_seen_epoch": "1555363576.61108" }, { "bytes": 1824, "stream": 204, "flow_id": "flow-d1e9e4dce7f97241a585d080", "packets": 14, "transport": "tcp", "last_frame": 9964, "first_frame": 9853, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49354, "responder_port": 135, "initiator_bytes": 940, "last_seen_epoch": "1555363588.621531", "responder_bytes": 884, "first_seen_epoch": "1555363576.613246" }, { "bytes": 4994, "stream": 205, "flow_id": "flow-3d79bebdfa338ae6fe8ca972", "packets": 20, "transport": "tcp", "last_frame": 9974, "first_frame": 9860, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49355, "responder_port": 49155, "initiator_bytes": 3383, "last_seen_epoch": "1555363608.619975", "responder_bytes": 1611, "first_seen_epoch": "1555363576.615266" }, { "bytes": 3084, "stream": 206, "flow_id": "flow-7eadd01a78724b80b1409be0", "packets": 12, "transport": "tcp", "last_frame": 9963, "first_frame": 9877, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49356, "responder_port": 49158, "initiator_bytes": 1658, "last_seen_epoch": "1555363588.62143", "responder_bytes": 1426, "first_seen_epoch": "1555363576.72037" }, { "bytes": 347, "stream": 87, "flow_id": "flow-713d9b4c4ef6e5928505854a", "packets": 2, "transport": "udp", "last_frame": 9888, "first_frame": 9887, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49998, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1555363577.234249", "responder_bytes": 213, "first_seen_epoch": "1555363577.233966" }, { "bytes": 285, "stream": 88, "flow_id": "flow-5ad7fedb7f496b6e12ddc556", "packets": 2, "transport": "udp", "last_frame": 9890, "first_frame": 9889, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 64911, "responder_port": 53, "initiator_bytes": 103, "last_seen_epoch": "1555363577.234859", "responder_bytes": 182, "first_seen_epoch": "1555363577.234678" }, { "bytes": 8138, "stream": 207, "flow_id": "flow-da4e79c19aa01180c1562028", "packets": 18, "transport": "tcp", "last_frame": 9948, "first_frame": 9891, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49357, "responder_port": 389, "initiator_bytes": 3378, "last_seen_epoch": "1555363577.876772", "responder_bytes": 4760, "first_seen_epoch": "1555363577.236499" }, { "bytes": 457, "stream": 89, "flow_id": "flow-4f5dc371f3b0576cab675728", "packets": 2, "transport": "udp", "last_frame": 9905, "first_frame": 9904, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 64912, "responder_port": 389, "initiator_bytes": 213, "last_seen_epoch": "1555363577.243397", "responder_bytes": 244, "first_seen_epoch": "1555363577.243179" }, { "bytes": 3431, "stream": 208, "flow_id": "flow-5b7d432b0909e3b02325bd4f", "packets": 13, "transport": "tcp", "last_frame": 9944, "first_frame": 9906, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49358, "responder_port": 389, "initiator_bytes": 2575, "last_seen_epoch": "1555363577.360508", "responder_bytes": 856, "first_seen_epoch": "1555363577.342623" }, { "bytes": 9306, "stream": 209, "flow_id": "flow-8e31a9873dc9aaeec90e1feb", "packets": 36, "transport": "tcp", "last_frame": 9979, "first_frame": 9919, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49359, "responder_port": 445, "initiator_bytes": 6168, "last_seen_epoch": "1555363613.30112", "responder_bytes": 3138, "first_seen_epoch": "1555363577.352273" }, { "bytes": 3333, "stream": 210, "flow_id": "flow-3025166618925f2a424bc30b", "packets": 20, "transport": "tcp", "last_frame": 10019, "first_frame": 9984, "initiator_ip": "10.0.90.175", "responder_ip": "185.158.249.39", "initiator_port": 49360, "responder_port": 443, "initiator_bytes": 1556, "last_seen_epoch": "1555363904.644625", "responder_bytes": 1777, "first_seen_epoch": "1555363784.639173" }, { "bytes": 2983, "stream": 211, "flow_id": "flow-d2a376a40b0a80eb5411ef0b", "packets": 14, "transport": "tcp", "last_frame": 10016, "first_frame": 9999, "initiator_ip": "10.0.90.175", "responder_ip": "185.158.249.39", "initiator_port": 49361, "responder_port": 443, "initiator_bytes": 1842, "last_seen_epoch": "1555363890.574181", "responder_bytes": 1141, "first_seen_epoch": "1555363830.563322" }, { "bytes": 7231, "stream": 212, "flow_id": "flow-97d4ad351961e1f5874f3c74", "packets": 23, "transport": "tcp", "last_frame": 10044, "first_frame": 10022, "initiator_ip": "10.0.90.175", "responder_ip": "198.54.125.57", "initiator_port": 49362, "responder_port": 443, "initiator_bytes": 1390, "last_seen_epoch": "1555364060.874781", "responder_bytes": 5841, "first_seen_epoch": "1555364060.598327" }, { "bytes": 158, "stream": 90, "flow_id": "flow-a7b36c163450c14f1aa8f799", "packets": 2, "transport": "udp", "last_frame": 10046, "first_frame": 10045, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 56060, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1555364084.673017", "responder_bytes": 87, "first_seen_epoch": "1555364084.642498" }, { "bytes": 3219, "stream": 213, "flow_id": "flow-a13c87d2263836404652eb11", "packets": 20, "transport": "tcp", "last_frame": 10083, "first_frame": 10047, "initiator_ip": "10.0.90.175", "responder_ip": "109.230.199.24", "initiator_port": 49363, "responder_port": 443, "initiator_bytes": 1522, "last_seen_epoch": "1555364172.107573", "responder_bytes": 1697, "first_seen_epoch": "1555364084.673959" }, { "bytes": 3587, "stream": 214, "flow_id": "flow-938990afcec6054d764e44d0", "packets": 20, "transport": "tcp", "last_frame": 10112, "first_frame": 10062, "initiator_ip": "10.0.90.175", "responder_ip": "109.230.199.24", "initiator_port": 49364, "responder_port": 443, "initiator_bytes": 1986, "last_seen_epoch": "1555364290.590368", "responder_bytes": 1601, "first_seen_epoch": "1555364111.564066" }, { "bytes": 6351, "stream": 215, "flow_id": "flow-ef884f08dcd906da2a905980", "packets": 22, "transport": "tcp", "last_frame": 10105, "first_frame": 10084, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49365, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555364213.292561", "responder_bytes": 1714, "first_seen_epoch": "1555364202.413688" }, { "bytes": 3203, "stream": 216, "flow_id": "flow-199892a21cc9e1f9defb160f", "packets": 20, "transport": "tcp", "last_frame": 10138, "first_frame": 10115, "initiator_ip": "10.0.90.175", "responder_ip": "109.230.199.24", "initiator_port": 49366, "responder_port": 443, "initiator_bytes": 1506, "last_seen_epoch": "1555364504.654642", "responder_bytes": 1697, "first_seen_epoch": "1555364384.644224" }, { "bytes": 3187, "stream": 217, "flow_id": "flow-7d3bd491237d161d16a37a4f", "packets": 20, "transport": "tcp", "last_frame": 10176, "first_frame": 10141, "initiator_ip": "10.0.90.175", "responder_ip": "109.230.199.24", "initiator_port": 49367, "responder_port": 443, "initiator_bytes": 1490, "last_seen_epoch": "1555364780.603587", "responder_bytes": 1697, "first_seen_epoch": "1555364660.592943" }, { "bytes": 2469, "stream": 218, "flow_id": "flow-f32980cf85543c95dbe376bc", "packets": 14, "transport": "tcp", "last_frame": 10171, "first_frame": 10156, "initiator_ip": "10.0.90.175", "responder_ip": "109.230.199.24", "initiator_port": 49368, "responder_port": 443, "initiator_bytes": 1328, "last_seen_epoch": "1555364758.995542", "responder_bytes": 1141, "first_seen_epoch": "1555364698.9862" }, { "bytes": 7161, "stream": 219, "flow_id": "flow-fc6f513e65f4e82994cf5802", "packets": 22, "transport": "tcp", "last_frame": 10202, "first_frame": 10181, "initiator_ip": "10.0.90.175", "responder_ip": "198.54.115.33", "initiator_port": 49369, "responder_port": 443, "initiator_bytes": 1320, "last_seen_epoch": "1555364999.279101", "responder_bytes": 5841, "first_seen_epoch": "1555364999.002508" }, { "bytes": 200, "stream": 91, "flow_id": "flow-03b2ef6479a962e24ba2cc96", "packets": 2, "transport": "udp", "last_frame": 10206, "first_frame": 10205, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 57937, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1555365102.443467", "responder_bytes": 108, "first_seen_epoch": "1555365102.443185" }, { "bytes": 6351, "stream": 220, "flow_id": "flow-a97f353d34bf3f865448f29c", "packets": 22, "transport": "tcp", "last_frame": 10228, "first_frame": 10207, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49370, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555365113.304916", "responder_bytes": 1714, "first_seen_epoch": "1555365102.44651" }, { "bytes": 162, "stream": 92, "flow_id": "flow-4fc9472beabbad24e65bd41e", "packets": 2, "transport": "udp", "last_frame": 10232, "first_frame": 10231, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 57265, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1555365260.670068", "responder_bytes": 89, "first_seen_epoch": "1555365260.601857" }, { "bytes": 3173, "stream": 221, "flow_id": "flow-88316a42b3d9c4360970cb28", "packets": 20, "transport": "tcp", "last_frame": 10268, "first_frame": 10233, "initiator_ip": "10.0.90.175", "responder_ip": "176.10.125.110", "initiator_port": 49371, "responder_port": 443, "initiator_bytes": 1476, "last_seen_epoch": "1555365380.610218", "responder_bytes": 1697, "first_seen_epoch": "1555365260.671183" }, { "bytes": 2487, "stream": 222, "flow_id": "flow-136966e380a13e6a4383885f", "packets": 14, "transport": "tcp", "last_frame": 10263, "first_frame": 10248, "initiator_ip": "10.0.90.175", "responder_ip": "176.10.125.110", "initiator_port": 49372, "responder_port": 443, "initiator_bytes": 1346, "last_seen_epoch": "1555365359.004958", "responder_bytes": 1141, "first_seen_epoch": "1555365298.991673" }, { "bytes": 7231, "stream": 223, "flow_id": "flow-7aed1aef16583a2a341fa5be", "packets": 23, "transport": "tcp", "last_frame": 10295, "first_frame": 10273, "initiator_ip": "10.0.90.175", "responder_ip": "68.65.122.52", "initiator_port": 49373, "responder_port": 443, "initiator_bytes": 1390, "last_seen_epoch": "1555365599.290758", "responder_bytes": 5841, "first_seen_epoch": "1555365599.012105" }, { "bytes": 458, "stream": 93, "flow_id": "flow-bbd62a234247a611cd0b30ab", "packets": 2, "transport": "udp", "last_frame": 10297, "first_frame": 10296, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 57266, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1555365673.478103", "responder_bytes": 244, "first_seen_epoch": "1555365673.477517" }, { "bytes": 1280, "stream": 224, "flow_id": "flow-26e17d90d0cd391d7d15b647", "packets": 12, "transport": "tcp", "last_frame": 10411, "first_frame": 10298, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49374, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1555365685.482131", "responder_bytes": 562, "first_seen_epoch": "1555365673.581347" }, { "bytes": 4974, "stream": 225, "flow_id": "flow-708b2d500b14d8a2af89058b", "packets": 20, "transport": "tcp", "last_frame": 10421, "first_frame": 10305, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49375, "responder_port": 49155, "initiator_bytes": 3363, "last_seen_epoch": "1555365705.480746", "responder_bytes": 1611, "first_seen_epoch": "1555365673.583929" }, { "bytes": 347, "stream": 94, "flow_id": "flow-666cfff5b4063900501d1e17", "packets": 2, "transport": "udp", "last_frame": 10323, "first_frame": 10322, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 61988, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1555365673.988007", "responder_bytes": 213, "first_seen_epoch": "1555365673.987543" }, { "bytes": 285, "stream": 95, "flow_id": "flow-6c1064a5c39a9c6a80d5b9ee", "packets": 2, "transport": "udp", "last_frame": 10325, "first_frame": 10324, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 55709, "responder_port": 53, "initiator_bytes": 103, "last_seen_epoch": "1555365673.98876", "responder_bytes": 182, "first_seen_epoch": "1555365673.988543" }, { "bytes": 8112, "stream": 226, "flow_id": "flow-e18a1e87dc36a557d78cf7ba", "packets": 18, "transport": "tcp", "last_frame": 10405, "first_frame": 10326, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49376, "responder_port": 389, "initiator_bytes": 3352, "last_seen_epoch": "1555365674.642525", "responder_bytes": 4760, "first_seen_epoch": "1555365673.990669" }, { "bytes": 457, "stream": 96, "flow_id": "flow-9228e74176c1c1ff454ad973", "packets": 2, "transport": "udp", "last_frame": 10340, "first_frame": 10339, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 55710, "responder_port": 389, "initiator_bytes": 213, "last_seen_epoch": "1555365674.003974", "responder_bytes": 244, "first_seen_epoch": "1555365674.003724" }, { "bytes": 3650, "stream": 227, "flow_id": "flow-f992878118a3f1c6cd4667a0", "packets": 12, "transport": "tcp", "last_frame": 10352, "first_frame": 10341, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49377, "responder_port": 88, "initiator_bytes": 1813, "last_seen_epoch": "1555365674.020313", "responder_bytes": 1837, "first_seen_epoch": "1555365674.017948" }, { "bytes": 3313, "stream": 228, "flow_id": "flow-6765aca064fcaa8d03fe7c9f", "packets": 10, "transport": "tcp", "last_frame": 10362, "first_frame": 10353, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49378, "responder_port": 88, "initiator_bytes": 2887, "last_seen_epoch": "1555365674.022349", "responder_bytes": 426, "first_seen_epoch": "1555365674.020404" }, { "bytes": 3387, "stream": 229, "flow_id": "flow-27f4663e63688cf33b0fbd8f", "packets": 13, "transport": "tcp", "last_frame": 10401, "first_frame": 10363, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49379, "responder_port": 389, "initiator_bytes": 2531, "last_seen_epoch": "1555365674.12962", "responder_bytes": 856, "first_seen_epoch": "1555365674.109116" }, { "bytes": 9266, "stream": 230, "flow_id": "flow-e28ea46eaa92bd509913b9a5", "packets": 36, "transport": "tcp", "last_frame": 10426, "first_frame": 10376, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49380, "responder_port": 445, "initiator_bytes": 6128, "last_seen_epoch": "1555365713.297655", "responder_bytes": 3138, "first_seen_epoch": "1555365674.120643" }, { "bytes": 162, "stream": 97, "flow_id": "flow-a9116daded540e298094afa5", "packets": 2, "transport": "udp", "last_frame": 10430, "first_frame": 10429, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 57126, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1555365860.644759", "responder_bytes": 89, "first_seen_epoch": "1555365860.610855" }, { "bytes": 3205, "stream": 231, "flow_id": "flow-2f576d912f4bbfd852f874e4", "packets": 20, "transport": "tcp", "last_frame": 10467, "first_frame": 10431, "initiator_ip": "10.0.90.175", "responder_ip": "185.158.249.39", "initiator_port": 49381, "responder_port": 443, "initiator_bytes": 1508, "last_seen_epoch": "1555365980.618335", "responder_bytes": 1697, "first_seen_epoch": "1555365860.645978" }, { "bytes": 3081, "stream": 232, "flow_id": "flow-f5df0c98fa37cee657fd27b1", "packets": 18, "transport": "tcp", "last_frame": 10494, "first_frame": 10446, "initiator_ip": "10.0.90.175", "responder_ip": "185.158.249.39", "initiator_port": 49382, "responder_port": 443, "initiator_bytes": 1438, "last_seen_epoch": "1555366090.614947", "responder_bytes": 1643, "first_seen_epoch": "1555365898.999469" }, { "bytes": 6351, "stream": 233, "flow_id": "flow-7a693fe1c1e87a2acceddb79", "packets": 22, "transport": "tcp", "last_frame": 10491, "first_frame": 10470, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49383, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555366013.304377", "responder_bytes": 1714, "first_seen_epoch": "1555366002.471261" }, { "bytes": 3151, "stream": 234, "flow_id": "flow-84341aa9f5457f68ffaa3f77", "packets": 19, "transport": "tcp", "last_frame": 10517, "first_frame": 10497, "initiator_ip": "10.0.90.175", "responder_ip": "185.158.249.39", "initiator_port": 49384, "responder_port": 443, "initiator_bytes": 1454, "last_seen_epoch": "1555366319.014313", "responder_bytes": 1697, "first_seen_epoch": "1555366199.00573" }, { "bytes": 3205, "stream": 235, "flow_id": "flow-f8e5a83aa025f1220b6fbcb0", "packets": 20, "transport": "tcp", "last_frame": 10558, "first_frame": 10520, "initiator_ip": "10.0.90.175", "responder_ip": "185.158.249.39", "initiator_port": 49385, "responder_port": 443, "initiator_bytes": 1508, "last_seen_epoch": "1555366580.627014", "responder_bytes": 1697, "first_seen_epoch": "1555366460.617753" }, { "bytes": 3205, "stream": 236, "flow_id": "flow-3ab9fdb9dfc14ba4c72a5773", "packets": 20, "transport": "tcp", "last_frame": 10565, "first_frame": 10535, "initiator_ip": "10.0.90.175", "responder_ip": "185.158.249.39", "initiator_port": 49386, "responder_port": 443, "initiator_bytes": 1508, "last_seen_epoch": "1555366690.624454", "responder_bytes": 1697, "first_seen_epoch": "1555366499.009851" }, { "bytes": 3189, "stream": 237, "flow_id": "flow-967e883a0b46a87b5a4d8d3b", "packets": 20, "transport": "tcp", "last_frame": 10611, "first_frame": 10568, "initiator_ip": "10.0.90.175", "responder_ip": "185.158.249.39", "initiator_port": 49387, "responder_port": 443, "initiator_bytes": 1492, "last_seen_epoch": "1555366919.023203", "responder_bytes": 1697, "first_seen_epoch": "1555366799.014605" }, { "bytes": 6351, "stream": 238, "flow_id": "flow-c320727a0c93ceefd922a8d8", "packets": 22, "transport": "tcp", "last_frame": 10608, "first_frame": 10585, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49388, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555366913.299548", "responder_bytes": 1714, "first_seen_epoch": "1555366902.497463" }, { "bytes": 2471, "stream": 239, "flow_id": "flow-090e21a33a8f00f57ee48ac9", "packets": 14, "transport": "tcp", "last_frame": 10629, "first_frame": 10614, "initiator_ip": "10.0.90.175", "responder_ip": "185.158.249.39", "initiator_port": 49389, "responder_port": 443, "initiator_bytes": 1330, "last_seen_epoch": "1555367120.636496", "responder_bytes": 1141, "first_seen_epoch": "1555367060.626763" }, { "bytes": 7209, "stream": 240, "flow_id": "flow-241462b64a6314261cba02a0", "packets": 22, "transport": "tcp", "last_frame": 10651, "first_frame": 10630, "initiator_ip": "10.0.90.175", "responder_ip": "198.54.125.57", "initiator_port": 49390, "responder_port": 443, "initiator_bytes": 1422, "last_seen_epoch": "1555367120.929142", "responder_bytes": 5787, "first_seen_epoch": "1555367120.652785" }, { "bytes": 158, "stream": 98, "flow_id": "flow-bfc337b7664b8d1a084f2269", "packets": 2, "transport": "udp", "last_frame": 10657, "first_frame": 10656, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 64775, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1555367420.690245", "responder_bytes": 87, "first_seen_epoch": "1555367420.644013" }, { "bytes": 3187, "stream": 241, "flow_id": "flow-74ca5bae9c66145708679650", "packets": 20, "transport": "tcp", "last_frame": 10679, "first_frame": 10658, "initiator_ip": "10.0.90.175", "responder_ip": "109.230.199.24", "initiator_port": 49391, "responder_port": 443, "initiator_bytes": 1490, "last_seen_epoch": "1555367540.652227", "responder_bytes": 1697, "first_seen_epoch": "1555367420.691449" }, { "bytes": 3079, "stream": 242, "flow_id": "flow-f6f4b40832bb287a3f0cc399", "packets": 18, "transport": "tcp", "last_frame": 10739, "first_frame": 10682, "initiator_ip": "10.0.90.175", "responder_ip": "109.230.199.24", "initiator_port": 49392, "responder_port": 443, "initiator_bytes": 1436, "last_seen_epoch": "1555367890.639197", "responder_bytes": 1643, "first_seen_epoch": "1555367660.634952" }, { "bytes": 2485, "stream": 243, "flow_id": "flow-ff2cf145879d95d41ceadc7c", "packets": 14, "transport": "tcp", "last_frame": 10714, "first_frame": 10699, "initiator_ip": "10.0.90.175", "responder_ip": "109.230.199.24", "initiator_port": 49393, "responder_port": 443, "initiator_bytes": 1344, "last_seen_epoch": "1555367780.659365", "responder_bytes": 1141, "first_seen_epoch": "1555367720.648296" }, { "bytes": 6351, "stream": 244, "flow_id": "flow-c907e8eb2cc5b9521759ba6b", "packets": 22, "transport": "tcp", "last_frame": 10736, "first_frame": 10715, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 49394, "responder_port": 445, "initiator_bytes": 4637, "last_seen_epoch": "1555367813.294952", "responder_bytes": 1714, "first_seen_epoch": "1555367802.527074" }, { "bytes": 7193, "stream": 245, "flow_id": "flow-37e749bdaf47b1f24cb4fe6b", "packets": 22, "transport": "tcp", "last_frame": 10763, "first_frame": 10742, "initiator_ip": "10.0.90.175", "responder_ip": "198.54.115.33", "initiator_port": 49395, "responder_port": 443, "initiator_bytes": 1406, "last_seen_epoch": "1555368020.953206", "responder_bytes": 5787, "first_seen_epoch": "1555368020.665119" }, { "bytes": 162, "stream": 99, "flow_id": "flow-a1c232f75f306bb29ba041d6", "packets": 2, "transport": "udp", "last_frame": 10769, "first_frame": 10768, "initiator_ip": "10.0.90.175", "responder_ip": "10.0.90.9", "initiator_port": 54403, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1555368260.669941", "responder_bytes": 89, "first_seen_epoch": "1555368260.642099" }, { "bytes": 3259, "stream": 246, "flow_id": "flow-8734042f9d2ccc5b74dd15d9", "packets": 21, "transport": "tcp", "last_frame": 10807, "first_frame": 10770, "initiator_ip": "10.0.90.175", "responder_ip": "176.10.125.110", "initiator_port": 49396, "responder_port": 443, "initiator_bytes": 1508, "last_seen_epoch": "1555368380.651385", "responder_bytes": 1751, "first_seen_epoch": "1555368260.670894" }, { "bytes": 2850, "stream": 247, "flow_id": "flow-3e985d4712df31a875f1b2e6", "packets": 15, "transport": "tcp", "last_frame": 10805, "first_frame": 10787, "initiator_ip": "10.0.90.175", "responder_ip": "176.10.125.110", "initiator_port": 49397, "responder_port": 443, "initiator_bytes": 1330, "last_seen_epoch": "1555368358.954814", "responder_bytes": 1520, "first_seen_epoch": "1555368320.655448" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-f505135d60ae2458e1f806cc", "src_port": 52727, "tcp_stream": null, "udp_stream": 1, "frame_number": 3, "timestamp_epoch": "1555346526.219136000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 52727, "event_id": "evt-99c39e0beae43de33d4811c3", "src_port": 53, "tcp_stream": null, "udp_stream": 1, "frame_number": 4, "timestamp_epoch": "1555346526.219414000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "stingrayahoy-dc.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-31249f2d7c0a4508427d5200", "src_port": 60967, "tcp_stream": null, "udp_stream": 2, "frame_number": 5, "timestamp_epoch": "1555346526.221397000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "stingrayahoy-dc.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 60967, "event_id": "evt-92e8cb9b6abe368bb5a58ae5", "src_port": 53, "tcp_stream": null, "udp_stream": 2, "frame_number": 6, "timestamp_epoch": "1555346526.221554000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-4b62136cf2212b52f035dfc4", "src_port": 59790, "tcp_stream": null, "udp_stream": 5, "frame_number": 79, "timestamp_epoch": "1555346526.414974000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 59790, "event_id": "evt-09bb50284c71d4cb33c9bc03", "src_port": 53, "tcp_stream": null, "udp_stream": 5, "frame_number": 80, "timestamp_epoch": "1555346526.415189000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-f43779fb21f81363b5186ade", "src_port": 61885, "tcp_stream": null, "udp_stream": 7, "frame_number": 133, "timestamp_epoch": "1555346526.466875000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 61885, "event_id": "evt-009fcd5a98686e99ee85dea7", "src_port": 53, "tcp_stream": null, "udp_stream": 7, "frame_number": 135, "timestamp_epoch": "1555346526.467039000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-651b46b1442619781dfa6e28", "src_port": 54226, "tcp_stream": null, "udp_stream": 9, "frame_number": 152, "timestamp_epoch": "1555346526.522086000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 54226, "event_id": "evt-bd9d4c4b3531647de70b8d07", "src_port": 53, "tcp_stream": null, "udp_stream": 9, "frame_number": 153, "timestamp_epoch": "1555346526.522279000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "wpad.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-1c83fb352a6d44c9295a65f1", "src_port": 57385, "tcp_stream": null, "udp_stream": 14, "frame_number": 239, "timestamp_epoch": "1555346529.296617000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "wpad.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 57385, "event_id": "evt-2baa0018f6b5c00b62ef0701", "src_port": 53, "tcp_stream": null, "udp_stream": 14, "frame_number": 240, "timestamp_epoch": "1555346529.296857000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-a5a1e5d31bbbeaeed0cc1078", "src_port": 53996, "tcp_stream": null, "udp_stream": 16, "frame_number": 245, "timestamp_epoch": "1555346529.737066000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 53996, "event_id": "evt-fee93dc81df416563b970335", "src_port": 53, "tcp_stream": null, "udp_stream": 16, "frame_number": 246, "timestamp_epoch": "1555346529.737389000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "isatap.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-6c90900cd43a83c46f072860", "src_port": 61413, "tcp_stream": null, "udp_stream": 17, "frame_number": 247, "timestamp_epoch": "1555346529.742162000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "isatap.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 61413, "event_id": "evt-b8471f91088d4820e20d4979", "src_port": 53, "tcp_stream": null, "udp_stream": 17, "frame_number": 248, "timestamp_epoch": "1555346529.742371000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-c2e08a1d7c9217d137352414", "src_port": 56239, "tcp_stream": null, "udp_stream": 18, "frame_number": 250, "timestamp_epoch": "1555346529.885969000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 56239, "event_id": "evt-1428dd63f205e71b1c043752", "src_port": 53, "tcp_stream": null, "udp_stream": 18, "frame_number": 251, "timestamp_epoch": "1555346529.886235000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-cf3cf004a54d1672a924345a", "src_port": 60369, "tcp_stream": null, "udp_stream": 19, "frame_number": 274, "timestamp_epoch": "1555346530.101594000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 60369, "event_id": "evt-524a943ace6850066a00dc96", "src_port": 53, "tcp_stream": null, "udp_stream": 19, "frame_number": 275, "timestamp_epoch": "1555346530.101872000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-132b557ff1f34ce00576419f", "src_port": 55773, "tcp_stream": null, "udp_stream": 20, "frame_number": 276, "timestamp_epoch": "1555346530.102406000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "_ldap._tcp.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 55773, "event_id": "evt-afd48077570277ff77f2822b", "src_port": 53, "tcp_stream": null, "udp_stream": 20, "frame_number": 277, "timestamp_epoch": "1555346530.102590000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-a0e5ef4188f473d0740a0950", "src_port": 50013, "tcp_stream": null, "udp_stream": 22, "frame_number": 397, "timestamp_epoch": "1555346531.866514000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "23.218.156.11,23.218.156.26", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 50013, "event_id": "evt-a6f3d4d995b1551fb207dcc5", "src_port": 53, "tcp_stream": null, "udp_stream": 22, "frame_number": 398, "timestamp_epoch": "1555346531.908365000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-a0e3f155714c8dd56733eaa6", "src_port": 54715, "tcp_stream": null, "udp_stream": 23, "frame_number": 565, "timestamp_epoch": "1555346534.015562000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 54715, "event_id": "evt-c7297ce57cb88164add735c1", "src_port": 53, "tcp_stream": null, "udp_stream": 23, "frame_number": 566, "timestamp_epoch": "1555346534.042221000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-91c448012cff54efdfade87e", "src_port": 55983, "tcp_stream": null, "udp_stream": 24, "frame_number": 567, "timestamp_epoch": "1555346534.042568000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.aaaa": "fd3e:4f5a:5b81::1", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 55983, "event_id": "evt-db964be36ed15153b3a611a0", "src_port": 53, "tcp_stream": null, "udp_stream": 24, "frame_number": 568, "timestamp_epoch": "1555346534.067372000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "Seoul-4a67-PC.stingrayahoy.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-5578a5314e38f3831d527a56", "src_port": 62142, "tcp_stream": null, "udp_stream": 25, "frame_number": 569, "timestamp_epoch": "1555346534.296811000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "Seoul-4a67-PC.stingrayahoy.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 62142, "event_id": "evt-fc34f2cf61edbdf1e8ad2bf0", "src_port": 53, "tcp_stream": null, "udp_stream": 25, "frame_number": 570, "timestamp_epoch": "1555346534.297105000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.a": "10.0.90.175", "dns.qry.name": "stingrayahoy.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-0f278f0720e0843f66358b41", "src_port": 55465, "tcp_stream": null, "udp_stream": 26, "frame_number": 571, "timestamp_epoch": "1555346534.298446000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.175", "dns.qry.name": "stingrayahoy.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 55465, "event_id": "evt-d448301f7cd3921dfadc1114", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 572, "timestamp_epoch": "1555346534.299123000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "ljeffery54ae.top", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-a44dfe42294df8ef5932746b", "src_port": 64355, "tcp_stream": null, "udp_stream": 27, "frame_number": 663, "timestamp_epoch": "1555346549.360603000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "91.240.87.19", "dns.qry.name": "ljeffery54ae.top", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 64355, "event_id": "evt-d416509b2827d871fa9dcaf3", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 664, "timestamp_epoch": "1555346549.748518000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "ksoniay95ee.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-15a4519f456371534dde2880", "src_port": 53775, "tcp_stream": null, "udp_stream": 28, "frame_number": 1022, "timestamp_epoch": "1555346586.179739000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "ksoniay95ee.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-5351331a57c025e578433546", "src_port": 53775, "tcp_stream": null, "udp_stream": 28, "frame_number": 1024, "timestamp_epoch": "1555346587.185863000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "ksoniay95ee.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-d8392cc34cf857007ffb4f58", "src_port": 53775, "tcp_stream": null, "udp_stream": 28, "frame_number": 1026, "timestamp_epoch": "1555346588.200720000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "37.230.112.226", "dns.qry.name": "ksoniay95ee.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 53775, "event_id": "evt-ba6d536aab4a43d5974eafae", "src_port": 53, "tcp_stream": null, "udp_stream": 28, "frame_number": 1027, "timestamp_epoch": "1555346588.429073000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-fed7b5125f002219267aac5d", "src_port": 60014, "tcp_stream": null, "udp_stream": 29, "frame_number": 1253, "timestamp_epoch": "1555346589.777190000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-bad6f7c420e532ff4bbc43c2", "src_port": 59671, "tcp_stream": null, "udp_stream": 30, "frame_number": 1254, "timestamp_epoch": "1555346589.785106000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-eef788db9329608e92154fe6", "src_port": 61436, "tcp_stream": null, "udp_stream": 31, "frame_number": 1255, "timestamp_epoch": "1555346589.786325000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-5f3264ece9191720d5e21b98", "src_port": 52393, "tcp_stream": null, "udp_stream": 32, "frame_number": 1256, "timestamp_epoch": "1555346589.787265000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-f4906f3151ff18fe3cd3ef5e", "src_port": 60509, "tcp_stream": null, "udp_stream": 33, "frame_number": 1257, "timestamp_epoch": "1555346589.787594000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-75599f2cfba4ca43baee1469", "src_port": 55382, "tcp_stream": null, "udp_stream": 34, "frame_number": 1258, "timestamp_epoch": "1555346589.788166000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 61436, "event_id": "evt-39958f209478e1e8b0333c6d", "src_port": 53, "tcp_stream": null, "udp_stream": 31, "frame_number": 1263, "timestamp_epoch": "1555346589.804161000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 60014, "event_id": "evt-3db274fad71f5af8d7a29c5a", "src_port": 53, "tcp_stream": null, "udp_stream": 29, "frame_number": 1264, "timestamp_epoch": "1555346589.804242000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 52393, "event_id": "evt-d6c1be2fbaaf73503901a8e3", "src_port": 53, "tcp_stream": null, "udp_stream": 32, "frame_number": 1265, "timestamp_epoch": "1555346589.847335000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 60509, "event_id": "evt-7e87f1538fb12df8c3337b08", "src_port": 53, "tcp_stream": null, "udp_stream": 33, "frame_number": 1266, "timestamp_epoch": "1555346589.847476000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 55382, "event_id": "evt-20aae71103c7f84d8ed9cb47", "src_port": 53, "tcp_stream": null, "udp_stream": 34, "frame_number": 1267, "timestamp_epoch": "1555346589.847567000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 59671, "event_id": "evt-3f70733ef68a0dbdc6494614", "src_port": 53, "tcp_stream": null, "udp_stream": 30, "frame_number": 1268, "timestamp_epoch": "1555346589.847659000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "iecvlist.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-74c1b24d22f2c4a787106bc3", "src_port": 61041, "tcp_stream": null, "udp_stream": 35, "frame_number": 1680, "timestamp_epoch": "1555346616.038986000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "72.21.81.200", "dns.cname": "ie9comview.vo.msecnd.net,cs9.wpc.v0cdn.net", "dns.qry.name": "iecvlist.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 61041, "event_id": "evt-f7891a7fc90789287bc5e6a5", "src_port": 53, "tcp_stream": null, "udp_stream": 35, "frame_number": 1681, "timestamp_epoch": "1555346616.090612000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "resolver1.opendns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-2d72865d25b6972000545e68", "src_port": 56761, "tcp_stream": null, "udp_stream": 36, "frame_number": 1814, "timestamp_epoch": "1555346658.335680000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "208.67.222.222", "dns.qry.name": "resolver1.opendns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 56761, "event_id": "evt-a979d870b2af17f1341bcebd", "src_port": 53, "tcp_stream": null, "udp_stream": 36, "frame_number": 1815, "timestamp_epoch": "1555346658.357872000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "222.222.67.208.in-addr.arpa", "dns.qry.type": "12", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-e08857f3862a90e56503adfb", "src_port": 56762, "tcp_stream": null, "udp_stream": 37, "frame_number": 1816, "timestamp_epoch": "1555346658.362882000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "222.222.67.208.in-addr.arpa", "dns.qry.type": "12", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 56762, "event_id": "evt-e0b65a560cdb5f44a9029074", "src_port": 53, "tcp_stream": null, "udp_stream": 37, "frame_number": 1817, "timestamp_epoch": "1555346658.385660000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-02d60febdb87e53322e99224", "src_port": 56763, "tcp_stream": null, "udp_stream": 38, "frame_number": 1818, "timestamp_epoch": "1555346658.386451000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "myip.opendns.com.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 56763, "event_id": "evt-052da85ebf1798ae6c569867", "src_port": 53, "tcp_stream": null, "udp_stream": 38, "frame_number": 1819, "timestamp_epoch": "1555346658.452204000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com.stingrayahoy.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-182eeb6a5138534ca3f79add", "src_port": 56764, "tcp_stream": null, "udp_stream": 39, "frame_number": 1820, "timestamp_epoch": "1555346658.452945000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "myip.opendns.com.stingrayahoy.com", "dns.qry.type": "28", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 56764, "event_id": "evt-c7ad408ca8e5ec7153d5e14f", "src_port": 53, "tcp_stream": null, "udp_stream": 39, "frame_number": 1821, "timestamp_epoch": "1555346658.499622000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-f36a2feb3fe56bd27923d9ee", "src_port": 56765, "tcp_stream": null, "udp_stream": 40, "frame_number": 1822, "timestamp_epoch": "1555346658.500468000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "173.166.146.112", "dns.qry.name": "myip.opendns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 56765, "event_id": "evt-fdac9cb800e238d362c4648c", "src_port": 53, "tcp_stream": null, "udp_stream": 40, "frame_number": 1823, "timestamp_epoch": "1555346658.525048000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-6c3e966ff042db86ee12a687", "src_port": 56766, "tcp_stream": null, "udp_stream": 41, "frame_number": 1824, "timestamp_epoch": "1555346658.529168000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "28", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 56766, "event_id": "evt-0535755eb6a1315c0d417759", "src_port": 53, "tcp_stream": null, "udp_stream": 41, "frame_number": 1825, "timestamp_epoch": "1555346658.554522000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "zindv.club", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-17856f3da535fba9802b0dd1", "src_port": 50073, "tcp_stream": null, "udp_stream": 42, "frame_number": 1827, "timestamp_epoch": "1555346658.623534000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "185.139.69.88", "dns.qry.name": "zindv.club", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 50073, "event_id": "evt-59f64e15f2de51474c20c5f0", "src_port": 53, "tcp_stream": null, "udp_stream": 42, "frame_number": 1830, "timestamp_epoch": "1555346658.882999000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-1eceb21b9b9393e142a5bd45", "src_port": 65497, "tcp_stream": null, "udp_stream": 43, "frame_number": 1843, "timestamp_epoch": "1555346659.484357000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "104.73.85.137", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 65497, "event_id": "evt-cd1d577111d82f3552b4792e", "src_port": 53, "tcp_stream": null, "udp_stream": 43, "frame_number": 1844, "timestamp_epoch": "1555346659.532735000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-81159923548678597a930a9d", "src_port": 57450, "tcp_stream": null, "udp_stream": 44, "frame_number": 2208, "timestamp_epoch": "1555348326.795358000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 57450, "event_id": "evt-e15140247ea265b42ec95f15", "src_port": 53, "tcp_stream": null, "udp_stream": 44, "frame_number": 2209, "timestamp_epoch": "1555348326.795828000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-bcbb5ef5afda59f4f49cfbe8", "src_port": 64252, "tcp_stream": null, "udp_stream": 45, "frame_number": 2694, "timestamp_epoch": "1555351926.908657000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 64252, "event_id": "evt-cc0eb0532a5e9a9e7723d299", "src_port": 53, "tcp_stream": null, "udp_stream": 45, "frame_number": 2695, "timestamp_epoch": "1555351926.909196000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-4e311a5e94437c9cbe57d7de", "src_port": 55480, "tcp_stream": null, "udp_stream": 48, "frame_number": 2794, "timestamp_epoch": "1555352174.647680000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 55480, "event_id": "evt-bb7165cee750839edceba6f0", "src_port": 53, "tcp_stream": null, "udp_stream": 48, "frame_number": 2795, "timestamp_epoch": "1555352174.648011000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-aae0dcc75663445cd31e9487", "src_port": 63956, "tcp_stream": null, "udp_stream": 49, "frame_number": 2796, "timestamp_epoch": "1555352174.648798000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "_ldap._tcp.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 63956, "event_id": "evt-46bb6de9246c82bf24ee8103", "src_port": 53, "tcp_stream": null, "udp_stream": 49, "frame_number": 2797, "timestamp_epoch": "1555352174.649008000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "Seoul-4a67-PC.stingrayahoy.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-84f1220a0e87902e721ad991", "src_port": 58664, "tcp_stream": null, "udp_stream": 53, "frame_number": 3276, "timestamp_epoch": "1555354242.021965000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "Seoul-4a67-PC.stingrayahoy.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 58664, "event_id": "evt-95fd77695e2e14ab3687535f", "src_port": 53, "tcp_stream": null, "udp_stream": 53, "frame_number": 3277, "timestamp_epoch": "1555354242.022327000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.a": "10.0.90.175", "dns.qry.name": "stingrayahoy.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-6747f8863b6aed3cd018c073", "src_port": 56229, "tcp_stream": null, "udp_stream": 55, "frame_number": 3280, "timestamp_epoch": "1555354242.024466000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.175", "dns.qry.name": "stingrayahoy.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 56229, "event_id": "evt-6147eeb67cc20afa0964a9c8", "src_port": 53, "tcp_stream": null, "udp_stream": 55, "frame_number": 3281, "timestamp_epoch": "1555354242.025714000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "Seoul-4a67-PC.stingrayahoy.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-33384d148c93cdfb6126e614", "src_port": 54639, "tcp_stream": null, "udp_stream": 56, "frame_number": 3282, "timestamp_epoch": "1555354242.027081000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "Seoul-4a67-PC.stingrayahoy.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 54639, "event_id": "evt-544614654ec5cda7fdd98827", "src_port": 53, "tcp_stream": null, "udp_stream": 56, "frame_number": 3283, "timestamp_epoch": "1555354242.027468000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.a": "10.0.90.175", "dns.qry.name": "stingrayahoy.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-6b3a3cb0a5469198eec3e194", "src_port": 49480, "tcp_stream": null, "udp_stream": 57, "frame_number": 3284, "timestamp_epoch": "1555354242.028227000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.175", "dns.qry.name": "stingrayahoy.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 49480, "event_id": "evt-69b5ad6c86a574d95db5b8e9", "src_port": 53, "tcp_stream": null, "udp_stream": 57, "frame_number": 3285, "timestamp_epoch": "1555354242.029222000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "isatap.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-4001ee1659cd99e8746600bb", "src_port": 54547, "tcp_stream": null, "udp_stream": 60, "frame_number": 3292, "timestamp_epoch": "1555354242.372150000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "isatap.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 54547, "event_id": "evt-96ce597e3b97bc7d040e926b", "src_port": 53, "tcp_stream": null, "udp_stream": 60, "frame_number": 3293, "timestamp_epoch": "1555354242.372458000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-974bec79f50d80145f6681fb", "src_port": 64150, "tcp_stream": null, "udp_stream": 61, "frame_number": 3307, "timestamp_epoch": "1555354244.532374000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 64150, "event_id": "evt-2cc19eeddd53c434adb05fdc", "src_port": 53, "tcp_stream": null, "udp_stream": 61, "frame_number": 3308, "timestamp_epoch": "1555354244.556414000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-1aa3afb8e964bbe240048a27", "src_port": 65030, "tcp_stream": null, "udp_stream": 62, "frame_number": 3309, "timestamp_epoch": "1555354244.557459000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.aaaa": "fd3e:4f5a:5b81::1", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 65030, "event_id": "evt-6f90d62b1b27d58cace30190", "src_port": 53, "tcp_stream": null, "udp_stream": 62, "frame_number": 3310, "timestamp_epoch": "1555354244.578449000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-8ac4819609780e01158668a3", "src_port": 65030, "tcp_stream": null, "udp_stream": 62, "frame_number": 3311, "timestamp_epoch": "1555354244.578618000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.aaaa": "fd3e:4f5a:5b81::1", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 65030, "event_id": "evt-f5b4463603e2017cb0b02ae1", "src_port": 53, "tcp_stream": null, "udp_stream": 62, "frame_number": 3312, "timestamp_epoch": "1555354244.578811000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "wpad.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-8ae390c8adf7ff3e015f3643", "src_port": 56903, "tcp_stream": null, "udp_stream": 64, "frame_number": 3316, "timestamp_epoch": "1555354245.317477000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "wpad.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 56903, "event_id": "evt-8f766709e0d53946ceda445b", "src_port": 53, "tcp_stream": null, "udp_stream": 64, "frame_number": 3317, "timestamp_epoch": "1555354245.317662000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-3218145b0d84defd95131551", "src_port": 53640, "tcp_stream": null, "udp_stream": 66, "frame_number": 3319, "timestamp_epoch": "1555354245.318201000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 53640, "event_id": "evt-cf8e58e0b0c9fb9bae808362", "src_port": 53, "tcp_stream": null, "udp_stream": 66, "frame_number": 3320, "timestamp_epoch": "1555354245.318350000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "isatap.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-8e55cfa56d0a62e55fc5112e", "src_port": 59964, "tcp_stream": null, "udp_stream": 67, "frame_number": 3323, "timestamp_epoch": "1555354245.320304000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "isatap.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 59964, "event_id": "evt-0b31dc63e4187d2fb03a3f0e", "src_port": 53, "tcp_stream": null, "udp_stream": 67, "frame_number": 3324, "timestamp_epoch": "1555354245.320485000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-2221c7891caaba1244710da5", "src_port": 58439, "tcp_stream": null, "udp_stream": 68, "frame_number": 3858, "timestamp_epoch": "1555357902.216762000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 58439, "event_id": "evt-1b25c60bd9ff8059288c1d24", "src_port": 53, "tcp_stream": null, "udp_stream": 68, "frame_number": 3859, "timestamp_epoch": "1555357902.217020000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-2dc93aa7b253b5dbfe73ba1c", "src_port": 60962, "tcp_stream": null, "udp_stream": 71, "frame_number": 3922, "timestamp_epoch": "1555357995.950976000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 60962, "event_id": "evt-147cfc0a79868075494351a1", "src_port": 53, "tcp_stream": null, "udp_stream": 71, "frame_number": 3923, "timestamp_epoch": "1555357995.951273000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-f6a4ae8fdeb2b8c7dd2e5470", "src_port": 60322, "tcp_stream": null, "udp_stream": 72, "frame_number": 3924, "timestamp_epoch": "1555357995.952142000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "_ldap._tcp.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 60322, "event_id": "evt-f90c5612daea1df6bccbc6a8", "src_port": 53, "tcp_stream": null, "udp_stream": 72, "frame_number": 3925, "timestamp_epoch": "1555357995.952380000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-48df924c00916c6432f0f4fc", "src_port": 63637, "tcp_stream": null, "udp_stream": 74, "frame_number": 4245, "timestamp_epoch": "1555359552.818613000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 63637, "event_id": "evt-293d055443f4963e1709465c", "src_port": 53, "tcp_stream": null, "udp_stream": 74, "frame_number": 4246, "timestamp_epoch": "1555359552.818954000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-2098775eb32ce675cc553245", "src_port": 52092, "tcp_stream": null, "udp_stream": 75, "frame_number": 4247, "timestamp_epoch": "1555359552.819516000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "_ldap._tcp.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 52092, "event_id": "evt-1eb8416c9e951c50b5b5460c", "src_port": 53, "tcp_stream": null, "udp_stream": 75, "frame_number": 4248, "timestamp_epoch": "1555359552.819739000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "pompeiiii.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-9850d41956373b6b056f1217", "src_port": 57906, "tcp_stream": null, "udp_stream": 77, "frame_number": 4345, "timestamp_epoch": "1555359584.579046000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "208.91.197.91", "dns.qry.name": "pompeiiii.org", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 57906, "event_id": "evt-28553241c262722d80920547", "src_port": 53, "tcp_stream": null, "udp_stream": 77, "frame_number": 4346, "timestamp_epoch": "1555359584.630094000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-a82f877fa23a01a784aea6f6", "src_port": 60407, "tcp_stream": null, "udp_stream": 78, "frame_number": 4358, "timestamp_epoch": "1555359604.529776000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 60407, "event_id": "evt-93a4a832bc91afa162583af7", "src_port": 53, "tcp_stream": null, "udp_stream": 78, "frame_number": 4359, "timestamp_epoch": "1555359604.557420000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-2123561dc322e9e6f238030b", "src_port": 51572, "tcp_stream": null, "udp_stream": 79, "frame_number": 4360, "timestamp_epoch": "1555359604.557969000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.aaaa": "fd3e:4f5a:5b81::1", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 51572, "event_id": "evt-337de567db9fbd92c3ab4837", "src_port": 53, "tcp_stream": null, "udp_stream": 79, "frame_number": 4361, "timestamp_epoch": "1555359604.579475000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-a2a0689426f1b90081740f83", "src_port": 58900, "tcp_stream": null, "udp_stream": 80, "frame_number": 4622, "timestamp_epoch": "1555361502.329425000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 58900, "event_id": "evt-425b708fd83a8c196a582f9e", "src_port": 53, "tcp_stream": null, "udp_stream": 80, "frame_number": 4623, "timestamp_epoch": "1555361502.329738000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "adsfinder.xyz", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-c4be8b7241a493361c55f494", "src_port": 63136, "tcp_stream": null, "udp_stream": 81, "frame_number": 4919, "timestamp_epoch": "1555363460.580569000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "185.158.249.39", "dns.qry.name": "adsfinder.xyz", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 63136, "event_id": "evt-78d2c47bc088a3fbd7a05acd", "src_port": 53, "tcp_stream": null, "udp_stream": 81, "frame_number": 4920, "timestamp_epoch": "1555363460.619298000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "wpad.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-095663b191fa90bc186e520e", "src_port": 53010, "tcp_stream": null, "udp_stream": 82, "frame_number": 5369, "timestamp_epoch": "1555363518.813733000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "wpad.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 53010, "event_id": "evt-126770787f8146b39dcd9be8", "src_port": 53, "tcp_stream": null, "udp_stream": 82, "frame_number": 5370, "timestamp_epoch": "1555363518.814081000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-ddb57cc8cfcfda9faa9f5eb0", "src_port": 62852, "tcp_stream": null, "udp_stream": 83, "frame_number": 5371, "timestamp_epoch": "1555363518.814523000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 62852, "event_id": "evt-786e8e7ed602c83eed015b3b", "src_port": 53, "tcp_stream": null, "udp_stream": 83, "frame_number": 5375, "timestamp_epoch": "1555363518.842569000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-c716ba1410f1c7d897f1054a", "src_port": 49998, "tcp_stream": null, "udp_stream": 87, "frame_number": 9887, "timestamp_epoch": "1555363577.233966000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 49998, "event_id": "evt-aad886de3613eba74b62ade7", "src_port": 53, "tcp_stream": null, "udp_stream": 87, "frame_number": 9888, "timestamp_epoch": "1555363577.234249000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-b6cf927e0d94453e08679ad5", "src_port": 64911, "tcp_stream": null, "udp_stream": 88, "frame_number": 9889, "timestamp_epoch": "1555363577.234678000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "_ldap._tcp.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 64911, "event_id": "evt-964ec4805f5ca6ac38c8ce84", "src_port": 53, "tcp_stream": null, "udp_stream": 88, "frame_number": 9890, "timestamp_epoch": "1555363577.234859000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "qqtube.club", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-5998b5d1fa311a08fb9ea4a7", "src_port": 56060, "tcp_stream": null, "udp_stream": 90, "frame_number": 10045, "timestamp_epoch": "1555364084.642498000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "109.230.199.24", "dns.qry.name": "qqtube.club", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 56060, "event_id": "evt-a1f5bcad3d365b77e23bddfb", "src_port": 53, "tcp_stream": null, "udp_stream": 90, "frame_number": 10046, "timestamp_epoch": "1555364084.673017000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-c231aaeb17ce58c15347165d", "src_port": 57937, "tcp_stream": null, "udp_stream": 91, "frame_number": 10205, "timestamp_epoch": "1555365102.443185000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 57937, "event_id": "evt-d93649e466b6d62cc41c2469", "src_port": 53, "tcp_stream": null, "udp_stream": 91, "frame_number": 10206, "timestamp_epoch": "1555365102.443467000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "parolinos.xyz", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-336041e0d6974038e9cec334", "src_port": 57265, "tcp_stream": null, "udp_stream": 92, "frame_number": 10231, "timestamp_epoch": "1555365260.601857000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "176.10.125.110", "dns.qry.name": "parolinos.xyz", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 57265, "event_id": "evt-364d33ac4a59da0c98db99bb", "src_port": 53, "tcp_stream": null, "udp_stream": 92, "frame_number": 10232, "timestamp_epoch": "1555365260.670068000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-9c2c76466fc93c635dc5b436", "src_port": 61988, "tcp_stream": null, "udp_stream": 94, "frame_number": 10322, "timestamp_epoch": "1555365673.987543000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 61988, "event_id": "evt-5219e495b470352d1d4b237a", "src_port": 53, "tcp_stream": null, "udp_stream": 94, "frame_number": 10323, "timestamp_epoch": "1555365673.988007000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-4a60109c413837d0fa148d6d", "src_port": 55709, "tcp_stream": null, "udp_stream": 95, "frame_number": 10324, "timestamp_epoch": "1555365673.988543000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.qry.name": "_ldap._tcp.StingrayAhoy-DC.stingrayahoy.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 55709, "event_id": "evt-22f206403144f5c7009108dd", "src_port": 53, "tcp_stream": null, "udp_stream": 95, "frame_number": 10325, "timestamp_epoch": "1555365673.988760000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "adsfinder.xyz", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-9659927e8bf9b9b847b09a30", "src_port": 57126, "tcp_stream": null, "udp_stream": 97, "frame_number": 10429, "timestamp_epoch": "1555365860.610855000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "185.158.249.39", "dns.qry.name": "adsfinder.xyz", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 57126, "event_id": "evt-0554fbddbff74d36715fb498", "src_port": 53, "tcp_stream": null, "udp_stream": 97, "frame_number": 10430, "timestamp_epoch": "1555365860.644759000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "qqtube.club", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-1b1f9f46094a27522a9aecd9", "src_port": 64775, "tcp_stream": null, "udp_stream": 98, "frame_number": 10656, "timestamp_epoch": "1555367420.644013000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "109.230.199.24", "dns.qry.name": "qqtube.club", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 64775, "event_id": "evt-08136fbab89d3d45b0564a0c", "src_port": 53, "tcp_stream": null, "udp_stream": 98, "frame_number": 10657, "timestamp_epoch": "1555367420.690245000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "parolinos.xyz", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": 53, "event_id": "evt-442be5bbe0aa6208ceb1f5de", "src_port": 54403, "tcp_stream": null, "udp_stream": 99, "frame_number": 10768, "timestamp_epoch": "1555368260.642099000" }, { "kind": "dns", "dst_ip": "10.0.90.175", "fields": { "dns.a": "176.10.125.110", "dns.qry.name": "parolinos.xyz", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 54403, "event_id": "evt-0f2b80fbf81411f4a9b7643a", "src_port": 53, "tcp_stream": null, "udp_stream": 99, "frame_number": 10769, "timestamp_epoch": "1555368260.669941000" } ], "dhcp": [ { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "d0:67:e5:b1:53:fa", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "d0:67:e5:b1:53:fa,d0:67:e5:b1:53:fa", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Seoul-4a67-PC" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d45eff019d3aeae1944dbc42", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 237, "timestamp_epoch": "1555346529.292738000" }, { "kind": "dhcp", "dst_ip": "10.0.90.175", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "d0:67:e5:b1:53:fa", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d5413e69c08ca6d61f289c46", "src_port": null, "tcp_stream": null, "udp_stream": 13, "frame_number": 238, "timestamp_epoch": "1555346529.293034000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "d0:67:e5:b1:53:fa", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "d0:67:e5:b1:53:fa,d0:67:e5:b1:53:fa", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Seoul-4a67-PC" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1dda680c86fc7136f9b876c2", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1828, "timestamp_epoch": "1555346658.626217000" }, { "kind": "dhcp", "dst_ip": "10.0.90.175", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "d0:67:e5:b1:53:fa", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-be7405def106892426ad1ce1", "src_port": null, "tcp_stream": null, "udp_stream": 13, "frame_number": 1829, "timestamp_epoch": "1555346658.626775000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "d0:67:e5:b1:53:fa", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "d0:67:e5:b1:53:fa,d0:67:e5:b1:53:fa", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Seoul-4a67-PC" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-020ea3d04fb57e46f65a166f", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 3325, "timestamp_epoch": "1555354245.322579000" }, { "kind": "dhcp", "dst_ip": "10.0.90.175", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "d0:67:e5:b1:53:fa", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4e0b37e54eebd43979ab21f8", "src_port": null, "tcp_stream": null, "udp_stream": 13, "frame_number": 3326, "timestamp_epoch": "1555354245.322947000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "d0:67:e5:b1:53:fa", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "d0:67:e5:b1:53:fa,d0:67:e5:b1:53:fa", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Seoul-4a67-PC" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0678de1833f8876b3d849a2d", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 5372, "timestamp_epoch": "1555363518.816531000" }, { "kind": "dhcp", "dst_ip": "10.0.90.175", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "d0:67:e5:b1:53:fa", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-20e55d3c767d2815aeeb2ffd", "src_port": null, "tcp_stream": null, "udp_stream": 13, "frame_number": 5373, "timestamp_epoch": "1555363518.817063000" } ], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<00>,SEOUL-4A67-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8e1c7c2c80745df4cc96c3cd", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1555346526.210024000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "STINGRAYAHOY<00>,STINGRAYAHOY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3499396f41b83d2572a67519", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2, "timestamp_epoch": "1555346526.210760000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "10", "kerberos.CNameString": "seoul-4a67-pc$" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cdad2cdba34c033bebda7824", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 44, "timestamp_epoch": "1555346526.365190000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-df9ba42eb919307b598c73de", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 45, "timestamp_epoch": "1555346526.365675000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "10", "kerberos.CNameString": "seoul-4a67-pc$" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c35cfde47b37c47d30cfa607", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 52, "timestamp_epoch": "1555346526.395093000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a7585c875023a5b18c1f0607", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 54, "timestamp_epoch": "1555346526.395998000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ade486f0b03b6380588d1039", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 63, "timestamp_epoch": "1555346526.405060000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9f83986ee64e4f69318215e2", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 66, "timestamp_epoch": "1555346526.406041000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5f25263f1eeea923008bcb6e", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 72, "timestamp_epoch": "1555346526.407400000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3cbfca4a985be8c8358e715d", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 74, "timestamp_epoch": "1555346526.407973000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e9828e235cab6f8e5f229f5c", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 87, "timestamp_epoch": "1555346526.420758000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ca57348b12cc331cc6dc84fb", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 88, "timestamp_epoch": "1555346526.436779000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-bb18b8902d89b8800697c831", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 89, "timestamp_epoch": "1555346526.437194000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "10", "kerberos.CNameString": "seoul-4a67-pc$" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-59e63e93d48f92bfe34e5a43", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 93, "timestamp_epoch": "1555346526.441030000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-27ae12c7adc6ed0b34cff361", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 94, "timestamp_epoch": "1555346526.441437000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "10", "kerberos.CNameString": "seoul-4a67-pc$" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-19ecafdcb256afd88d82ce67", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 100, "timestamp_epoch": "1555346526.459700000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-48722e25a2c2e5385a4e940b", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 102, "timestamp_epoch": "1555346526.460600000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-81c3269a7dbada2e74d9e873", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 111, "timestamp_epoch": "1555346526.463052000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7a9c66450adc22f6b4cf29f3", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 114, "timestamp_epoch": "1555346526.463861000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d8797259d5d7c16b866ecc67", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 123, "timestamp_epoch": "1555346526.465588000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c5d01dcda544a1b69a59d121", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 126, "timestamp_epoch": "1555346526.465944000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-eee362b3e5d8fab40b6d173d", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 136, "timestamp_epoch": "1555346526.467133000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-206c1d86f3a2ff0d798b7dc7", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 139, "timestamp_epoch": "1555346526.468333000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2c6e8f16cafc7c58bfbfa3e2", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 140, "timestamp_epoch": "1555346526.468912000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f4920b6bc93f2da3fcd9be8a", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 141, "timestamp_epoch": "1555346526.469067000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1485472d1f2cac9b0a0b8f02", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 142, "timestamp_epoch": "1555346526.469865000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-88521bf267ffc45df82fa019", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 143, "timestamp_epoch": "1555346526.470285000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-792016174532b56e20ce3560", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 168, "timestamp_epoch": "1555346526.573818000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5ffedb4643e6a4479e39eaa1", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 171, "timestamp_epoch": "1555346526.574603000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c1589643fbc578bf65edadf5", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 177, "timestamp_epoch": "1555346526.575676000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c651cb6a841a72a02294b3bf", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 179, "timestamp_epoch": "1555346526.576222000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<20>,SEOUL-4A67-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-25e405bc1a69c1d936acd95f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 215, "timestamp_epoch": "1555346526.718948000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5f85b09f69674dbcfd711ea0", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 216, "timestamp_epoch": "1555346526.759398000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f6a5c193b20acda1f60faeb9", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 217, "timestamp_epoch": "1555346526.759993000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<00>,SEOUL-4A67-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c758e67d4ccbfc1de71bc8da", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 223, "timestamp_epoch": "1555346526.959105000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "STINGRAYAHOY<00>,STINGRAYAHOY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7f87a01dd75b45be510bb860", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 224, "timestamp_epoch": "1555346526.959207000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<20>,SEOUL-4A67-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-21bd5f92704fda7327cdacab", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 227, "timestamp_epoch": "1555346527.469052000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "STINGRAYAHOY<00>,STINGRAYAHOY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-abc4e8f49f9465c43ffa9556", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 228, "timestamp_epoch": "1555346527.709372000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<00>,SEOUL-4A67-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1069d9802f39f51199fa7277", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 229, "timestamp_epoch": "1555346527.709536000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<20>,SEOUL-4A67-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d4bc25e21aa425a8a53ac064", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 230, "timestamp_epoch": "1555346528.219128000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<00>,SEOUL-4A67-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-6c87661e712d7ee56c91d6f6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 231, "timestamp_epoch": "1555346528.459037000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "STINGRAYAHOY<00>,STINGRAYAHOY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e0a17bda32bce207b35024cb", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 232, "timestamp_epoch": "1555346528.459179000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<20>,SEOUL-4A67-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-18b2b50cb8ab15057ba30af4", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 233, "timestamp_epoch": "1555346528.980071000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:67:e5:b1:53:fa", "dns.qry.name": "Seoul-4a67-PC" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4873048a5b94f63a47c4ac48", "src_port": null, "tcp_stream": null, "udp_stream": 11, "frame_number": 236, "timestamp_epoch": "1555346529.285859000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:67:e5:b1:53:fa", "dns.qry.name": "wpad" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-65fb8208aaae9a34d136b9ac", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 241, "timestamp_epoch": "1555346529.297465000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:67:e5:b1:53:fa", "dns.qry.name": "Seoul-4a67-PC" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9401d062c871fd7a3fa0d4db", "src_port": null, "tcp_stream": null, "udp_stream": 11, "frame_number": 242, "timestamp_epoch": "1555346529.378627000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:67:e5:b1:53:fa", "dns.qry.name": "wpad" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-02852fa23bc1b3e713f0fedc", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 243, "timestamp_epoch": "1555346529.388560000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3b4cf72da7899e100a8bc92a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 244, "timestamp_epoch": "1555346529.589009000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-69664f2aad2c4dae6de31061", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 259, "timestamp_epoch": "1555346529.921087000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a94ba3037f04efa8967d0b40", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 262, "timestamp_epoch": "1555346529.921919000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-94afda11e31efe963d544894", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 286, "timestamp_epoch": "1555346530.105981000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-050ecd26822b13c8859fc7a1", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 288, "timestamp_epoch": "1555346530.106666000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1357c2dbddcb5a5b15b393b5", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 293, "timestamp_epoch": "1555346530.113075000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2a9ba123d42bd32a56847126", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 296, "timestamp_epoch": "1555346530.114166000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-816d0775de862192d167df7b", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 308, "timestamp_epoch": "1555346530.119257000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e2db7cdfa5badb55f5fea375", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 314, "timestamp_epoch": "1555346530.120242000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-bb0cc6e1682e9dfaa934dfd3", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 323, "timestamp_epoch": "1555346530.121130000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-03ee7595c419870cbaf30f64", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 326, "timestamp_epoch": "1555346530.121497000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-95e5637f24d8aaf1a2ab921c", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 327, "timestamp_epoch": "1555346530.121646000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f80edfe7808ccedb745575df", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 330, "timestamp_epoch": "1555346530.122121000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b4b833d7def00a356363a367", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 342, "timestamp_epoch": "1555346530.126347000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7dca1849a36520349fd086ed", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 343, "timestamp_epoch": "1555346530.126560000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a2964eddff26016f8931ece7", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 348, "timestamp_epoch": "1555346530.127434000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9edab0a06093a62f40e2e477", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 351, "timestamp_epoch": "1555346530.128174000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9c92b6d7aa0d99d9e7c4ec2e", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 360, "timestamp_epoch": "1555346530.129019000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4e0d38dc03283176bf7e4ae1", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 363, "timestamp_epoch": "1555346530.129382000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e65cd83e9593c86adcf229df", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 371, "timestamp_epoch": "1555346530.129953000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-74932443b3b4ea18ec4ca37d", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 372, "timestamp_epoch": "1555346530.130418000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2c4cb8dd94ec8c8d4a8a9cd1", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 373, "timestamp_epoch": "1555346530.130771000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-eca30523d01d0517a8dd1770", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 374, "timestamp_epoch": "1555346530.130872000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-bb076453e6f94beb90f34e1e", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 375, "timestamp_epoch": "1555346530.131110000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3caaa45335f4000b2c77b89d", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 376, "timestamp_epoch": "1555346530.131300000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-dc03594f48a50361819bfd47", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 377, "timestamp_epoch": "1555346530.131546000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-488e6a0d56cce9ef91c773fa", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 378, "timestamp_epoch": "1555346530.131696000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-71c54c2c0821170ee3f8174d", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 379, "timestamp_epoch": "1555346530.131934000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2a35a98541835fa1e7797aa8", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 380, "timestamp_epoch": "1555346530.132036000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d60da32d96073e23438dfdb9", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 381, "timestamp_epoch": "1555346530.132444000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8cae6bb5051e18044d4e2699", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 382, "timestamp_epoch": "1555346530.132680000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0cad5820c21377698848c9f3", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 383, "timestamp_epoch": "1555346530.132951000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2940519cecd9aca2078df113", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 384, "timestamp_epoch": "1555346530.133056000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-96d9190f6ec469c460fa995a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 389, "timestamp_epoch": "1555346530.338867000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cc0da97b7c163e6b3051e7fb", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 390, "timestamp_epoch": "1555346531.101247000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "10", "kerberos.CNameString": "kim.jooyoung" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-73e27248893fd910ba8c911d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 411, "timestamp_epoch": "1555346532.838471000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4bc80975fabaa53eebe2b59d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 412, "timestamp_epoch": "1555346532.839244000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "10", "kerberos.CNameString": "kim.jooyoung" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5dbc63d74c16c7bd4be46901", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 419, "timestamp_epoch": "1555346532.858739000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "kim.jooyoung" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7e6ac1ebbefc2bcf59d89661", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 421, "timestamp_epoch": "1555346532.859387000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b72d0bf1fb52d07097bf1ee6", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 430, "timestamp_epoch": "1555346532.860165000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "kim.jooyoung" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-84eab45e3cbdadf2a7cc42bc", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 433, "timestamp_epoch": "1555346532.861068000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a05b46a778c306319341c7ca", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 444, "timestamp_epoch": "1555346532.899288000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "kim.jooyoung" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-10de2747057996466f036311", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 447, "timestamp_epoch": "1555346532.900040000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-efbe963829ab7f24c9ef4060", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 463, "timestamp_epoch": "1555346532.930623000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0c52828054c7a8c36e38f8d9", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 464, "timestamp_epoch": "1555346532.930760000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-473f324a8a71b53b1eb6ccd0", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 465, "timestamp_epoch": "1555346532.930936000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e233d0052387d8dfe5cf838d", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 470, "timestamp_epoch": "1555346532.931634000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "kim.jooyoung" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-09e81a7825e0251303be1576", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 473, "timestamp_epoch": "1555346532.932351000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-71e8e0abd7763871742c2292", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 482, "timestamp_epoch": "1555346532.932985000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "kim.jooyoung" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f72be76292ae6baeb993b944", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 485, "timestamp_epoch": "1555346532.933259000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d70c360f9f151e485506fb71", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 493, "timestamp_epoch": "1555346532.933746000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6771d3d62425d5b52de3240d", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 494, "timestamp_epoch": "1555346532.934204000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1fda81c49d7a881025242ee5", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 495, "timestamp_epoch": "1555346532.934439000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-285615be9a744386db115326", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 496, "timestamp_epoch": "1555346532.934545000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-6280e55780a786a056bc571b", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 497, "timestamp_epoch": "1555346532.935087000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-73a7ee8588bd165a5b39888d", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 498, "timestamp_epoch": "1555346533.036698000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ebed5428af7eefc1d81d90d2", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 499, "timestamp_epoch": "1555346533.037423000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8de41822d3e8fa1fa39ef8a6", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 500, "timestamp_epoch": "1555346533.037744000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a05269a7bd82ee321e1689aa", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 501, "timestamp_epoch": "1555346533.040086000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-02c60dd678796f12e8fd6db0", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 502, "timestamp_epoch": "1555346533.040286000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-681d379ccccaf3642d1b95d3", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 514, "timestamp_epoch": "1555346533.411659000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "kim.jooyoung" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-747c2db4d8243139b32a123f", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 517, "timestamp_epoch": "1555346533.412768000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-93f9534b20d7ba78a4417437", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 523, "timestamp_epoch": "1555346533.413413000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-24c3455ae4fea8a263688348", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 525, "timestamp_epoch": "1555346533.413982000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-6af98cf20b6f197b9bb58b94", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 532, "timestamp_epoch": "1555346533.419178000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-97ab73527524e4c59899d384", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 534, "timestamp_epoch": "1555346533.419686000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-77af966fc5ea3e05ca2c7e3d", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 544, "timestamp_epoch": "1555346533.424769000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-cdf3a5d810710be7b448b7bb", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 545, "timestamp_epoch": "1555346533.425029000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a15b2444c3397e372f9767cd", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 549, "timestamp_epoch": "1555346533.425870000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1103e759d3f17768e3c03a03", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 550, "timestamp_epoch": "1555346533.426683000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7eec89a41f22a0afc3515a73", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 551, "timestamp_epoch": "1555346533.427036000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6972fd4585ada634a23a31e9", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 552, "timestamp_epoch": "1555346533.427185000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-bee2ba74114bf812a96e8f64", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 553, "timestamp_epoch": "1555346533.427559000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7b21bc48ac72b30e7dadf645", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 554, "timestamp_epoch": "1555346533.427851000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ef06230f8ea65a685f170abc", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 555, "timestamp_epoch": "1555346533.428170000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b32d64e667417e5e04b57cf3", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 556, "timestamp_epoch": "1555346533.428302000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e61de44e8f73059d48b3e211", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 573, "timestamp_epoch": "1555346536.998584000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-392a565d679d4c4168429ff7", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 574, "timestamp_epoch": "1555346536.998881000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e8003637e8298d235af5af55", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 583, "timestamp_epoch": "1555346537.141592000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4425f83fc78439e72d27f8a3", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 585, "timestamp_epoch": "1555346537.142162000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-fdc18d73d6ed03600703a5bc", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 598, "timestamp_epoch": "1555346537.153441000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f79422599b41f3b0332ad5fd", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 600, "timestamp_epoch": "1555346537.153977000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "10", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-92eb137ff1d77f9cd0a3542f", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 606, "timestamp_epoch": "1555346537.155891000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-83ae373d770848a4fc21b403", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 607, "timestamp_epoch": "1555346537.156443000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "10", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a722d15be870c78562759e8f", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 614, "timestamp_epoch": "1555346537.172564000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8f713fe7c6db45df5f14243d", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 616, "timestamp_epoch": "1555346537.174031000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-19d8dbd46a9a967ad4eb8ef4", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 625, "timestamp_epoch": "1555346537.175681000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-445be6826b5fb6b115417bb8", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 628, "timestamp_epoch": "1555346537.177108000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8c085d49f9c93a8b236c5f7e", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 640, "timestamp_epoch": "1555346543.268424000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a62614aa9f1fa07b234c495b", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 641, "timestamp_epoch": "1555346543.268745000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-fa850d095eb57949bfd02b52", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 642, "timestamp_epoch": "1555346543.269153000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7b8eae9e756f822687233800", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 643, "timestamp_epoch": "1555346543.269352000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-82dd5cefe7c2e40618271d67", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 644, "timestamp_epoch": "1555346543.269737000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1cdfc57fefb56278594eb848", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 646, "timestamp_epoch": "1555346543.269940000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-fc61b31e5f2d2d7a186449f0", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 647, "timestamp_epoch": "1555346543.270491000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b0760bed84a6b0e078dcb6ff", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 648, "timestamp_epoch": "1555346543.270670000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-64d4a80c3e01b9d916dbe443", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 649, "timestamp_epoch": "1555346543.270833000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b2ac7c2dd93a654b5abe09f2", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 650, "timestamp_epoch": "1555346543.270964000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-da517098d3d551bdd3a1234b", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 651, "timestamp_epoch": "1555346543.271257000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-89fa85c4601f7ad2cfd70506", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 653, "timestamp_epoch": "1555346543.271434000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cf64f5a55be838eca177b4a6", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 655, "timestamp_epoch": "1555346544.990703000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-15e326f8059808e3e8bf6052", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 656, "timestamp_epoch": "1555346544.990946000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-62be411d3a7e149e9c2b6f99", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 657, "timestamp_epoch": "1555346544.991164000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e82b65184e4b404f309ce54f", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 658, "timestamp_epoch": "1555346545.093052000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3c76dd24d67a7ba252862460", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 659, "timestamp_epoch": "1555346545.093736000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-eea80da7f651db9261b46f4c", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 660, "timestamp_epoch": "1555346545.093932000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f9d63a3fd0460a0db8eb12f0", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 1002, "timestamp_epoch": "1555346555.268901000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-38c78700d6e94bc8585149c1", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 1003, "timestamp_epoch": "1555346555.269488000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a5c757f9d56f2db66731bd62", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 1004, "timestamp_epoch": "1555346555.271520000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-52000d4df01360a4dd3808f8", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 1005, "timestamp_epoch": "1555346555.271724000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3bf54efb7eeb5b0d454b5010", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 1006, "timestamp_epoch": "1555346555.271900000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-20a5469d38eafc91539c9d86", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 1008, "timestamp_epoch": "1555346555.272056000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-6113454dc85ca903b84b0a25", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1021, "timestamp_epoch": "1555346586.101828000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8244d3ff9af5d5ffcf2daaa8", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1023, "timestamp_epoch": "1555346586.857640000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0c86fd0c48e5429162d1434a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1025, "timestamp_epoch": "1555346587.622522000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-affbc7c82699a0768d9ba728", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1826, "timestamp_epoch": "1555346658.616259000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3c02c41f970482f69e96e36f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1840, "timestamp_epoch": "1555346659.377565000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b5dfd162ee1296ada76073e6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1910, "timestamp_epoch": "1555346660.142582000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d442fae8840094f7663b3a11", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2083, "timestamp_epoch": "1555347426.786699000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b509e6faf6e65c66d330d394", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2084, "timestamp_epoch": "1555347426.786846000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c634880872f0e567760be558", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2085, "timestamp_epoch": "1555347426.787068000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-05014c2bff640b77cbf69cbb", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2089, "timestamp_epoch": "1555347426.788383000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8414b3f61be1c1ee1919f4f9", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2090, "timestamp_epoch": "1555347426.789293000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d399552d86c605b3bbaaa26e", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2091, "timestamp_epoch": "1555347426.789665000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-03ae0ec02644b3fdf5bbe858", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2092, "timestamp_epoch": "1555347426.789781000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ee84d44ebadc3deafe76efff", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2093, "timestamp_epoch": "1555347426.790030000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d42ab690d50e3a83cf31e4bd", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2094, "timestamp_epoch": "1555347426.790302000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ce9ee17bb596ba6e51d7838f", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2096, "timestamp_epoch": "1555347437.275328000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5fc4f368fdd3f8a3ca0d66ca", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2097, "timestamp_epoch": "1555347437.275555000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-777291fea9fb0c8663a65ded", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2098, "timestamp_epoch": "1555347437.275729000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-05a34322a2b531d3c8d41d9b", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 2099, "timestamp_epoch": "1555347437.275865000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d7be027653030fece2e434c5", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2214, "timestamp_epoch": "1555348326.799238000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-305f50679f080d4bb38e66d6", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2215, "timestamp_epoch": "1555348326.799391000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-61ee949c3e0ac536507ddd11", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2216, "timestamp_epoch": "1555348326.799585000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a1e564c39e3c1b8bd9d078a4", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2220, "timestamp_epoch": "1555348326.800934000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8b15c4da66af3a54966c6790", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2221, "timestamp_epoch": "1555348326.801795000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-27c73ef33f7ca95bf9a8d280", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2222, "timestamp_epoch": "1555348326.802219000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2b85149d408ab44716b00358", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2223, "timestamp_epoch": "1555348326.802364000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-137aba253aa9c749889fb9ad", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2224, "timestamp_epoch": "1555348326.802698000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c4b2df7b90acf10cf47bef4a", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2225, "timestamp_epoch": "1555348326.802915000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-24660bd3c7e98eef9eea4c4f", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2227, "timestamp_epoch": "1555348337.272030000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0426cdf31ca094084e9ed004", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2228, "timestamp_epoch": "1555348337.272304000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e3656de6a7ead14f5e875806", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2229, "timestamp_epoch": "1555348337.273026000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-655c5167dce964192bff3d9f", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 2230, "timestamp_epoch": "1555348337.273220000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-494012c7ed9990d9d2ab0f2c", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2342, "timestamp_epoch": "1555349226.813145000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-aa5428226b0d030211fb3459", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2343, "timestamp_epoch": "1555349226.813400000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a834fa5467250d3bab1d4d40", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2344, "timestamp_epoch": "1555349226.813744000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cf8a314dee4b5d84e5cde998", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2348, "timestamp_epoch": "1555349226.815290000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-389496dc8f696f12605013e4", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2349, "timestamp_epoch": "1555349226.816203000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ad923f90f12caee09e586c3e", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2350, "timestamp_epoch": "1555349226.816936000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ccda80e2d17e33d11e6cecae", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2351, "timestamp_epoch": "1555349226.817074000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e26f7173b7d566c0a8ac3780", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2352, "timestamp_epoch": "1555349226.817588000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-57867870f4ca30dce54a00d1", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2353, "timestamp_epoch": "1555349226.817952000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b9d136cf5b0b56155b1053b0", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2355, "timestamp_epoch": "1555349237.268800000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-597c01d5126355e6a349922f", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2356, "timestamp_epoch": "1555349237.269106000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-840a206cd7b07049cf3367ef", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2357, "timestamp_epoch": "1555349237.269370000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4bb3bb66c8832c95958407c8", "src_port": null, "tcp_stream": 79, "udp_stream": null, "frame_number": 2358, "timestamp_epoch": "1555349237.269532000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-abe5ba6b17428ae22bd10900", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2446, "timestamp_epoch": "1555350126.840788000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1820f54c4e0f1d15ff0638b5", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2447, "timestamp_epoch": "1555350126.840969000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5bd80592d4adcfb6b5c1147e", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2448, "timestamp_epoch": "1555350126.841232000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8f5155ab091e021c1cf7b8cf", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2452, "timestamp_epoch": "1555350126.842428000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6d7dfa1d0b37cb8d302b04f4", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2453, "timestamp_epoch": "1555350126.843119000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1b141dbc43d8e2b22d3f3cee", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2454, "timestamp_epoch": "1555350126.843584000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d2d403f6b6714fd7bb12445b", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2455, "timestamp_epoch": "1555350126.843725000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a9f8ad62adb44d08643321f8", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2456, "timestamp_epoch": "1555350126.844095000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6356458a588c6713993a23bd", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2457, "timestamp_epoch": "1555350126.844484000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0b5d75c6198a9885b58e88ef", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2459, "timestamp_epoch": "1555350137.278515000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-66ecc2d9d17f36104b5b0949", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2460, "timestamp_epoch": "1555350137.278846000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-61b228a6f20c4f399fbcd0e1", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2461, "timestamp_epoch": "1555350137.279232000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ac9cb8a626c66491ff28134c", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 2462, "timestamp_epoch": "1555350137.279416000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d7f39fb50f546b9e3656a843", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2570, "timestamp_epoch": "1555351026.885913000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-42e000039b1d94850e220350", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2571, "timestamp_epoch": "1555351026.886139000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-fa7d1b40617020e5472ce820", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2572, "timestamp_epoch": "1555351026.886369000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cb377eaaa421be4111931bd8", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2576, "timestamp_epoch": "1555351026.887575000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b825a96ee990cded46802b2c", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2577, "timestamp_epoch": "1555351026.888430000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b5c3e96d27437c083196c6c7", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2578, "timestamp_epoch": "1555351026.888930000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-cf53688ef26d1dfb76ce0f30", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2579, "timestamp_epoch": "1555351026.889077000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-abe2eca71c50a8d59070fdc0", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2580, "timestamp_epoch": "1555351026.889599000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3280e205e243607b03538300", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2581, "timestamp_epoch": "1555351026.889886000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5454c08e03b38d6973d36239", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2583, "timestamp_epoch": "1555351037.290166000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-76e08dbe187ff73d60398148", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2584, "timestamp_epoch": "1555351037.290403000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-70a3d7d76e5267be19e9b3b7", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2585, "timestamp_epoch": "1555351037.290526000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9946bbbfc88fa3f8a4ac4996", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 2586, "timestamp_epoch": "1555351037.290723000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-94c1ed4b1d1ec978d81d0785", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2671, "timestamp_epoch": "1555351861.966976000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c5db10135789500f64edbe73", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2672, "timestamp_epoch": "1555351861.967272000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0348daf30b1306501dcd914c", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2676, "timestamp_epoch": "1555351861.969863000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4500e5e55af904fd20b49a03", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2677, "timestamp_epoch": "1555351861.970756000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-312a0d6eaef079e8d5a76cb5", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2678, "timestamp_epoch": "1555351861.979108000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e4fa44c13055485b10c57510", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2679, "timestamp_epoch": "1555351861.979283000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3924556b55397eb676cc14a0", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2680, "timestamp_epoch": "1555351861.979534000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-fae9982e1a380fe514329933", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2681, "timestamp_epoch": "1555351862.081874000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d5a4369dd86e37be38c96013", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2682, "timestamp_epoch": "1555351862.082461000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-96bf80b0d56cc38f33178795", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2683, "timestamp_epoch": "1555351862.082841000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7da17bb3b4b802e29f0de29b", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2685, "timestamp_epoch": "1555351862.456301000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f1ee1f0595544069931738b9", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2686, "timestamp_epoch": "1555351862.456695000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1955ff9c78f23beb5691fac5", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2688, "timestamp_epoch": "1555351877.289554000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d0bb32c0f1330e59ad94e29d", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 2689, "timestamp_epoch": "1555351877.289891000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3a87d0b501f8ab0069103991", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2700, "timestamp_epoch": "1555351926.912326000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2c6434ab4505cb8717139a35", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2701, "timestamp_epoch": "1555351926.912450000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-555b04fc010f0bc54a5004b1", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2702, "timestamp_epoch": "1555351926.912663000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e0d6af68030dc0724d218123", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2706, "timestamp_epoch": "1555351926.913747000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-fb06247f0b35342f93e43fae", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2707, "timestamp_epoch": "1555351926.914719000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-6a77efce320a7a018ac89ffb", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2708, "timestamp_epoch": "1555351926.915305000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d2d280e5b80a6d11784cad83", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2709, "timestamp_epoch": "1555351926.915451000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-983e65c73d13c9b93e24330f", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2710, "timestamp_epoch": "1555351926.915859000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a536186726466d37f3f9e168", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2711, "timestamp_epoch": "1555351926.916170000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cdbf1d2cca33bc9f45b882ca", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2713, "timestamp_epoch": "1555351937.287696000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-eed98988fed29e58c9a843e9", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2714, "timestamp_epoch": "1555351937.288229000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d775d5dd242e7fa70bdb99f9", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2715, "timestamp_epoch": "1555351937.288688000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-60cbff39b87537d60bfdf4c9", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 2716, "timestamp_epoch": "1555351937.288892000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-666cb5bfe53038c7c6f65387", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 2780, "timestamp_epoch": "1555352174.238185000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4f83d104ced67c0e29c83f1e", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 2782, "timestamp_epoch": "1555352174.238962000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7b802ceaafab0ef1f32028a9", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 2783, "timestamp_epoch": "1555352174.239466000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0cd2eb14abce3859eb0d3e73", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2806, "timestamp_epoch": "1555352174.653540000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-90b01b8da72260c88bb4f7cc", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2808, "timestamp_epoch": "1555352174.654166000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-07a2449dea9bec9ff1616ad5", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 2817, "timestamp_epoch": "1555352174.769122000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6904bb39ceb4a083872b92d7", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 2819, "timestamp_epoch": "1555352174.769919000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-935854c03bb9f3660db4cac5", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2830, "timestamp_epoch": "1555352174.777088000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b8458fd3009061108a52dabb", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2831, "timestamp_epoch": "1555352174.777302000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a553748249f0dadb6eb903d3", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2832, "timestamp_epoch": "1555352174.777566000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c94a4fdca32824662bc7b9e5", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2836, "timestamp_epoch": "1555352174.778755000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-aa74b4e97c972f04a14506fe", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2837, "timestamp_epoch": "1555352174.779348000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e43eebf41e21dcbf4c5a9891", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2838, "timestamp_epoch": "1555352174.779732000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-41da2c0d13f47eb871f8898f", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2839, "timestamp_epoch": "1555352174.779853000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-bdcb32bfe304f4082313c082", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2840, "timestamp_epoch": "1555352174.780105000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0577b481b33d024addf20d02", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2841, "timestamp_epoch": "1555352174.780291000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cde8a9694a779f4ee5cd56ec", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2842, "timestamp_epoch": "1555352174.780708000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-61a31b4e7dd8c67f29b52574", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2843, "timestamp_epoch": "1555352174.780851000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ecd85d185c487f6cddc15ce3", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2844, "timestamp_epoch": "1555352174.781133000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-cc18561a2aaf9ce26470ff7e", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2845, "timestamp_epoch": "1555352174.781264000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0e9de0fbe689e415eef767b3", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2846, "timestamp_epoch": "1555352174.781858000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4855a195db4fdcb9629009e6", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2847, "timestamp_epoch": "1555352174.782221000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-aa2a108814097fc43e275c26", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2848, "timestamp_epoch": "1555352174.782601000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-571042d8159372682633947e", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2849, "timestamp_epoch": "1555352174.782770000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c254c50589019a969b50f8e9", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2870, "timestamp_epoch": "1555352189.290292000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0497b215cc3cd88192362fe0", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2871, "timestamp_epoch": "1555352189.290590000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-418b2af0496032857b2d237e", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2873, "timestamp_epoch": "1555352201.286846000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8d042bb5c3bd8a4a589170d9", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2874, "timestamp_epoch": "1555352201.287180000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-efecb60027fca8f94dc2a435", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2880, "timestamp_epoch": "1555352213.282608000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0d35085244c9339780f28efe", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2881, "timestamp_epoch": "1555352213.282856000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5737d11a94369780ae03a80a", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2882, "timestamp_epoch": "1555352213.283633000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b57e7411f233305995ee04b4", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 2883, "timestamp_epoch": "1555352213.283798000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-af334aead2ec33228cdd184b", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2956, "timestamp_epoch": "1555352711.135948000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-487474459f86c52c7144e4cd", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2958, "timestamp_epoch": "1555352711.136540000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-efbfac4f4a560719ac349463", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2959, "timestamp_epoch": "1555352711.136817000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-891ab278f2947c551ba379fb", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2973, "timestamp_epoch": "1555352711.647662000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3bb64d1e92fb3573d36e63ac", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2975, "timestamp_epoch": "1555352711.648467000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f25a500881655c0ed7c5b935", "src_port": null, "tcp_stream": 111, "udp_stream": null, "frame_number": 2984, "timestamp_epoch": "1555352711.762320000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-130e92b8c2a18f79d65f6eaa", "src_port": null, "tcp_stream": 111, "udp_stream": null, "frame_number": 2986, "timestamp_epoch": "1555352711.762961000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-391797ae562b709f1a816644", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 2997, "timestamp_epoch": "1555352711.766033000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a22401832e7c90d5c0a7bd8e", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 3000, "timestamp_epoch": "1555352711.766804000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9b392742d31d5a7128eb0034", "src_port": null, "tcp_stream": 113, "udp_stream": null, "frame_number": 3009, "timestamp_epoch": "1555352711.767700000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-96e54bfdd9c2a30d9103015f", "src_port": null, "tcp_stream": 113, "udp_stream": null, "frame_number": 3011, "timestamp_epoch": "1555352711.768189000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ee1c15a088d7cc61cc9fb132", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3019, "timestamp_epoch": "1555352711.770300000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5ed5fb2cc5379ce1f84f0cb8", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3020, "timestamp_epoch": "1555352711.770504000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a1b19adc87d491bd7fb30a85", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3021, "timestamp_epoch": "1555352711.770689000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5996a554619500942f95d698", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3025, "timestamp_epoch": "1555352711.771933000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-458806e44821803b5f262482", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3026, "timestamp_epoch": "1555352711.772498000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-658971d51cee6439c1ab0e57", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3027, "timestamp_epoch": "1555352711.772966000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a12590975dd560d02d00dd69", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3028, "timestamp_epoch": "1555352711.773105000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c4b6ed1c88bab942e49857f2", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3029, "timestamp_epoch": "1555352711.773711000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ef3c99954adf232943851843", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3030, "timestamp_epoch": "1555352711.774016000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-134d5097a2a2ad1a016c0691", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3031, "timestamp_epoch": "1555352711.774387000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6bde70478e085ae7cd42e800", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3032, "timestamp_epoch": "1555352711.774540000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-120c342293b9a354ee333214", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3045, "timestamp_epoch": "1555352735.276639000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8e0c020107fd05c65d531de3", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3046, "timestamp_epoch": "1555352735.276906000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-433cb37117e1cf22b5a5b692", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3054, "timestamp_epoch": "1555352747.287481000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-92f9f86dc69fdd15d264ea60", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3055, "timestamp_epoch": "1555352747.287724000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-800030e16aa362ba5adbaf62", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3056, "timestamp_epoch": "1555352747.287922000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ff685ebb163a5ad3dcfafc5e", "src_port": null, "tcp_stream": 114, "udp_stream": null, "frame_number": 3057, "timestamp_epoch": "1555352747.288080000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-214e31e3e1f9f839c4477f37", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3070, "timestamp_epoch": "1555352826.941162000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b20133d89958927513c12788", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3071, "timestamp_epoch": "1555352826.941426000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5eaf93eb2a75446fc599ca43", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3072, "timestamp_epoch": "1555352826.941616000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-bd9dafd74d283e2d0a7ce6c3", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3076, "timestamp_epoch": "1555352826.942918000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9e851c5dcabf1c710a0ffe72", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3077, "timestamp_epoch": "1555352826.943791000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ae8144ecd8d5453e900bf441", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3078, "timestamp_epoch": "1555352826.944316000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8d2fd7e3d7d4a23d173fdbd9", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3079, "timestamp_epoch": "1555352826.944477000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-391a9ac186d705c8671c15e7", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3080, "timestamp_epoch": "1555352826.944851000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-00c589b0a3a2aa705dd0366b", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3081, "timestamp_epoch": "1555352826.945144000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-001e813476ced7f650188eed", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3083, "timestamp_epoch": "1555352837.285671000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ad14418cda0fc83d0cc75ef0", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3084, "timestamp_epoch": "1555352837.285974000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-6f69771d7d526140d9ffcf88", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3085, "timestamp_epoch": "1555352837.286305000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-caa067daa6bd851101c7a060", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 3086, "timestamp_epoch": "1555352837.286567000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-863baf4f1171672a69bbd500", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3190, "timestamp_epoch": "1555353726.968894000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5440c2c15bd72999c048d977", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3191, "timestamp_epoch": "1555353726.969031000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-99405523226eed5bfa744f69", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3192, "timestamp_epoch": "1555353726.969198000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-79998e6290c243eef73f1e80", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3196, "timestamp_epoch": "1555353726.970497000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-09317a6c17e7bfdb62f30534", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3197, "timestamp_epoch": "1555353726.971160000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-82fe5ecc50b3d69a869fbd9b", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3198, "timestamp_epoch": "1555353726.971701000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-bb22c77d42f80065ab7fb5de", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3199, "timestamp_epoch": "1555353726.971855000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1fff3f319069156df1af74ea", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3200, "timestamp_epoch": "1555353726.972341000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-96d3d918923f6d36c12db593", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3201, "timestamp_epoch": "1555353726.972656000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f8d569e22491078bb556041c", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3203, "timestamp_epoch": "1555353737.297753000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-028e3afcecddd7ee91951fec", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3204, "timestamp_epoch": "1555353737.297981000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-050519e4da98715594c3660f", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3205, "timestamp_epoch": "1555353737.298384000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-211d4a260f3bf393108ffdfe", "src_port": null, "tcp_stream": 120, "udp_stream": null, "frame_number": 3206, "timestamp_epoch": "1555353737.298564000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:67:e5:b1:53:fa", "dns.qry.name": "Seoul-4a67-PC" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-942c0ac5f2ec724c4814ad72", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 3279, "timestamp_epoch": "1555354242.022930000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:67:e5:b1:53:fa", "dns.qry.name": "Seoul-4a67-PC" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cdebbb9d0de83afc4a933ccd", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 3286, "timestamp_epoch": "1555354242.128002000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2107e0774345e96972dabf44", "src_port": null, "tcp_stream": 125, "udp_stream": null, "frame_number": 3302, "timestamp_epoch": "1555354242.379984000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7bd40ecd1f4401135779811f", "src_port": null, "tcp_stream": 125, "udp_stream": null, "frame_number": 3304, "timestamp_epoch": "1555354242.380589000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:67:e5:b1:53:fa", "dns.qry.name": "Seoul-4a67-PC" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2275d6e00f5305dcca936ebf", "src_port": null, "tcp_stream": null, "udp_stream": 63, "frame_number": 3315, "timestamp_epoch": "1555354245.317243000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:67:e5:b1:53:fa", "dns.qry.name": "wpad" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3c4791933ded821b7fc52b70", "src_port": null, "tcp_stream": null, "udp_stream": 65, "frame_number": 3318, "timestamp_epoch": "1555354245.317909000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<00>,SEOUL-4A67-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-71caa7046c673653ba065d8e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3327, "timestamp_epoch": "1555354245.388296000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "STINGRAYAHOY<00>,STINGRAYAHOY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d22f7bd055e3910832071d0a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3328, "timestamp_epoch": "1555354245.388638000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<20>,SEOUL-4A67-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7a4f8d64f858d076bb5b4ccd", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3329, "timestamp_epoch": "1555354245.389045000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:67:e5:b1:53:fa", "dns.qry.name": "wpad" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2511729a1427bc8efc370ca4", "src_port": null, "tcp_stream": null, "udp_stream": 65, "frame_number": 3330, "timestamp_epoch": "1555354245.419433000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:67:e5:b1:53:fa", "dns.qry.name": "Seoul-4a67-PC" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b89e155907c13cbf21212df0", "src_port": null, "tcp_stream": null, "udp_stream": 63, "frame_number": 3331, "timestamp_epoch": "1555354245.419539000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c6374d524f323c4dc23d7546", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3332, "timestamp_epoch": "1555354245.622461000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<20>,SEOUL-4A67-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1e480bdf832f99350f5a0fdd", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3334, "timestamp_epoch": "1555354246.152451000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "STINGRAYAHOY<00>,STINGRAYAHOY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2aa5fa010fe4edf71e6dc788", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3335, "timestamp_epoch": "1555354246.152589000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<00>,SEOUL-4A67-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0081abe42d606067e113cd56", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3336, "timestamp_epoch": "1555354246.152686000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c49b1e97af3ae49eaf11d0a6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3337, "timestamp_epoch": "1555354246.386652000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<00>,SEOUL-4A67-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4c9812701c7f9c86627040c0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3338, "timestamp_epoch": "1555354246.916751000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "STINGRAYAHOY<00>,STINGRAYAHOY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c0835d824697c8d4e0979806", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3339, "timestamp_epoch": "1555354246.916930000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<20>,SEOUL-4A67-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-fc2ee047d52ffd13b9da4be5", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3340, "timestamp_epoch": "1555354246.917020000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e5b6adac536b23577cccc700", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3341, "timestamp_epoch": "1555354247.150842000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<20>,SEOUL-4A67-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-68444c93acaf633f56b08693", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3342, "timestamp_epoch": "1555354247.681153000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "STINGRAYAHOY<00>,STINGRAYAHOY<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cb8c4a16a153bddb741ccdd8", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3343, "timestamp_epoch": "1555354247.681379000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "SEOUL-4A67-PC<00>,SEOUL-4A67-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-02dd747a5aa5d45b2990d293", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3344, "timestamp_epoch": "1555354247.681635000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b92f3ccdd0ae185753692037", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3345, "timestamp_epoch": "1555354248.323095000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-309335275c8e45bd4795180a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3346, "timestamp_epoch": "1555354249.086574000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-50d464292dc3ec082841bb4d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3347, "timestamp_epoch": "1555354249.849566000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-87ed0771743f39afedc8c98e", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3354, "timestamp_epoch": "1555354302.119361000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8dbcdc20cc4e6590050de56a", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3355, "timestamp_epoch": "1555354302.119493000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9bf714391d0ae43562e42578", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3356, "timestamp_epoch": "1555354302.119682000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-fa7be3023a4161862b4fcee4", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3360, "timestamp_epoch": "1555354302.120602000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3fc1137670e5f42884fbc6ae", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3361, "timestamp_epoch": "1555354302.121372000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1904a21ed00693463c92ed6b", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3362, "timestamp_epoch": "1555354302.121708000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-76257c1088a2f4c18f2af099", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3363, "timestamp_epoch": "1555354302.121852000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9c61da7be93dbf0cd6efddd3", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3364, "timestamp_epoch": "1555354302.122074000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-83857ab72b50ee56b89cfe06", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3365, "timestamp_epoch": "1555354302.122364000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9c5e05f34671539096ee599a", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3367, "timestamp_epoch": "1555354313.296835000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-758e696932402f85d90d2ec8", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3368, "timestamp_epoch": "1555354313.297085000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3740d2205a2a53ea5f2fdd06", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3369, "timestamp_epoch": "1555354313.297285000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-cc86bf22ed231654bf8a4f06", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 3370, "timestamp_epoch": "1555354313.297450000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1737ff7dd5687664a490ce88", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3492, "timestamp_epoch": "1555355202.141787000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-722dccc8a559c19904097aaf", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3493, "timestamp_epoch": "1555355202.141978000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e0e41852600b1141c7a6f717", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3494, "timestamp_epoch": "1555355202.142178000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4201af9d92114befc3413a07", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3498, "timestamp_epoch": "1555355202.143573000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2f773bdd3348c7beffe4fa55", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3499, "timestamp_epoch": "1555355202.144419000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d69bbd272946c0bc28e01a4c", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3500, "timestamp_epoch": "1555355202.144913000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2f760d62586b04853b27d97f", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3501, "timestamp_epoch": "1555355202.145109000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1b9e72006cb46e82453c5edd", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3502, "timestamp_epoch": "1555355202.145453000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-44917a1057a96e61b73b0f60", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3503, "timestamp_epoch": "1555355202.145645000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3fbfa1c4b7ed8c8536702217", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3505, "timestamp_epoch": "1555355213.292170000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-bd00614a963426da50264e6f", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3506, "timestamp_epoch": "1555355213.292464000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b15a4cf01f8b5b8e5ac50cec", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3507, "timestamp_epoch": "1555355213.292659000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c13e6475e0e85e5e15ad5c67", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 3508, "timestamp_epoch": "1555355213.292853000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5341e70574734c22b9150d9f", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3607, "timestamp_epoch": "1555356102.163285000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2bdd70123dbc606d5ca059f1", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3608, "timestamp_epoch": "1555356102.163525000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ed3dac0a425fcc253a81fe4b", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3609, "timestamp_epoch": "1555356102.163767000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f48515f2bb2c9fdad6090343", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3613, "timestamp_epoch": "1555356102.165277000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-25cb8f26f8712f68373b6a1d", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3614, "timestamp_epoch": "1555356102.166171000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3e29cea0c7d10180a07561c3", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3615, "timestamp_epoch": "1555356102.166734000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e45f5d5d2186fd1feb451117", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3616, "timestamp_epoch": "1555356102.166920000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7e351c4b067f9deec5eff288", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3617, "timestamp_epoch": "1555356102.167331000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ef9cbd76b5d15c2a7c33e801", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3618, "timestamp_epoch": "1555356102.167587000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-fc212f10fc8c678f195885cd", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3623, "timestamp_epoch": "1555356113.304795000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6767fbdb541db91aa037628a", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3624, "timestamp_epoch": "1555356113.305151000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-bd848cf5fbb27f5cee582d16", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3625, "timestamp_epoch": "1555356113.305965000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f39284cc75bf7dfba800e8d4", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 3626, "timestamp_epoch": "1555356113.306215000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7bdc106ca37f155153e30eaa", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3747, "timestamp_epoch": "1555357002.195815000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-98c8d9fb0ce4b0b42accfabe", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3748, "timestamp_epoch": "1555357002.196049000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6c277bfcf2696870c36b8096", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3749, "timestamp_epoch": "1555357002.196262000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-77de4d5f253bce81f5d2ddee", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3753, "timestamp_epoch": "1555357002.197583000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9f8d2b466d0f954f1054fc78", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3754, "timestamp_epoch": "1555357002.198502000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3d6f907f13bd0ff51a3ad91d", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3755, "timestamp_epoch": "1555357002.199088000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f75435b6b98fd8ed89533a7a", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3756, "timestamp_epoch": "1555357002.199215000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-6e03a37d5e4a819040fb3621", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3757, "timestamp_epoch": "1555357002.199547000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-25326d6424d927c00c5b6b55", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3758, "timestamp_epoch": "1555357002.199829000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-dcaf058472bcff34e770402c", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3760, "timestamp_epoch": "1555357013.301464000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c3a07908fcef74c43be09574", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3761, "timestamp_epoch": "1555357013.301805000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-018a94c3fff426f5c007199a", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3762, "timestamp_epoch": "1555357013.302579000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-49f37bb749385cce39f35e83", "src_port": null, "tcp_stream": 143, "udp_stream": null, "frame_number": 3763, "timestamp_epoch": "1555357013.302776000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4a8e35f9d6b6af2db7f2898c", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3864, "timestamp_epoch": "1555357902.220423000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-591d721ded35a69816116c11", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3865, "timestamp_epoch": "1555357902.220619000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1ffea522f94cb1b4e8c22375", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3866, "timestamp_epoch": "1555357902.220810000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-06e2f24c9cb41045ae9c591b", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3870, "timestamp_epoch": "1555357902.222105000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e14e60d7495e87662c9fa4e4", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3871, "timestamp_epoch": "1555357902.223008000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f2bdae9b238b691bdfcb0335", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3872, "timestamp_epoch": "1555357902.223516000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c91238bcd4942d58103a9e93", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3873, "timestamp_epoch": "1555357902.223684000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c342bc59919e4397de183f68", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3874, "timestamp_epoch": "1555357902.223978000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c9745914a17520f3ae524d83", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3875, "timestamp_epoch": "1555357902.224208000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f538578b149d612f90eb9997", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3880, "timestamp_epoch": "1555357913.299939000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-728c9a089cb33f2e45432ba5", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3881, "timestamp_epoch": "1555357913.300191000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-016b2af85a9223cb5b19d940", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3882, "timestamp_epoch": "1555357913.300579000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f0c3fffaa7cd1d35914d9d91", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 3883, "timestamp_epoch": "1555357913.300734000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-221bd4e42fe8c7bb35237482", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 3911, "timestamp_epoch": "1555357995.841232000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-109044647a346b5ca0426d52", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 3913, "timestamp_epoch": "1555357995.842030000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ee462ce3639ad5e1e86a3af3", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 3914, "timestamp_epoch": "1555357995.842274000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-46574074cb8253d7b4f7f909", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 3934, "timestamp_epoch": "1555357995.956532000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a4f178d3d387c50a9423e7f9", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 3936, "timestamp_epoch": "1555357995.957216000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cb054b5deef1439ddb5a062a", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 3947, "timestamp_epoch": "1555357996.074107000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-07e8f6c8b5b8547c5342b2f0", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 3949, "timestamp_epoch": "1555357996.074921000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-456f8c46adb20b9ccb98a267", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3960, "timestamp_epoch": "1555357996.082465000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7a873b67b844c551e4402d60", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3961, "timestamp_epoch": "1555357996.082625000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b4537231381e7086b0d6be78", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3962, "timestamp_epoch": "1555357996.082801000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cdfb8e2eec98c0329cc5d2fb", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3966, "timestamp_epoch": "1555357996.083914000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-15cfd759cdab2c6c3fcd02c5", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3967, "timestamp_epoch": "1555357996.084541000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2568df4dd0aa6126c91a61b3", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3968, "timestamp_epoch": "1555357996.084971000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f68f089040a13bb4f530a0b3", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3969, "timestamp_epoch": "1555357996.085187000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-824dcb4395622627e0a8c6d7", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3970, "timestamp_epoch": "1555357996.085549000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-677a299653f0c32283723031", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3971, "timestamp_epoch": "1555357996.087655000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0d8d292cb124f8e3c8a5a4e8", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3972, "timestamp_epoch": "1555357996.087976000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-abf8bf0a44da7ba5df59d847", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3973, "timestamp_epoch": "1555357996.088198000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2c96fe00b2cfaad719403c4c", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3974, "timestamp_epoch": "1555357996.088461000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7f846f7b145c00d520ff7c9d", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3975, "timestamp_epoch": "1555357996.088619000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0e1c644efca1ebe8aae8a5b3", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3976, "timestamp_epoch": "1555357996.089218000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7c185d5126d29fa154ad359d", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3977, "timestamp_epoch": "1555357996.089582000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7223ca1b6803924c13f2875a", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3978, "timestamp_epoch": "1555357996.090253000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-36ff2f2b92e454dee3569e83", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3979, "timestamp_epoch": "1555357996.090456000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7941709f075eeeab225eb258", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3996, "timestamp_epoch": "1555358009.300629000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5f3976268890329b478e6c30", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3997, "timestamp_epoch": "1555358009.300969000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-fe0cec7d5446be442381e838", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 3999, "timestamp_epoch": "1555358021.299003000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c4098eee709a79089a523237", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 4000, "timestamp_epoch": "1555358021.299315000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d580d5332a3df06b3249afe5", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 4006, "timestamp_epoch": "1555358033.294656000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b60ad9a33e6c62140f9d4e85", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 4007, "timestamp_epoch": "1555358033.294953000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-48f8ced05e9b59f9e24f8d64", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 4008, "timestamp_epoch": "1555358033.295724000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a37a19aade73ba908ba43e44", "src_port": null, "tcp_stream": 154, "udp_stream": null, "frame_number": 4009, "timestamp_epoch": "1555358033.295970000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-fb2f561a1ba98703c30fcd3b", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4129, "timestamp_epoch": "1555358802.248405000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-800d1775b27f52d5014f3a87", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4130, "timestamp_epoch": "1555358802.248550000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ac151ecd758b401cb0ba0742", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4131, "timestamp_epoch": "1555358802.248758000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-739de0c457b8f69d2e287a7d", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4135, "timestamp_epoch": "1555358802.249950000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8fbe439cb2112de4883d5959", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4136, "timestamp_epoch": "1555358802.250819000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-eca3727f371980ead45d9489", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4137, "timestamp_epoch": "1555358802.251466000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-de3b753c5f114ac3174d07dc", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4138, "timestamp_epoch": "1555358802.251635000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a49df4aab9429a0d0e013930", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4139, "timestamp_epoch": "1555358802.251942000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8cfd31f8d26ccecc626c5deb", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4140, "timestamp_epoch": "1555358802.252175000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b6d98fbd1286f3edd0877b3b", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4142, "timestamp_epoch": "1555358813.297041000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-006c4b8ec33217afda99b43e", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4143, "timestamp_epoch": "1555358813.297334000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-89f0c03d5b428413eab1ac49", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4144, "timestamp_epoch": "1555358813.297797000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e6a3376815441843ce104eae", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 4145, "timestamp_epoch": "1555358813.298063000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5ec4e0be5992ecf70a6b8ff4", "src_port": null, "tcp_stream": 165, "udp_stream": null, "frame_number": 4232, "timestamp_epoch": "1555359552.312363000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b17138690c6d26707baade43", "src_port": null, "tcp_stream": 165, "udp_stream": null, "frame_number": 4234, "timestamp_epoch": "1555359552.312955000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ae20394d6322c69de5fde6e6", "src_port": null, "tcp_stream": 165, "udp_stream": null, "frame_number": 4235, "timestamp_epoch": "1555359552.313175000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-898babdea807d655aa9862a9", "src_port": null, "tcp_stream": 166, "udp_stream": null, "frame_number": 4257, "timestamp_epoch": "1555359552.823805000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-aed12c07ced9d894fa449fb1", "src_port": null, "tcp_stream": 166, "udp_stream": null, "frame_number": 4259, "timestamp_epoch": "1555359552.824511000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-de4ad11e7c8af6e0aa9441d6", "src_port": null, "tcp_stream": 167, "udp_stream": null, "frame_number": 4268, "timestamp_epoch": "1555359552.934589000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a8d979057ac253c83a0efb63", "src_port": null, "tcp_stream": 167, "udp_stream": null, "frame_number": 4270, "timestamp_epoch": "1555359552.935285000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-32e59457557479f5a9be01b0", "src_port": null, "tcp_stream": 168, "udp_stream": null, "frame_number": 4281, "timestamp_epoch": "1555359552.938932000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f9d1e80781080211f8124952", "src_port": null, "tcp_stream": 168, "udp_stream": null, "frame_number": 4284, "timestamp_epoch": "1555359552.939853000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4297a868fc704f79f9ea641f", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 4295, "timestamp_epoch": "1555359552.940773000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ecae32c209d5c5b47d9bd9fb", "src_port": null, "tcp_stream": 169, "udp_stream": null, "frame_number": 4299, "timestamp_epoch": "1555359552.941297000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ba7babbb5cd38570080424d0", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4301, "timestamp_epoch": "1555359552.941504000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d506b326767a5998266b0d7e", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4303, "timestamp_epoch": "1555359552.941650000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e3fc9dc65614816165d86f83", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4305, "timestamp_epoch": "1555359552.941880000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2adec3b7663f007322d913ee", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4309, "timestamp_epoch": "1555359552.943008000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6990de57b33f47cb9372df45", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4310, "timestamp_epoch": "1555359552.943609000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-daa33d8091f3c4c3cc9e69cb", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4311, "timestamp_epoch": "1555359552.944041000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2a6a31b6c560f4d0714c3a7a", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4312, "timestamp_epoch": "1555359552.944216000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a22fd8ddbced061fadadf73c", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4313, "timestamp_epoch": "1555359552.944604000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3ada4d0d6ffe00c275d80b7a", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4314, "timestamp_epoch": "1555359552.946590000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-bd8acdb2b3848ede68887e77", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4315, "timestamp_epoch": "1555359552.946974000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3eeba4c6c5cff4ece4bebbfe", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4316, "timestamp_epoch": "1555359552.947222000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-15e9ed3db4bdbffac87e95f6", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4317, "timestamp_epoch": "1555359552.947537000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-48a5a09493b85bf3d91031e2", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4318, "timestamp_epoch": "1555359552.947750000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c0f13909d2ebd510429a484d", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4319, "timestamp_epoch": "1555359552.948356000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-85b7bf5ae6041f9d1ce832ed", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4320, "timestamp_epoch": "1555359552.948641000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-bb5f6f4e2d8fe6cb155f2342", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4321, "timestamp_epoch": "1555359552.949167000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4f674daea1d80337720cc8a9", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4322, "timestamp_epoch": "1555359552.949344000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2f9a8547b23c4fcf1c7fab58", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4331, "timestamp_epoch": "1555359563.299727000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d9c4d623ef8c39fe3c879474", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4332, "timestamp_epoch": "1555359563.299977000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f289cb7a61e793fb26d27464", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4338, "timestamp_epoch": "1555359575.296045000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ac1a1042c63e33c45a275375", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4339, "timestamp_epoch": "1555359575.296323000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d9570f816a1bca479a5c1ef9", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4353, "timestamp_epoch": "1555359587.291211000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ca65c5e1d479caad8becf269", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4354, "timestamp_epoch": "1555359587.291506000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cbb981bb2bba8e10c2e2e7a9", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4355, "timestamp_epoch": "1555359587.291759000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-dd070d36d26e40f2c49dcbb7", "src_port": null, "tcp_stream": 170, "udp_stream": null, "frame_number": 4356, "timestamp_epoch": "1555359587.291967000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-36804d9ce78352053cbc14c3", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4368, "timestamp_epoch": "1555359702.275142000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d435065155ff0aebb6bb9f54", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4369, "timestamp_epoch": "1555359702.275303000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c17abb373443429a99656a33", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4370, "timestamp_epoch": "1555359702.275528000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f8d711316e8af14cf8a6fbb3", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4374, "timestamp_epoch": "1555359702.276765000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a7512b9e8c000eb8a7fd80b6", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4375, "timestamp_epoch": "1555359702.277588000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8f538f398a18ed53a41f3d89", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4376, "timestamp_epoch": "1555359702.277978000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8db003f720c370582ef9898b", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4377, "timestamp_epoch": "1555359702.278139000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8be1b2e7a300ca147ea78196", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4378, "timestamp_epoch": "1555359702.278379000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1f032b1cd1a9c29c0538d499", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4379, "timestamp_epoch": "1555359702.278613000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-244c321d63e23e4a47355a7f", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4381, "timestamp_epoch": "1555359713.291817000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-284dc4f61b42fc370076390f", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4382, "timestamp_epoch": "1555359713.292109000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9d8a73329628aa8f1e58cc2a", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4383, "timestamp_epoch": "1555359713.293049000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3e99d23ebfbaabd3810b6f54", "src_port": null, "tcp_stream": 174, "udp_stream": null, "frame_number": 4384, "timestamp_epoch": "1555359713.293265000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-dad857c853bf048a2a1d4d38", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4508, "timestamp_epoch": "1555360602.306828000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1f07c1f12b48c152307da4c9", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4509, "timestamp_epoch": "1555360602.307180000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-99148b98bb8753487d2c6116", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4510, "timestamp_epoch": "1555360602.307391000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b74cc4d0016f58110bdfb4bd", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4514, "timestamp_epoch": "1555360602.308818000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6b772b5aa6d1b193601f5450", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4515, "timestamp_epoch": "1555360602.309667000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-6250a1e9054e942faedcd525", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4516, "timestamp_epoch": "1555360602.310100000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b18241ec60771bb6570d4a88", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4517, "timestamp_epoch": "1555360602.310240000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-122193bdee931276dbf37407", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4518, "timestamp_epoch": "1555360602.310821000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-62fe7385cd28100e1a1fbdbe", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4519, "timestamp_epoch": "1555360602.311109000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0da7b6347e082f63374e9787", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4521, "timestamp_epoch": "1555360613.304006000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f877724635a7d83d712ebbab", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4522, "timestamp_epoch": "1555360613.304323000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8da5518f7720574326da9470", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4523, "timestamp_epoch": "1555360613.304524000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7281e53979936eb2dd63cd61", "src_port": null, "tcp_stream": 180, "udp_stream": null, "frame_number": 4524, "timestamp_epoch": "1555360613.304746000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-85cb753976aac1b63abaadb4", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4628, "timestamp_epoch": "1555361502.333288000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a60374b550bfa4dea48f093c", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4629, "timestamp_epoch": "1555361502.333456000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-79afb6bc2e290dfb42c17c02", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4630, "timestamp_epoch": "1555361502.333647000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-81bacc77ac3fd8990eefc277", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4634, "timestamp_epoch": "1555361502.334885000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-817cf24466a299bb7977fbd9", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4635, "timestamp_epoch": "1555361502.335584000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ecb9b4d4053fa6e53deb9b8a", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4636, "timestamp_epoch": "1555361502.336049000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7d5aa9902f8afef6e2841fb4", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4637, "timestamp_epoch": "1555361502.336214000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2642222926825db0e7401509", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4638, "timestamp_epoch": "1555361502.336550000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5e307858036bf300cd43de2a", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4639, "timestamp_epoch": "1555361502.336765000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-193fec647e5fa85639710a9d", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4644, "timestamp_epoch": "1555361513.300426000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6c5f9999d8867d98ae31dfa9", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4645, "timestamp_epoch": "1555361513.300675000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2e2590779661a41ac84b6269", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4646, "timestamp_epoch": "1555361513.301071000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b0a10e359b6921ddd2fcdd93", "src_port": null, "tcp_stream": 185, "udp_stream": null, "frame_number": 4647, "timestamp_epoch": "1555361513.301273000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0f791cd4d14e959a189baff9", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4767, "timestamp_epoch": "1555362402.364020000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c998d199e2952324abd1e588", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4768, "timestamp_epoch": "1555362402.364333000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ae2879c27c7461565e7b915a", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4769, "timestamp_epoch": "1555362402.364554000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-eb759b904c08148a50a6c0b7", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4773, "timestamp_epoch": "1555362402.365997000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e4101aa8f180b8d67d24dc45", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4774, "timestamp_epoch": "1555362402.366858000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0a5f913f0fd9b1eaca83a6f3", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4775, "timestamp_epoch": "1555362402.367288000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1edb42bcf163cdc8e753022b", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4776, "timestamp_epoch": "1555362402.367453000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b1ca7c669960d5c69d5b8695", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4777, "timestamp_epoch": "1555362402.367932000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8285ed7aa283543afe09618b", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4778, "timestamp_epoch": "1555362402.368316000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a75eef20ca3687bc615f41f4", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4780, "timestamp_epoch": "1555362413.299658000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a857429a84c2d2d7a856c1f5", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4781, "timestamp_epoch": "1555362413.299895000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-21dc69dbdce5a2461694a84c", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4782, "timestamp_epoch": "1555362413.300169000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-59171aeb77e3bbecdf50e15b", "src_port": null, "tcp_stream": 191, "udp_stream": null, "frame_number": 4783, "timestamp_epoch": "1555362413.300514000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-cf4351a4a8f08a26dd4f3a04", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4894, "timestamp_epoch": "1555363302.389826000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f4b2b3cb3d50f20455136b71", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4895, "timestamp_epoch": "1555363302.390017000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9613a6096047c684cec0b2ea", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4896, "timestamp_epoch": "1555363302.390266000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2e54befacc078b753eb3a41f", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4900, "timestamp_epoch": "1555363302.391739000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c3bbf5b5f45e7021a56d1e91", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4901, "timestamp_epoch": "1555363302.392581000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7da22fd8bd5b29c1498f2daf", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4902, "timestamp_epoch": "1555363302.393106000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3bfdffad3273ad702393979f", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4903, "timestamp_epoch": "1555363302.393272000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8670b7fc21d71a0d0cb823c4", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4904, "timestamp_epoch": "1555363302.393652000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-cd7d1dd21444318970206450", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4905, "timestamp_epoch": "1555363302.393887000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b626933b727c753092edecba", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4912, "timestamp_epoch": "1555363313.294225000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5c21b2c5f65f4e692dda6b46", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4913, "timestamp_epoch": "1555363313.294568000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ea4a493d580812e5eb159a3b", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4914, "timestamp_epoch": "1555363313.294917000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7c1b7b1f89dedb489e266918", "src_port": null, "tcp_stream": 197, "udp_stream": null, "frame_number": 4915, "timestamp_epoch": "1555363313.295127000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:67:e5:b1:53:fa", "dns.qry.name": "wpad" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1088ac8303e89f8600156d40", "src_port": null, "tcp_stream": null, "udp_stream": 84, "frame_number": 5376, "timestamp_epoch": "1555363518.842947000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "d0:67:e5:b1:53:fa", "dns.qry.name": "wpad" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e75cf38f1aefb43c4ddea2fd", "src_port": null, "tcp_stream": null, "udp_stream": 84, "frame_number": 5377, "timestamp_epoch": "1555363518.948865000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-069555ede5d110aa5de7f25e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 5382, "timestamp_epoch": "1555363519.152218000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b22d605afa0a596f71e8ea7f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 5548, "timestamp_epoch": "1555363519.915819000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "d0:67:e5:b1:53:fa", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0d74d0b0845cd474072c7646", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6234, "timestamp_epoch": "1555363520.680436000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4632ba230012b60207112891", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 9809, "timestamp_epoch": "1555363523.742733000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0816425cea0c78cdf6baaf71", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 9811, "timestamp_epoch": "1555363523.743242000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2aa5977627f3a7caa06aeb10", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 9812, "timestamp_epoch": "1555363523.743492000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c9f7452d476790981e9c53db", "src_port": null, "tcp_stream": 205, "udp_stream": null, "frame_number": 9864, "timestamp_epoch": "1555363576.615841000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3e63fc25a4332fcec04b2ed8", "src_port": null, "tcp_stream": 205, "udp_stream": null, "frame_number": 9866, "timestamp_epoch": "1555363576.616419000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-834f7d046c4579ac783a82e7", "src_port": null, "tcp_stream": 205, "udp_stream": null, "frame_number": 9867, "timestamp_epoch": "1555363576.616737000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-968b0b8f2b03208eb20ddd80", "src_port": null, "tcp_stream": 207, "udp_stream": null, "frame_number": 9899, "timestamp_epoch": "1555363577.238374000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5f691821d75ab76df5bc7026", "src_port": null, "tcp_stream": 207, "udp_stream": null, "frame_number": 9901, "timestamp_epoch": "1555363577.239010000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-aae05859e3fa8b90b3347cda", "src_port": null, "tcp_stream": 208, "udp_stream": null, "frame_number": 9910, "timestamp_epoch": "1555363577.344925000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-48292fb7e319424aa735feae", "src_port": null, "tcp_stream": 208, "udp_stream": null, "frame_number": 9912, "timestamp_epoch": "1555363577.345753000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-62e1498cca0284c59c81b53e", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9923, "timestamp_epoch": "1555363577.352912000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f59593d34a5fddda38d9b855", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9924, "timestamp_epoch": "1555363577.353121000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-737c42a216ea64664fab0c54", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9925, "timestamp_epoch": "1555363577.353301000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b408d1ea5c1a33c83659cc1a", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9929, "timestamp_epoch": "1555363577.354727000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-fc88c0cf5f3c2f4d445f046c", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9930, "timestamp_epoch": "1555363577.355365000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-27e491711968e2c101fb91bf", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9931, "timestamp_epoch": "1555363577.355763000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ed95250fd5cea132e83affb0", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9932, "timestamp_epoch": "1555363577.355909000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5ff3f29c258f990771ed09e4", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9933, "timestamp_epoch": "1555363577.356448000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ebd026251c4b07a8389bce48", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9934, "timestamp_epoch": "1555363577.356745000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d0ecca259fa5b70e1b438a90", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9935, "timestamp_epoch": "1555363577.357084000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7125f21013fff55d6f9b4cd1", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9936, "timestamp_epoch": "1555363577.357305000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-617167170a71326bc9603684", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9937, "timestamp_epoch": "1555363577.357576000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-643451342fdbdf03e4319ee1", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9938, "timestamp_epoch": "1555363577.357723000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-6d3539cc4568a3c32ad4e147", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9939, "timestamp_epoch": "1555363577.358613000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0c8d60c9fa11b5e3cd486889", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9940, "timestamp_epoch": "1555363577.358919000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c45881080eb4c66c819923b1", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9941, "timestamp_epoch": "1555363577.359361000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6db7da146ba73f76bb5625bb", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9942, "timestamp_epoch": "1555363577.359510000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d9041f9e2539b000ba0df43e", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9965, "timestamp_epoch": "1555363589.292511000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e415539756994b5c52963c5a", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9966, "timestamp_epoch": "1555363589.292743000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0ed7142be75eb2b2558213c8", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9968, "timestamp_epoch": "1555363601.302978000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ac45218e1ee43743141004d1", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9969, "timestamp_epoch": "1555363601.303272000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ad1ce04c1460ec2afaf0e5d2", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9975, "timestamp_epoch": "1555363613.300233000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c19502de68833366ae6e202a", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9976, "timestamp_epoch": "1555363613.300480000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b3a219fc00262f0460a51da0", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9977, "timestamp_epoch": "1555363613.300672000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d2d255557117e465cfd9c327", "src_port": null, "tcp_stream": 209, "udp_stream": null, "frame_number": 9978, "timestamp_epoch": "1555363613.300835000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c94e0604198b2d87d4b07c1c", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10088, "timestamp_epoch": "1555364202.414679000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1b09933165e0501a848d10a5", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10089, "timestamp_epoch": "1555364202.414907000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4456017f55e59dd93da6ae03", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10090, "timestamp_epoch": "1555364202.415114000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e1f7b8a29e5f748dabdb2e7d", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10094, "timestamp_epoch": "1555364202.416412000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8cd457f4cc272b34d21beb2d", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10095, "timestamp_epoch": "1555364202.417012000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0cf4eb90c16037967185b233", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10096, "timestamp_epoch": "1555364202.417664000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-fd9821fcca62bf3afac96680", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10097, "timestamp_epoch": "1555364202.417826000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c6fba1cbda029914b923ecf0", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10098, "timestamp_epoch": "1555364202.418199000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6c5d7257c8e0b813a29bf511", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10099, "timestamp_epoch": "1555364202.418426000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-455733b6ac695207282f7537", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10101, "timestamp_epoch": "1555364213.291226000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1792bdbf17592c274401f3ce", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10102, "timestamp_epoch": "1555364213.291468000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-98d7e05e20d1521b446e2edf", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10103, "timestamp_epoch": "1555364213.291968000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e2f5c579f4bd7efdfd9309f9", "src_port": null, "tcp_stream": 215, "udp_stream": null, "frame_number": 10104, "timestamp_epoch": "1555364213.292159000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6a7dfbfe5a8f68230104999a", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10211, "timestamp_epoch": "1555365102.447216000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0c097a156c518e95403b3c9f", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10212, "timestamp_epoch": "1555365102.447471000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0743d68a6490ae4d750ae4e6", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10213, "timestamp_epoch": "1555365102.447720000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9a5be2df8cbe878180928958", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10217, "timestamp_epoch": "1555365102.449208000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e4d2761bda20611402abf78b", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10218, "timestamp_epoch": "1555365102.450076000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-449d68053103ca200fef3eb7", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10219, "timestamp_epoch": "1555365102.450657000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-abf2d5d1a7d1ae7713c4d51f", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10220, "timestamp_epoch": "1555365102.450821000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-41b825e0e7bfc03193e28ff5", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10221, "timestamp_epoch": "1555365102.451378000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3fd39d5f46dd94f82cd3f97d", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10222, "timestamp_epoch": "1555365102.451661000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-aaca5287beea0f241f5c9369", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10224, "timestamp_epoch": "1555365113.303437000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6754868a8012492ce90d0bed", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10225, "timestamp_epoch": "1555365113.303650000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-bc686d0be70441633dfb1880", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10226, "timestamp_epoch": "1555365113.304383000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f093cf1c017cc13aee5b8a5e", "src_port": null, "tcp_stream": 220, "udp_stream": null, "frame_number": 10227, "timestamp_epoch": "1555365113.304580000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c018313b671511a4c8b8cf8e", "src_port": null, "tcp_stream": 225, "udp_stream": null, "frame_number": 10309, "timestamp_epoch": "1555365673.584990000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-06cec0119302199929818269", "src_port": null, "tcp_stream": 225, "udp_stream": null, "frame_number": 10311, "timestamp_epoch": "1555365673.585963000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1b045c67e9172f0009d47310", "src_port": null, "tcp_stream": 225, "udp_stream": null, "frame_number": 10312, "timestamp_epoch": "1555365673.586205000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-20118a3c695aa380810fae81", "src_port": null, "tcp_stream": 226, "udp_stream": null, "frame_number": 10334, "timestamp_epoch": "1555365673.992812000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-22f0e10777a427d3cdfe5dad", "src_port": null, "tcp_stream": 226, "udp_stream": null, "frame_number": 10336, "timestamp_epoch": "1555365673.993535000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-85eab703dc5b2b4c913c4506", "src_port": null, "tcp_stream": 227, "udp_stream": null, "frame_number": 10345, "timestamp_epoch": "1555365674.018500000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "SEOUL-4A67-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-cdb834135c3c4b3a15e5e925", "src_port": null, "tcp_stream": 227, "udp_stream": null, "frame_number": 10348, "timestamp_epoch": "1555365674.019593000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f1bb6bb23fef64308b067b2b", "src_port": null, "tcp_stream": 228, "udp_stream": null, "frame_number": 10357, "timestamp_epoch": "1555365674.021055000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d6097bc17851993f8f93cddb", "src_port": null, "tcp_stream": 228, "udp_stream": null, "frame_number": 10359, "timestamp_epoch": "1555365674.021733000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-056c571770fe3c8f055173d1", "src_port": null, "tcp_stream": 229, "udp_stream": null, "frame_number": 10367, "timestamp_epoch": "1555365674.112248000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-792e714fa295e109ac9c7588", "src_port": null, "tcp_stream": 229, "udp_stream": null, "frame_number": 10369, "timestamp_epoch": "1555365674.113024000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1e4afd793c2fda8c6b638d17", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10380, "timestamp_epoch": "1555365674.121270000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-eaffe6ea3d1e11d127f038f5", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10381, "timestamp_epoch": "1555365674.121450000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8c07df8d3368b06ac7fe50dc", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10382, "timestamp_epoch": "1555365674.121647000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-dd6dd33a07277ca813e7da72", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10386, "timestamp_epoch": "1555365674.122668000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4d4bced8dc5ba417d33ecb82", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10387, "timestamp_epoch": "1555365674.123292000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-01cb999c20423a1cdc9d0be2", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10388, "timestamp_epoch": "1555365674.123738000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8662daddcda3c3d25efeec7a", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10389, "timestamp_epoch": "1555365674.123886000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-eb03a39bba863f652247fbb6", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10390, "timestamp_epoch": "1555365674.124225000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f0bc7994e758da1f4a4fe43c", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10391, "timestamp_epoch": "1555365674.126051000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a01f0cefbf5b787b36af1f11", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10392, "timestamp_epoch": "1555365674.126401000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6e4db9004acd5e0e20778efa", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10393, "timestamp_epoch": "1555365674.126542000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e7274610c0d3d05ab3965657", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10394, "timestamp_epoch": "1555365674.126933000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3abf0e72b6f62e1946aa743c", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10395, "timestamp_epoch": "1555365674.127146000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9d843f15d5e3ff17785bb530", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10396, "timestamp_epoch": "1555365674.127791000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d29a6f1e41cc7f7234ac8dd1", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10397, "timestamp_epoch": "1555365674.128084000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-424ad659cc74499366d74a86", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10398, "timestamp_epoch": "1555365674.128585000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d281981a149d8690ddcfe33b", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10399, "timestamp_epoch": "1555365674.128753000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-53e880bb1889951a1e1ab488", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10412, "timestamp_epoch": "1555365689.305859000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c4e3d6df32b62bc8bd4e7e05", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10413, "timestamp_epoch": "1555365689.306164000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-932f0ab9935056cfcd1ef4d6", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10415, "timestamp_epoch": "1555365701.299636000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8fea90c0a73dd17e014ddf99", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10416, "timestamp_epoch": "1555365701.299908000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ec4166d6b36af31c3983dadf", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10422, "timestamp_epoch": "1555365713.296423000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-899146f1ccf13700b784d637", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10423, "timestamp_epoch": "1555365713.296744000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-29bdbcba483dd3a3449049dc", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10424, "timestamp_epoch": "1555365713.297162000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-45e8b57d1a8d03818a37510c", "src_port": null, "tcp_stream": 230, "udp_stream": null, "frame_number": 10425, "timestamp_epoch": "1555365713.297339000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-73fddfbd35707754d96d9c02", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10474, "timestamp_epoch": "1555366002.472178000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-33ed2da56e6655027f3cde29", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10475, "timestamp_epoch": "1555366002.472401000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-dc106a9db5bfe977e48a3498", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10476, "timestamp_epoch": "1555366002.472587000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-67bcd3ed82703f567dd2990f", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10480, "timestamp_epoch": "1555366002.473908000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e6868b377dec8bc9b5d88661", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10481, "timestamp_epoch": "1555366002.474853000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-414b90e196f7e8571ce80739", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10482, "timestamp_epoch": "1555366002.475416000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4f10acdd737633a7499a6f66", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10483, "timestamp_epoch": "1555366002.475576000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4d8966b7a95b7eea6b60b15b", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10484, "timestamp_epoch": "1555366002.475948000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8ed6222950152691d3109e22", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10485, "timestamp_epoch": "1555366002.476228000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0624dbd43032d19022dc3145", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10487, "timestamp_epoch": "1555366013.302260000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-863d8026f475fe2ca3181a90", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10488, "timestamp_epoch": "1555366013.302590000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0ee73da3b272b55bea6e1d55", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10489, "timestamp_epoch": "1555366013.303282000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0b7c76198c195db4b638d03e", "src_port": null, "tcp_stream": 233, "udp_stream": null, "frame_number": 10490, "timestamp_epoch": "1555366013.303550000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-109e951bb7a94ff09bb07af2", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10589, "timestamp_epoch": "1555366902.498545000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a876613638f362ed1048b80a", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10590, "timestamp_epoch": "1555366902.498801000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-91a9461f2fbd4760366e4729", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10591, "timestamp_epoch": "1555366902.499036000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-26d05c9e344c86f0c8f5229f", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10595, "timestamp_epoch": "1555366902.500966000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-47e25fdaee74725909d46e39", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10596, "timestamp_epoch": "1555366902.501886000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ce2f6919fd64dc68821ae0b5", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10597, "timestamp_epoch": "1555366902.502476000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-68cd2830e657f25fb9e4c83a", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10598, "timestamp_epoch": "1555366902.502686000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-35ead47095ca3d19dd1f8270", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10599, "timestamp_epoch": "1555366902.503137000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c21a53b68b50ad3c8f6ab188", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10600, "timestamp_epoch": "1555366902.503417000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-29ef29f9988f7f0c9d5f176a", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10604, "timestamp_epoch": "1555366913.298244000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-719a6e96e06c64e1de3742bc", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10605, "timestamp_epoch": "1555366913.298485000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-0c5735520dc9f098abc831b2", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10606, "timestamp_epoch": "1555366913.298926000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-74453ae9b21ea71c45808769", "src_port": null, "tcp_stream": 238, "udp_stream": null, "frame_number": 10607, "timestamp_epoch": "1555366913.299103000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0f60c69d432392eca11cedbd", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10719, "timestamp_epoch": "1555367802.528275000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-25d66cb57a4dc6453f7145a9", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10720, "timestamp_epoch": "1555367802.528487000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-363869e8603fac83b6f8b78b", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10721, "timestamp_epoch": "1555367802.528675000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b9285c88c0f2893f0900be53", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10725, "timestamp_epoch": "1555367802.529745000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d3dd74228fc307ae9ce9668c", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10726, "timestamp_epoch": "1555367802.530586000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8dea2ac543cedb463feea078", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10727, "timestamp_epoch": "1555367802.531075000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-bb2126271c20cedf0100997d", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10728, "timestamp_epoch": "1555367802.531220000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a1f4d88c905edba7f7573131", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10729, "timestamp_epoch": "1555367802.531570000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-682ad769289ced866d924951", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10730, "timestamp_epoch": "1555367802.531861000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9201b1bdf52ac4468d09b711", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10732, "timestamp_epoch": "1555367813.293703000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1d0f79d7a008e4034cef9393", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10733, "timestamp_epoch": "1555367813.294029000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "d0:67:e5:b1:53:fa" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-471311b44327e0ddd1314b2e", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10734, "timestamp_epoch": "1555367813.294401000" }, { "kind": "identity", "dst_ip": "10.0.90.175", "fields": { "eth.dst": "d0:67:e5:b1:53:fa", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-28b63ec2dd3b1cf661f8a2c1", "src_port": null, "tcp_stream": 244, "udp_stream": null, "frame_number": 10735, "timestamp_epoch": "1555367813.294561000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "23.218.156.11", "fields": { "http.host": "www.msftncsi.com", "http.user_agent": "Microsoft NCSI", "http.request.uri": "/ncsi.txt", "http.response_in": "404", "http.request.method": "GET", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-f21ff7359d456ac14e8a8556", "src_port": 49183, "tcp_stream": 28, "udp_stream": null, "frame_number": 402, "timestamp_epoch": "1555346531.941203000" }, { "kind": "http_request", "dst_ip": "91.240.87.19", "fields": { "http.host": "ljeffery54ae.top", "http.request.uri": "/skoex/po2.php?l=cupk6.fgs", "http.response_in": "997", "http.request.method": "GET", "http.request.full_uri": "http://ljeffery54ae.top/skoex/po2.php?l=cupk6.fgs" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-59c23e763cc310f06343649c", "src_port": 49201, "tcp_stream": 45, "udp_stream": null, "frame_number": 668, "timestamp_epoch": "1555346549.956141000" }, { "kind": "http_request", "dst_ip": "37.230.112.226", "fields": { "http.host": "ksoniay95ee.info", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/CI9BVzd6AqB/ZNUmRFBAKmX4q_/2FIAs9nQJlVF7_2BTvRU5/ZPqTgOgLDp8JzrCL/_2Fcm_2BF41yLbk/eclytPd8CmogXhag5f/iJKuzzkmf/M1zwJZUnnnK6LJcptL1S/m6Hl99BQ3fNUdtPt9So/0Zzs4gdqrhrs/_2FJr.avi", "http.response_in": "1311", "http.request.method": "GET", "http.request.full_uri": "http://ksoniay95ee.info/images/CI9BVzd6AqB/ZNUmRFBAKmX4q_/2FIAs9nQJlVF7_2BTvRU5/ZPqTgOgLDp8JzrCL/_2Fcm_2BF41yLbk/eclytPd8CmogXhag5f/iJKuzzkmf/M1zwJZUnnnK6LJcptL1S/m6Hl99BQ3fNUdtPt9So/0Zzs4gdqrhrs/_2FJr.avi" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-fe5bd4f4a025134ec594d679", "src_port": 49203, "tcp_stream": 46, "udp_stream": null, "frame_number": 1032, "timestamp_epoch": "1555346588.624105000" }, { "kind": "http_request", "dst_ip": "37.230.112.226", "fields": { "http.host": "ksoniay95ee.info", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/favicon.ico", "http.response_in": "1320", "http.request.method": "GET", "http.request.full_uri": "http://ksoniay95ee.info/favicon.ico" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-27b0a61be1586d3477d24f7b", "src_port": 49203, "tcp_stream": 46, "udp_stream": null, "frame_number": 1314, "timestamp_epoch": "1555346589.965853000" }, { "kind": "http_request", "dst_ip": "37.230.112.226", "fields": { "http.host": "ksoniay95ee.info", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/zqt4lIX7/WURokuO9vh89Yy_2BsUJrS9/PjffqPwJdE/ySWjXv6UbPaKFMooy/6X5boj6wckcc/Ucw3dM3Mi_2/FznVDXGp2L3Py2/JxFQvMX4xN_2FzOJs9Vmk/BMKiWvw71S3sGLtJ/XPIlWh5f6mD5BYu/asfVMoi7/c.avi", "http.response_in": "1666", "http.request.method": "GET", "http.request.full_uri": "http://ksoniay95ee.info/images/zqt4lIX7/WURokuO9vh89Yy_2BsUJrS9/PjffqPwJdE/ySWjXv6UbPaKFMooy/6X5boj6wckcc/Ucw3dM3Mi_2/FznVDXGp2L3Py2/JxFQvMX4xN_2FzOJs9Vmk/BMKiWvw71S3sGLtJ/XPIlWh5f6mD5BYu/asfVMoi7/c.avi" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-0f942001e7e1e47e06d9ce4a", "src_port": 49205, "tcp_stream": 49, "udp_stream": null, "frame_number": 1329, "timestamp_epoch": "1555346591.226636000" }, { "kind": "http_request", "dst_ip": "37.230.112.226", "fields": { "http.host": "ksoniay95ee.info", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/k1bBds2o/QmLUr43VFSfi6mVN0k_2Fri/aRq5qJ_2Bb/9pn_2FrlWUAEwA3DA/8_2BlKV4KDN_/2B_2BLZHLEa/vLvK_2F5G0A625/hGoDuTo8Bf7h2KRBD9vOP/gcTRbqx7bC5Q89C6/6YYly9yOp3zpx2r/BwphZTlcwHbBf1/hYP.avi", "http.response_in": "1674", "http.request.method": "GET", "http.request.full_uri": "http://ksoniay95ee.info/images/k1bBds2o/QmLUr43VFSfi6mVN0k_2Fri/aRq5qJ_2Bb/9pn_2FrlWUAEwA3DA/8_2BlKV4KDN_/2B_2BLZHLEa/vLvK_2F5G0A625/hGoDuTo8Bf7h2KRBD9vOP/gcTRbqx7bC5Q89C6/6YYly9yOp3zpx2r/BwphZTlcwHbBf1/hYP.avi" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-4817ef86b2a45e1310e01175", "src_port": 49203, "tcp_stream": 46, "udp_stream": null, "frame_number": 1669, "timestamp_epoch": "1555346593.303292000" }, { "kind": "http_request", "dst_ip": "104.73.85.137", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "http.response_in": "1906", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-e67fea86c2264d5c51ab29ae", "src_port": 49211, "tcp_stream": 57, "udp_stream": null, "frame_number": 1848, "timestamp_epoch": "1555346659.556595000" }, { "kind": "http_request", "dst_ip": "151.106.27.208", "fields": { "http.host": "151.106.27.208", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)", "http.request.uri": "/client.rar", "http.response_in": "1933", "http.request.method": "GET", "http.request.full_uri": "http://151.106.27.208/client.rar" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-ed2828c493c650c00fc64c1b", "src_port": 49213, "tcp_stream": 59, "udp_stream": null, "frame_number": 1931, "timestamp_epoch": "1555346661.898719000" }, { "kind": "http_request", "dst_ip": "151.106.27.208", "fields": { "http.host": "151.106.27.208", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)", "http.request.uri": "/client.rar", "http.response_in": "1996", "http.request.method": "GET", "http.request.full_uri": "http://151.106.27.208/client.rar" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-b4308f51b486de5d27dfd165", "src_port": 49216, "tcp_stream": 63, "udp_stream": null, "frame_number": 1994, "timestamp_epoch": "1555346969.613910000" }, { "kind": "http_request", "dst_ip": "89.163.144.224", "fields": { "http.host": "89.163.144.224", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)", "http.request.uri": "/klansfuuerifneiferunfasd/modules/client.rar", "http.response_in": "4882", "http.request.method": "GET", "http.request.full_uri": "http://89.163.144.224/klansfuuerifneiferunfasd/modules/client.rar" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-844f5251921d6a99d8386ce4", "src_port": 49346, "tcp_stream": 196, "udp_stream": null, "frame_number": 4880, "timestamp_epoch": "1555363185.829368000" }, { "kind": "http_request", "dst_ip": "162.213.250.131", "fields": { "http.host": "162.213.250.131", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)", "http.request.uri": "/azor.rar", "http.response_in": "5365", "http.request.method": "GET", "http.request.full_uri": "http://162.213.250.131/azor.rar" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-4b3d9b1f499fcec876183627", "src_port": 49350, "tcp_stream": 200, "udp_stream": null, "frame_number": 4961, "timestamp_epoch": "1555363492.940707000" }, { "kind": "http_request", "dst_ip": "85.114.134.49", "fields": { "http.host": "85.114.134.49", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", "http.request.uri": "/index.php", "http.response_in": "9793", "http.content_length": "107", "http.request.method": "POST", "http.request.full_uri": "http://85.114.134.49/index.php" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-935c91e80469628f959d9eb0", "src_port": 49351, "tcp_stream": 201, "udp_stream": null, "body_sha256": "f07dbc57bb41792248061012e6479b00ba046d6631e1734bdbbd01bc421ecba4", "frame_number": 5380, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 107, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 107, "timestamp_epoch": "1555363518.972098000" }, { "kind": "http_request", "dst_ip": "85.114.134.49", "fields": { "http.host": "85.114.134.49", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", "http.request.uri": "/index.php", "http.response_in": "9834", "http.content_length": "6962", "http.request.method": "POST", "http.request.full_uri": "http://85.114.134.49/index.php" }, "src_ip": "10.0.90.175", "dst_port": 80, "event_id": "evt-fa83b607ee9d31cda4299ebb", "src_port": 49351, "tcp_stream": 201, "udp_stream": null, "body_sha256": "4017ffd0c17a9fbaebd74c6b75b6e8898d53ce401f16a64881bd0ee5837f6591", "frame_number": 9830, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6962, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 6962, "timestamp_epoch": "1555363524.078960000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "402", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "23.218.156.11", "dst_port": 49183, "event_id": "evt-08b08519c5c12e4aa99862f1", "src_port": 80, "tcp_stream": 28, "udp_stream": null, "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "frame_number": 404, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1555346531.961189000" }, { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "668", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "328192" }, "src_ip": "91.240.87.19", "dst_port": 49201, "event_id": "evt-45d439e61a2495b8a789c74e", "src_port": 80, "tcp_stream": 45, "udp_stream": null, "body_sha256": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "frame_number": 997, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 328192, "timestamp_epoch": "1555346551.045091000" }, { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "1032", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "37.230.112.226", "dst_port": 49203, "event_id": "evt-46ac485b7357d6412b25fce9", "src_port": 80, "tcp_stream": 46, "udp_stream": null, "body_sha256": "637ccbba391788d61f87d86caf06bdd4c6c03c43aa9386c42bdf2543a072619c", "frame_number": 1311, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 218556, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 218556, "timestamp_epoch": "1555346589.902272000" }, { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "1314", "http.content_type": "image/vnd.microsoft.icon", "http.response.code": "200", "http.content_length": "5430" }, "src_ip": "37.230.112.226", "dst_port": 49203, "event_id": "evt-5791dfc41916c3fd67926986", "src_port": 80, "tcp_stream": 46, "udp_stream": null, "body_sha256": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "frame_number": 1320, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5430, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5430, "timestamp_epoch": "1555346590.143034000" }, { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "1329", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "37.230.112.226", "dst_port": 49205, "event_id": "evt-d6dc8eb43fcdcdbfadb96558", "src_port": 80, "tcp_stream": 49, "udp_stream": null, "body_sha256": "6aed702963283420db151840cb48374f6c48b4f9dc933f7a6c9fdb1d77ce88e1", "frame_number": 1666, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 274540, "timestamp_epoch": "1555346592.486605000" }, { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "1669", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.content_length": "2396" }, "src_ip": "37.230.112.226", "dst_port": 49203, "event_id": "evt-46601398a33e3901fde35491", "src_port": 80, "tcp_stream": 46, "udp_stream": null, "body_sha256": "91cba2f5400a35c849783d307e016002144c96c9ee817b7a375e225c57b1ff80", "frame_number": 1674, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2396, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2396, "timestamp_epoch": "1555346593.510214000" }, { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "1848", "http.content_type": "application/vnd.ms-cab-compressed", "http.response.code": "200", "http.content_length": "56952" }, "src_ip": "104.73.85.137", "dst_port": 49211, "event_id": "evt-f738c351c0c1055b7201b60c", "src_port": 80, "tcp_stream": 57, "udp_stream": null, "body_sha256": "4c9c4d831d61c8c38b2513f9b431ef4f4cf6af9fb18a2317cd2178d6e0997822", "frame_number": 1906, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 56952, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 56952, "timestamp_epoch": "1555346659.617901000" }, { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "1931", "http.response.code": "200", "http.content_length": "591" }, "src_ip": "151.106.27.208", "dst_port": 49213, "event_id": "evt-23e89864a12ef5690f156789", "src_port": 80, "tcp_stream": 59, "udp_stream": null, "body_sha256": "5f1ea837b7530af44e85e0198beab49e0f2cf9e60a75d76c044313985de822ff", "frame_number": 1933, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 591, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 591, "timestamp_epoch": "1555346662.032496000" }, { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "1994", "http.response.code": "200", "http.content_length": "591" }, "src_ip": "151.106.27.208", "dst_port": 49216, "event_id": "evt-f2a1870a310fc2f2e2abe418", "src_port": 80, "tcp_stream": 63, "udp_stream": null, "body_sha256": "5f1ea837b7530af44e85e0198beab49e0f2cf9e60a75d76c044313985de822ff", "frame_number": 1996, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 591, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 591, "timestamp_epoch": "1555346969.751896000" }, { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "4880", "http.content_type": "application/rar", "http.response.code": "200", "http.content_length": "581" }, "src_ip": "89.163.144.224", "dst_port": 49346, "event_id": "evt-9b3c09962cbba419dd8d706b", "src_port": 80, "tcp_stream": 196, "udp_stream": null, "body_sha256": "6d48f7ed8bafb7e147b7438a21362220adcc24e83a4f9942f6ccf9c09b3b4b02", "frame_number": 4882, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 581, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 581, "timestamp_epoch": "1555363185.975636000" }, { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "4961", "http.content_type": "application/x-rar-compressed", "http.response.code": "200", "http.content_length": "425549" }, "src_ip": "162.213.250.131", "dst_port": 49350, "event_id": "evt-aa90235d5bc50f1335601efe", "src_port": 80, "tcp_stream": 200, "udp_stream": null, "body_sha256": "aa2f524d89ce598b990d3c8cd74cdc31cfaa9a7c6a63596b0e5b394dc7ede10b", "frame_number": 5365, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 425549, "timestamp_epoch": "1555363493.397007000" }, { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "5380", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "85.114.134.49", "dst_port": 49351, "event_id": "evt-1cc5e629dff6bfec450ebdaa", "src_port": 80, "tcp_stream": 201, "udp_stream": null, "body_sha256": "2c60e1e69aeca03fb562c0597bd404df118151e6782d7cfefcbcefb5a1505d21", "frame_number": 9793, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 4473518, "timestamp_epoch": "1555363523.235252000" }, { "kind": "http_response", "dst_ip": "10.0.90.175", "fields": { "http.request_in": "9830", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.content_length": "2" }, "src_ip": "85.114.134.49", "dst_port": 49351, "event_id": "evt-1b7a125647c1f0ce049d6f87", "src_port": 80, "tcp_stream": 201, "udp_stream": null, "body_sha256": "565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3", "frame_number": 9834, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1555363524.526057000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-8edac736d944c05ebfd24d7a", "src_port": 49206, "tcp_stream": 50, "udp_stream": null, "frame_number": 1688, "timestamp_epoch": "1555346616.136011000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-794bae069e7afe4cbe5c4701", "src_port": 49207, "tcp_stream": 51, "udp_stream": null, "frame_number": 1689, "timestamp_epoch": "1555346616.136095000" }, { "kind": "tls_client_hello", "dst_ip": "185.139.69.88", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "zindv.club" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-ed597e04126411040f494819", "src_port": 49210, "tcp_stream": 56, "udp_stream": null, "frame_number": 1834, "timestamp_epoch": "1555346659.077320000" }, { "kind": "tls_client_hello", "dst_ip": "185.139.69.88", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "zindv.club" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-41bd1bb05037c191918f7cbc", "src_port": 49212, "tcp_stream": 58, "udp_stream": null, "frame_number": 1916, "timestamp_epoch": "1555346660.499057000" }, { "kind": "tls_client_hello", "dst_ip": "185.139.69.88", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "zindv.club" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-4bf420b0d5198a2da68ad7c2", "src_port": 49214, "tcp_stream": 60, "udp_stream": null, "frame_number": 1944, "timestamp_epoch": "1555346672.224837000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-65f009ec4db3be3b90411004", "src_port": 49215, "tcp_stream": 62, "udp_stream": null, "frame_number": 1979, "timestamp_epoch": "1555346960.486726000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-602f772fcdf9813a49b5a717", "src_port": 49217, "tcp_stream": 64, "udp_stream": null, "frame_number": 2015, "timestamp_epoch": "1555347260.467997000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-79aa8458361ffd34e97cf762", "src_port": 49218, "tcp_stream": 65, "udp_stream": null, "frame_number": 2034, "timestamp_epoch": "1555347280.844697000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-d6db3ac158839a06c5836d8a", "src_port": 49219, "tcp_stream": 66, "udp_stream": null, "frame_number": 2053, "timestamp_epoch": "1555347306.214706000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-3cace5a703ba6684018b3749", "src_port": 49221, "tcp_stream": 68, "udp_stream": null, "frame_number": 2107, "timestamp_epoch": "1555347580.840612000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-9c0f2be5fee56abbb5eb984f", "src_port": 49222, "tcp_stream": 69, "udp_stream": null, "frame_number": 2122, "timestamp_epoch": "1555347595.241177000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-1d63bd4b89af10d2d32a5fbe", "src_port": 49223, "tcp_stream": 70, "udp_stream": null, "frame_number": 2151, "timestamp_epoch": "1555347860.475131000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-d241ea7b82dc1facdc09526a", "src_port": 49224, "tcp_stream": 71, "udp_stream": null, "frame_number": 2166, "timestamp_epoch": "1555347884.529654000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-62139c3859d7d337b72369a1", "src_port": 49225, "tcp_stream": 72, "udp_stream": null, "frame_number": 2191, "timestamp_epoch": "1555348184.537856000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-05f117c67448a22897bb64df", "src_port": 49227, "tcp_stream": 74, "udp_stream": null, "frame_number": 2235, "timestamp_epoch": "1555348460.500200000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-b07c867084b46e715e5b58e7", "src_port": 49228, "tcp_stream": 75, "udp_stream": null, "frame_number": 2250, "timestamp_epoch": "1555348484.552664000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-98a75b691bbde4b3ab7bda4a", "src_port": 49229, "tcp_stream": 76, "udp_stream": null, "frame_number": 2279, "timestamp_epoch": "1555348784.564976000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-3b5974bc47ffe4d9e284caf1", "src_port": 49230, "tcp_stream": 77, "udp_stream": null, "frame_number": 2299, "timestamp_epoch": "1555349060.505864000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-18b272073f5aa06f2f66dce1", "src_port": 49231, "tcp_stream": 78, "udp_stream": null, "frame_number": 2314, "timestamp_epoch": "1555349084.556969000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-b83898a4a093f9bbd53aa079", "src_port": 49233, "tcp_stream": 80, "udp_stream": null, "frame_number": 2363, "timestamp_epoch": "1555349384.579174000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-0fc60e328a11f07a72d507ca", "src_port": 49234, "tcp_stream": 81, "udp_stream": null, "frame_number": 2385, "timestamp_epoch": "1555349660.512944000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-32e4737a53dfbbca971c5137", "src_port": 49235, "tcp_stream": 82, "udp_stream": null, "frame_number": 2400, "timestamp_epoch": "1555349684.547991000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-ef5fce45f82988d30e0090e1", "src_port": 49236, "tcp_stream": 83, "udp_stream": null, "frame_number": 2425, "timestamp_epoch": "1555349984.564403000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-f07831174673f9eb1be76e1e", "src_port": 49238, "tcp_stream": 85, "udp_stream": null, "frame_number": 2467, "timestamp_epoch": "1555350260.535120000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-86d1f45c31565f14562ca8b3", "src_port": 49239, "tcp_stream": 86, "udp_stream": null, "frame_number": 2482, "timestamp_epoch": "1555350284.575657000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-d50248e1cd34c50708e94e1a", "src_port": 49240, "tcp_stream": 87, "udp_stream": null, "frame_number": 2508, "timestamp_epoch": "1555350584.578244000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-0c4700ddba6626b609667e6c", "src_port": 49241, "tcp_stream": 88, "udp_stream": null, "frame_number": 2530, "timestamp_epoch": "1555350860.547801000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-489f2ba937f57ba3d5d2b17f", "src_port": 49242, "tcp_stream": 89, "udp_stream": null, "frame_number": 2545, "timestamp_epoch": "1555350884.586932000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-81b9bffc6efa239b15e04b8b", "src_port": 49244, "tcp_stream": 91, "udp_stream": null, "frame_number": 2591, "timestamp_epoch": "1555351184.620279000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-30ab9e2bab07af94568e898e", "src_port": 49245, "tcp_stream": 92, "udp_stream": null, "frame_number": 2612, "timestamp_epoch": "1555351460.534935000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-e0b4d8b22770b9c7490df019", "src_port": 49246, "tcp_stream": 93, "udp_stream": null, "frame_number": 2627, "timestamp_epoch": "1555351484.595941000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-edef01b8b1dcf3e5176956a7", "src_port": 49247, "tcp_stream": 94, "udp_stream": null, "frame_number": 2654, "timestamp_epoch": "1555351784.599300000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-6674f1554eb1ffb1277cfb35", "src_port": 49250, "tcp_stream": 97, "udp_stream": null, "frame_number": 2723, "timestamp_epoch": "1555352060.561092000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-8a44dd42ba00dba1aa350ca4", "src_port": 49251, "tcp_stream": 98, "udp_stream": null, "frame_number": 2738, "timestamp_epoch": "1555352084.597033000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-11db9f2b296dbf1e3309b37a", "src_port": 49258, "tcp_stream": 105, "udp_stream": null, "frame_number": 2892, "timestamp_epoch": "1555352384.606812000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-504cf16f3dc72adbf1724cb5", "src_port": 49259, "tcp_stream": 106, "udp_stream": null, "frame_number": 2916, "timestamp_epoch": "1555352660.566674000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-b71b131184c51ac0443bce84", "src_port": 49260, "tcp_stream": 107, "udp_stream": null, "frame_number": 2933, "timestamp_epoch": "1555352684.605839000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-b6fe0517678085ddf137607a", "src_port": 49269, "tcp_stream": 116, "udp_stream": null, "frame_number": 3095, "timestamp_epoch": "1555352984.639390000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-351d3d639492fc88d7f4c855", "src_port": 49270, "tcp_stream": 117, "udp_stream": null, "frame_number": 3119, "timestamp_epoch": "1555353260.561410000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-5eb6bf08afe45b558f758cd1", "src_port": 49271, "tcp_stream": 118, "udp_stream": null, "frame_number": 3134, "timestamp_epoch": "1555353284.700823000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-2e6db657f1fe8388db364016", "src_port": 49272, "tcp_stream": 119, "udp_stream": null, "frame_number": 3165, "timestamp_epoch": "1555353584.628017000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-f01583955d1b9657122d9a87", "src_port": 49274, "tcp_stream": 121, "udp_stream": null, "frame_number": 3213, "timestamp_epoch": "1555353860.603680000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-e37e6166c88f54041a5a9712", "src_port": 49275, "tcp_stream": 122, "udp_stream": null, "frame_number": 3228, "timestamp_epoch": "1555353884.636263000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-db0dcba1bfdb3931b2023b7c", "src_port": 49276, "tcp_stream": 123, "udp_stream": null, "frame_number": 3259, "timestamp_epoch": "1555354184.644268000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-2978b1829b7508c760387a9d", "src_port": 49279, "tcp_stream": 127, "udp_stream": null, "frame_number": 3377, "timestamp_epoch": "1555354460.611939000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-86babef9074facf2488bf2f4", "src_port": 49280, "tcp_stream": 128, "udp_stream": null, "frame_number": 3392, "timestamp_epoch": "1555354484.644794000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-347a75bd4f1cbae4da9f9cdc", "src_port": 49281, "tcp_stream": 129, "udp_stream": null, "frame_number": 3423, "timestamp_epoch": "1555354784.653359000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-2eb0f9ff9ec6650defa0a520", "src_port": 49282, "tcp_stream": 130, "udp_stream": null, "frame_number": 3449, "timestamp_epoch": "1555355060.598573000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-1f44e648d3bc6c20fbf313e2", "src_port": 49283, "tcp_stream": 131, "udp_stream": null, "frame_number": 3464, "timestamp_epoch": "1555355084.655958000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-a32a2d129a46b09dd4b917ca", "src_port": 49285, "tcp_stream": 133, "udp_stream": null, "frame_number": 3517, "timestamp_epoch": "1555355384.680753000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-deeccee1fe4f5854233da1cd", "src_port": 49286, "tcp_stream": 134, "udp_stream": null, "frame_number": 3541, "timestamp_epoch": "1555355660.613054000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-b88a330df2ae7af4ffcf6bfe", "src_port": 49287, "tcp_stream": 135, "udp_stream": null, "frame_number": 3556, "timestamp_epoch": "1555355684.669147000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-633fc6b141d1b92495c98615", "src_port": 49288, "tcp_stream": 136, "udp_stream": null, "frame_number": 3587, "timestamp_epoch": "1555355984.695119000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-3fefa97c482ee2e18461dc23", "src_port": 49290, "tcp_stream": 138, "udp_stream": null, "frame_number": 3633, "timestamp_epoch": "1555356260.634703000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-5dd7e89cbdbe9b0b0544efe5", "src_port": 49291, "tcp_stream": 139, "udp_stream": null, "frame_number": 3648, "timestamp_epoch": "1555356284.674670000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-2684e82d039b7d714c9b305f", "src_port": 49292, "tcp_stream": 140, "udp_stream": null, "frame_number": 3681, "timestamp_epoch": "1555356584.683723000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-b9b7b8a8023fa5d1317285a8", "src_port": 49293, "tcp_stream": 141, "udp_stream": null, "frame_number": 3705, "timestamp_epoch": "1555356860.629878000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-ce67429db5a0b2d2ebc9ed16", "src_port": 49294, "tcp_stream": 142, "udp_stream": null, "frame_number": 3720, "timestamp_epoch": "1555356884.684434000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-b10bd46dc1ff605a6e85c336", "src_port": 49296, "tcp_stream": 144, "udp_stream": null, "frame_number": 3772, "timestamp_epoch": "1555357184.697687000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-d54c7ee54a92cad19195c70e", "src_port": 49297, "tcp_stream": 145, "udp_stream": null, "frame_number": 3796, "timestamp_epoch": "1555357460.636841000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-59dc4e9f58f85f545e0106d5", "src_port": 49298, "tcp_stream": 146, "udp_stream": null, "frame_number": 3811, "timestamp_epoch": "1555357484.689386000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-429402608f45054e9acc1758", "src_port": 49299, "tcp_stream": 147, "udp_stream": null, "frame_number": 3842, "timestamp_epoch": "1555357784.697545000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-68afb3210b7ac1e77c3129e9", "src_port": 49307, "tcp_stream": 155, "udp_stream": null, "frame_number": 4014, "timestamp_epoch": "1555358060.657385000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-8e746a5d44832a27a5da5519", "src_port": 49308, "tcp_stream": 156, "udp_stream": null, "frame_number": 4029, "timestamp_epoch": "1555358084.693084000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-951923157706b3eb4b966fba", "src_port": 49309, "tcp_stream": 157, "udp_stream": null, "frame_number": 4061, "timestamp_epoch": "1555358384.702030000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-26a9ece773fe1d2dd8cd5f39", "src_port": 49310, "tcp_stream": 158, "udp_stream": null, "frame_number": 4084, "timestamp_epoch": "1555358660.649766000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-5aedcefb84a21fb49ccc8f74", "src_port": 49311, "tcp_stream": 159, "udp_stream": null, "frame_number": 4099, "timestamp_epoch": "1555358684.701291000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-c69df536cd818bb744d747af", "src_port": 49313, "tcp_stream": 161, "udp_stream": null, "frame_number": 4154, "timestamp_epoch": "1555358984.734843000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-be38158a752a68dd283d29f3", "src_port": 49314, "tcp_stream": 162, "udp_stream": null, "frame_number": 4178, "timestamp_epoch": "1555359260.660868000" }, { "kind": "tls_client_hello", "dst_ip": "185.136.169.160", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-3aea1ffe969a3767b6b59e51", "src_port": 49315, "tcp_stream": 163, "udp_stream": null, "frame_number": 4193, "timestamp_epoch": "1555359284.719947000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-88349b22ea6daa110b5e0cdf", "src_port": 49325, "tcp_stream": 175, "udp_stream": null, "frame_number": 4391, "timestamp_epoch": "1555359860.715853000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-fde5842960c3f1de76f1eaa4", "src_port": 49326, "tcp_stream": 176, "udp_stream": null, "frame_number": 4406, "timestamp_epoch": "1555359884.723352000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-b4c263dddd94e398eb4427f1", "src_port": 49327, "tcp_stream": 177, "udp_stream": null, "frame_number": 4437, "timestamp_epoch": "1555360184.723456000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-88327510d978068e1f5d1b57", "src_port": 49328, "tcp_stream": 178, "udp_stream": null, "frame_number": 4465, "timestamp_epoch": "1555360460.683687000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-527d3ace51a16dd11973a36f", "src_port": 49329, "tcp_stream": 179, "udp_stream": null, "frame_number": 4480, "timestamp_epoch": "1555360484.739099000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-99d8c15552d9ec720a275573", "src_port": 49331, "tcp_stream": 181, "udp_stream": null, "frame_number": 4533, "timestamp_epoch": "1555360784.755544000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-64e7bd5b899247cddf7ca7b3", "src_port": 49332, "tcp_stream": 182, "udp_stream": null, "frame_number": 4559, "timestamp_epoch": "1555361060.676913000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-0e46be85477b13ff30cb7a21", "src_port": 49333, "tcp_stream": 183, "udp_stream": null, "frame_number": 4574, "timestamp_epoch": "1555361084.747109000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-f9486b90906e408d58aaba3a", "src_port": 49334, "tcp_stream": 184, "udp_stream": null, "frame_number": 4604, "timestamp_epoch": "1555361384.749526000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-ac057acae589468f7693c970", "src_port": 49336, "tcp_stream": 186, "udp_stream": null, "frame_number": 4654, "timestamp_epoch": "1555361660.724102000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-8444fcc26bb4d11dc8c34d9c", "src_port": 49337, "tcp_stream": 187, "udp_stream": null, "frame_number": 4669, "timestamp_epoch": "1555361684.738771000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-68ec5ca38c768f0a955d5a92", "src_port": 49338, "tcp_stream": 188, "udp_stream": null, "frame_number": 4699, "timestamp_epoch": "1555361984.768733000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-b5cfd57a4ab2bcc98d97d6b0", "src_port": 49339, "tcp_stream": 189, "udp_stream": null, "frame_number": 4723, "timestamp_epoch": "1555362260.708539000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-abb8a8420710a7dbcc6ce66e", "src_port": 49340, "tcp_stream": 190, "udp_stream": null, "frame_number": 4738, "timestamp_epoch": "1555362284.768516000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-ce435cde7d949b28528176ea", "src_port": 49342, "tcp_stream": 192, "udp_stream": null, "frame_number": 4794, "timestamp_epoch": "1555362584.921894000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-20fbdd17350227f4ab031e4c", "src_port": 49343, "tcp_stream": 193, "udp_stream": null, "frame_number": 4819, "timestamp_epoch": "1555362860.717025000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-a1b099428d4d3b3f8bd318e7", "src_port": 49344, "tcp_stream": 194, "udp_stream": null, "frame_number": 4834, "timestamp_epoch": "1555362884.779162000" }, { "kind": "tls_client_hello", "dst_ip": "185.212.47.167", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-ed4774208b472cccb1edea74", "src_port": 49345, "tcp_stream": 195, "udp_stream": null, "frame_number": 4865, "timestamp_epoch": "1555363184.776008000" }, { "kind": "tls_client_hello", "dst_ip": "185.158.249.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adsfinder.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-ea06f14457bf3bb9ffbf5cb1", "src_port": 49348, "tcp_stream": 198, "udp_stream": null, "frame_number": 4924, "timestamp_epoch": "1555363460.745329000" }, { "kind": "tls_client_hello", "dst_ip": "185.158.249.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adsfinder.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-13dee5dbd4d7b4695b131c9c", "src_port": 49349, "tcp_stream": 199, "udp_stream": null, "frame_number": 4946, "timestamp_epoch": "1555363484.760068000" }, { "kind": "tls_client_hello", "dst_ip": "185.158.249.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adsfinder.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-ff19cd1ad4a7f31133bb54b6", "src_port": 49360, "tcp_stream": 210, "udp_stream": null, "frame_number": 9987, "timestamp_epoch": "1555363784.777427000" }, { "kind": "tls_client_hello", "dst_ip": "185.158.249.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adsfinder.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-c3e6c2f96319155c5b148e06", "src_port": 49361, "tcp_stream": 211, "udp_stream": null, "frame_number": 10002, "timestamp_epoch": "1555363830.695237000" }, { "kind": "tls_client_hello", "dst_ip": "198.54.125.57", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-ea308cb074f8fcba23836686", "src_port": 49362, "tcp_stream": 212, "udp_stream": null, "frame_number": 10025, "timestamp_epoch": "1555364060.659999000" }, { "kind": "tls_client_hello", "dst_ip": "109.230.199.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "qqtube.club" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-ab6f7af70b8d8f6eba3a069c", "src_port": 49363, "tcp_stream": 213, "udp_stream": null, "frame_number": 10050, "timestamp_epoch": "1555364084.830341000" }, { "kind": "tls_client_hello", "dst_ip": "109.230.199.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "qqtube.club" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-99c7cf8de4505dea410f71da", "src_port": 49364, "tcp_stream": 214, "udp_stream": null, "frame_number": 10065, "timestamp_epoch": "1555364111.723360000" }, { "kind": "tls_client_hello", "dst_ip": "109.230.199.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "qqtube.club" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-4781752748dc0bd743c6309f", "src_port": 49366, "tcp_stream": 216, "udp_stream": null, "frame_number": 10118, "timestamp_epoch": "1555364384.804171000" }, { "kind": "tls_client_hello", "dst_ip": "109.230.199.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "qqtube.club" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-83c2efe6316be545b974606e", "src_port": 49367, "tcp_stream": 217, "udp_stream": null, "frame_number": 10144, "timestamp_epoch": "1555364660.753511000" }, { "kind": "tls_client_hello", "dst_ip": "109.230.199.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "qqtube.club" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-c02b51e28aab7298ce7560f2", "src_port": 49368, "tcp_stream": 218, "udp_stream": null, "frame_number": 10159, "timestamp_epoch": "1555364699.131332000" }, { "kind": "tls_client_hello", "dst_ip": "198.54.115.33", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-74cac7f1ebcfaedecbb44cf1", "src_port": 49369, "tcp_stream": 219, "udp_stream": null, "frame_number": 10184, "timestamp_epoch": "1555364999.067651000" }, { "kind": "tls_client_hello", "dst_ip": "176.10.125.110", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "parolinos.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-9c6f67d570e0b9e083a2e601", "src_port": 49371, "tcp_stream": 221, "udp_stream": null, "frame_number": 10236, "timestamp_epoch": "1555365260.832179000" }, { "kind": "tls_client_hello", "dst_ip": "176.10.125.110", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "parolinos.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-1bbc5614396de174363738ae", "src_port": 49372, "tcp_stream": 222, "udp_stream": null, "frame_number": 10251, "timestamp_epoch": "1555365299.143211000" }, { "kind": "tls_client_hello", "dst_ip": "68.65.122.52", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-d9436afa22d96fa987454bf0", "src_port": 49373, "tcp_stream": 223, "udp_stream": null, "frame_number": 10276, "timestamp_epoch": "1555365599.078013000" }, { "kind": "tls_client_hello", "dst_ip": "185.158.249.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adsfinder.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-cb3b1ee24ec5747b6121cf7e", "src_port": 49381, "tcp_stream": 231, "udp_stream": null, "frame_number": 10434, "timestamp_epoch": "1555365860.792339000" }, { "kind": "tls_client_hello", "dst_ip": "185.158.249.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adsfinder.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-eb8f5e53da16507150715e0b", "src_port": 49382, "tcp_stream": 232, "udp_stream": null, "frame_number": 10449, "timestamp_epoch": "1555365899.132405000" }, { "kind": "tls_client_hello", "dst_ip": "185.158.249.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adsfinder.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-42a0f23a02ea311fe30255eb", "src_port": 49384, "tcp_stream": 234, "udp_stream": null, "frame_number": 10500, "timestamp_epoch": "1555366199.138972000" }, { "kind": "tls_client_hello", "dst_ip": "185.158.249.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adsfinder.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-01c7d3f4c2044a59d09d00fc", "src_port": 49385, "tcp_stream": 235, "udp_stream": null, "frame_number": 10523, "timestamp_epoch": "1555366460.751004000" }, { "kind": "tls_client_hello", "dst_ip": "185.158.249.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adsfinder.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-c0afdcef42c738685f24fb65", "src_port": 49386, "tcp_stream": 236, "udp_stream": null, "frame_number": 10538, "timestamp_epoch": "1555366499.147301000" }, { "kind": "tls_client_hello", "dst_ip": "185.158.249.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adsfinder.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-cd72a1956f7e636ee7600dcb", "src_port": 49387, "tcp_stream": 237, "udp_stream": null, "frame_number": 10571, "timestamp_epoch": "1555366799.150078000" }, { "kind": "tls_client_hello", "dst_ip": "185.158.249.39", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adsfinder.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-a68e136ab7252484e2160dcf", "src_port": 49389, "tcp_stream": 239, "udp_stream": null, "frame_number": 10617, "timestamp_epoch": "1555367060.759693000" }, { "kind": "tls_client_hello", "dst_ip": "198.54.125.57", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-69d8a345f598934864a309f9", "src_port": 49390, "tcp_stream": 240, "udp_stream": null, "frame_number": 10633, "timestamp_epoch": "1555367120.713603000" }, { "kind": "tls_client_hello", "dst_ip": "109.230.199.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "qqtube.club" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-d94c9b314d548970091253b1", "src_port": 49391, "tcp_stream": 241, "udp_stream": null, "frame_number": 10661, "timestamp_epoch": "1555367420.845474000" }, { "kind": "tls_client_hello", "dst_ip": "109.230.199.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "qqtube.club" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-0879878bf2ddd33360634090", "src_port": 49392, "tcp_stream": 242, "udp_stream": null, "frame_number": 10685, "timestamp_epoch": "1555367660.789976000" }, { "kind": "tls_client_hello", "dst_ip": "109.230.199.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "qqtube.club" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-2109d2ffdae504809568e6f2", "src_port": 49393, "tcp_stream": 243, "udp_stream": null, "frame_number": 10702, "timestamp_epoch": "1555367720.801170000" }, { "kind": "tls_client_hello", "dst_ip": "198.54.115.33", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-c84b8a3c887f438e2371ab13", "src_port": 49395, "tcp_stream": 245, "udp_stream": null, "frame_number": 10745, "timestamp_epoch": "1555368020.731452000" }, { "kind": "tls_client_hello", "dst_ip": "176.10.125.110", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "parolinos.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-965f547a6351a4b69180da31", "src_port": 49396, "tcp_stream": 246, "udp_stream": null, "frame_number": 10773, "timestamp_epoch": "1555368260.831257000" }, { "kind": "tls_client_hello", "dst_ip": "176.10.125.110", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "parolinos.xyz" }, "src_ip": "10.0.90.175", "dst_port": 443, "event_id": "evt-13977839361e0ca19a4d6ff1", "src_port": 49397, "tcp_stream": 247, "udp_stream": null, "frame_number": 10790, "timestamp_epoch": "1555368320.810353000" } ], "unclassified_tcp": [ { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49188, "event_id": "evt-fb4d8d0695dae72c2a46d50b", "src_port": 445, "tcp_stream": 33, "udp_stream": null, "frame_number": 1956, "timestamp_epoch": "1555346675.492952000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49188, "event_id": "evt-a2f3ce5f169e32f4222f6e56", "src_port": 445, "tcp_stream": 33, "udp_stream": null, "frame_number": 1972, "timestamp_epoch": "1555346795.503594000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49188, "event_id": "evt-d8aa9e67815a405cc8bea1dd", "src_port": 445, "tcp_stream": 33, "udp_stream": null, "frame_number": 1974, "timestamp_epoch": "1555346915.513050000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49188, "event_id": "evt-fa781ef2e8f282cf454a4a91", "src_port": 445, "tcp_stream": 33, "udp_stream": null, "frame_number": 2003, "timestamp_epoch": "1555347035.524927000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49188, "event_id": "evt-16d35618d3e1bf514b99ec8c", "src_port": 445, "tcp_stream": 33, "udp_stream": null, "frame_number": 2010, "timestamp_epoch": "1555347155.536409000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49188, "event_id": "evt-319c38974185d87c8fcdcffc", "src_port": 445, "tcp_stream": 33, "udp_stream": null, "frame_number": 2025, "timestamp_epoch": "1555347275.547133000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49188, "event_id": "evt-73cc3d0ecd04ed882a827113", "src_port": 445, "tcp_stream": 33, "udp_stream": null, "frame_number": 2077, "timestamp_epoch": "1555347395.557582000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-af600c5504f52b70f64edc34", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 2718, "timestamp_epoch": "1555351997.519491000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-f35eb93efd63a64a036f5446", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 2750, "timestamp_epoch": "1555352117.530367000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-8b2b6b2ac3f7122f9dc17542", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 2885, "timestamp_epoch": "1555352237.542182000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-a3a2b14e7e2b0afd8160e73c", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 2887, "timestamp_epoch": "1555352357.553063000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-2e8168d4e5559709490e2e8d", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 2906, "timestamp_epoch": "1555352477.563492000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-da783d9607d2bc32d1d9e40b", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 2911, "timestamp_epoch": "1555352597.574378000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-0001a1b7d6b49120e7b4d24f", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3039, "timestamp_epoch": "1555352717.584999000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-5f440bc5e6aa444d98468315", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3088, "timestamp_epoch": "1555352837.595565000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-dff5e96e4e44bb02289f61c0", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3090, "timestamp_epoch": "1555352957.606787000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-7e04297940f96924b1cf75f7", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3109, "timestamp_epoch": "1555353077.620059000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-d2caf932fff3341fbc76f498", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3114, "timestamp_epoch": "1555353197.630276000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-06d4f753c51dcb5aa1192d7f", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3146, "timestamp_epoch": "1555353317.641010000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-d576c4cc201fea1618aa9727", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3158, "timestamp_epoch": "1555353437.651634000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-d2950aef8684f494d47bdead", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3160, "timestamp_epoch": "1555353557.662881000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-7d57d8254ac2795589a130b8", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3179, "timestamp_epoch": "1555353677.673779000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-c75b9618d1b768464898fbbd", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3208, "timestamp_epoch": "1555353797.683879000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-7e919cc1221e886432abe72b", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3240, "timestamp_epoch": "1555353917.695256000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-797c62617f3d279ced19fb68", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3252, "timestamp_epoch": "1555354037.706159000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-9e76202d81a454091e54cdd6", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3254, "timestamp_epoch": "1555354157.702206000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-1c928f5db46626d5715a416a", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3348, "timestamp_epoch": "1555354277.713134000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-a4c398c36790b1ca223f71b0", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3372, "timestamp_epoch": "1555354397.723701000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-077a7d87a59fb57517a3b609", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3404, "timestamp_epoch": "1555354517.734890000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-21da319531968ff4ea45f763", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3416, "timestamp_epoch": "1555354637.730308000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-0c1cb45233e6892e9bfd8178", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3418, "timestamp_epoch": "1555354757.742727000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-0e4cf3738cd1d540559df103", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3439, "timestamp_epoch": "1555354877.752108000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-00292a7e955a669244e61838", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3444, "timestamp_epoch": "1555354997.764238000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-ae27138ed2d4eed3ec050ab9", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3476, "timestamp_epoch": "1555355117.773404000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-a85f36f8f7a6057f47a2b450", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3510, "timestamp_epoch": "1555355237.784963000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-74eed13ab5b2fd8e46014e26", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3512, "timestamp_epoch": "1555355357.781825000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-17da0ae0d7ccc489313e1ebf", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3531, "timestamp_epoch": "1555355477.792263000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-788f40faa997b4bf5c12eeb2", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3536, "timestamp_epoch": "1555355597.802972000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-038a271b426870e2ef962bb7", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3568, "timestamp_epoch": "1555355717.812949000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-f392bc1ebbeffb5eaeff668c", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3580, "timestamp_epoch": "1555355837.823985000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-24ed5e9b562445d74598800b", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3582, "timestamp_epoch": "1555355957.820761000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-f1945af2988565cb0f2b8874", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3601, "timestamp_epoch": "1555356077.830769000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-2ab45f7e4163780bc5b86936", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3628, "timestamp_epoch": "1555356197.842275000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-2abfc30c95d2d1aff670a63c", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3662, "timestamp_epoch": "1555356317.852214000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-5ee0fd039f9c4eb7072c9f11", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3674, "timestamp_epoch": "1555356437.866033000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-f1b148548da77d94c37fcb88", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3676, "timestamp_epoch": "1555356557.875540000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-36f8e45a3a5552acc4fa0385", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3695, "timestamp_epoch": "1555356677.885349000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-614cc4e067e77db9bd9987fb", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3700, "timestamp_epoch": "1555356797.898098000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-31b023016d2c903bd3a049c4", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3732, "timestamp_epoch": "1555356917.908613000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-937fe49df2eada93710b1761", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3765, "timestamp_epoch": "1555357037.919253000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-74af20cb634187a30c45d2da", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3767, "timestamp_epoch": "1555357157.930258000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-56969f9eaea968e7a27ba4be", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3786, "timestamp_epoch": "1555357277.940647000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-963df40dd704561185cb3425", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3791, "timestamp_epoch": "1555357397.952350000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-cfb2a3e96510933077247d33", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3823, "timestamp_epoch": "1555357517.963184000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-adba9c977f84eea1571ba6c4", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3835, "timestamp_epoch": "1555357637.974792000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-911ea6fa24a7fd4b8b3adb39", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3837, "timestamp_epoch": "1555357757.986351000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-1123c5e1c9ddca1b57a0ea2d", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3856, "timestamp_epoch": "1555357877.996387000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-78efdecc5362c1d25ac5bb42", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 3986, "timestamp_epoch": "1555357997.991557000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-1cc6584535393d96ed682f7a", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4041, "timestamp_epoch": "1555358118.001922000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-b17622f69772226942b4733c", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4052, "timestamp_epoch": "1555358238.012485000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-9dab364e94f8ad221f9958fb", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4056, "timestamp_epoch": "1555358358.023215000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-0f3cd332546bdb7a03473f4f", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4075, "timestamp_epoch": "1555358478.035376000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-f32e96bf546c6fc534dc246f", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4079, "timestamp_epoch": "1555358598.046746000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-f34724c7bd557069becc42b7", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4111, "timestamp_epoch": "1555358718.058410000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-08677e310d8c4e1fc5a27ea6", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4147, "timestamp_epoch": "1555358838.067644000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-da1f346b42fa0c2d23217466", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4149, "timestamp_epoch": "1555358958.081125000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-9c2f97c9ace52fa60812ff4c", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4168, "timestamp_epoch": "1555359078.090612000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-987ce06a92b8f406c7cf8683", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4173, "timestamp_epoch": "1555359198.102119000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-c54d9b0e91d585cf7ee0fcdd", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4205, "timestamp_epoch": "1555359318.113142000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-2fddac05f66637213f4867a1", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4219, "timestamp_epoch": "1555359438.124989000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-532ef3ac7dbd7d8990c77c88", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4329, "timestamp_epoch": "1555359558.133791000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-7a54299cb95690df518fbbcd", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4362, "timestamp_epoch": "1555359678.130717000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-b817bc68aad6282ab24cf01e", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4386, "timestamp_epoch": "1555359798.142224000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-f2d12cdbd4b8067c92eabd8c", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4418, "timestamp_epoch": "1555359918.153661000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-cd663ffe6e29eaaee90aa05b", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4430, "timestamp_epoch": "1555360038.162812000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-a43a91628a1558a44c606a46", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4432, "timestamp_epoch": "1555360158.173432000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-f9af925426140c2524bbd5c7", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4453, "timestamp_epoch": "1555360278.185930000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-e70a85de2a8204213883e6fc", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4460, "timestamp_epoch": "1555360398.196334000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-cd057f6c17f2cae363885efd", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4492, "timestamp_epoch": "1555360518.193069000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-d3e9968274746ee9e10927b0", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4526, "timestamp_epoch": "1555360638.201520000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-41d35fa48079fafc66764340", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4528, "timestamp_epoch": "1555360758.214169000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-a0f601ff1c297563ef6618bf", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4549, "timestamp_epoch": "1555360878.224076000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-08303374ef8a1604123880b0", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4554, "timestamp_epoch": "1555360998.235112000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-15ac5bdb0fc51abcd97e1f5e", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4586, "timestamp_epoch": "1555361118.230348000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-92045db2fc79febe933e23d6", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4597, "timestamp_epoch": "1555361238.242694000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-cc5fa51f157d0d79f307cc73", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4599, "timestamp_epoch": "1555361358.254770000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-bd3971cf04eac33c4bc1d9ee", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4620, "timestamp_epoch": "1555361478.265244000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-341cbfc19fb604f3ffd399ef", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4649, "timestamp_epoch": "1555361598.275802000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-83b8a0fea4ba334aa8cb82fa", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4681, "timestamp_epoch": "1555361718.270356000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-605b2fa81824b3a7fd30ecae", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4692, "timestamp_epoch": "1555361838.281279000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-c2db720fd5192259f4a41d06", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4694, "timestamp_epoch": "1555361958.293277000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-52eddea2ab1a2c26783d6ffc", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4713, "timestamp_epoch": "1555362078.303679000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-428eb00fdc98660a3e70e5a9", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4718, "timestamp_epoch": "1555362198.314212000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-f53ca2b3b2fc3aa6fc23b581", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4750, "timestamp_epoch": "1555362318.311019000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-89c601674e68596576d5a291", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4787, "timestamp_epoch": "1555362438.321710000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-78a81418967f00c077514e45", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4789, "timestamp_epoch": "1555362558.332700000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-957aecabdd88022ffe4e3c91", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4809, "timestamp_epoch": "1555362678.344850000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-f1217ea6e0152f0678383d68", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4814, "timestamp_epoch": "1555362798.354024000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-9ad6b2b9d9b2b0def77b27c7", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4846, "timestamp_epoch": "1555362918.365493000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-938f2ba3b3512e955e64eb07", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4858, "timestamp_epoch": "1555363038.377301000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-675db5bd852eb3c2155070fa", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4860, "timestamp_epoch": "1555363158.387315000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-c819e2b563393ea514786de7", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4888, "timestamp_epoch": "1555363278.398043000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-6b2fd73343ca092fe92eea52", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 4917, "timestamp_epoch": "1555363398.409707000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-b8509954f1642b544a48e036", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 5367, "timestamp_epoch": "1555363518.418888000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-03627fb25e6545f89415577e", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 9980, "timestamp_epoch": "1555363638.430826000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-616e3413dd4e1c0e07f491dd", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 9982, "timestamp_epoch": "1555363758.441846000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-08f4ba24efab65fbd96256d7", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10012, "timestamp_epoch": "1555363878.452848000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-b0b89d59e7cf89d0246fbd90", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10020, "timestamp_epoch": "1555363998.464090000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-ec39337acfd6f3d49d3d178f", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10075, "timestamp_epoch": "1555364118.473857000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-e08ce9deb2575b8aa8eebe89", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10108, "timestamp_epoch": "1555364238.485984000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-906477ffc09f71e9b03c44df", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10113, "timestamp_epoch": "1555364358.480549000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-a14df699a8f4f6d0e0aeb3e9", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10132, "timestamp_epoch": "1555364478.491697000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-25353015f52abc7cbb49c06c", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10139, "timestamp_epoch": "1555364598.503634000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-66e714d05aa28ec79b2d73be", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10169, "timestamp_epoch": "1555364718.513863000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-99308a60931d3e581d2efa32", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10177, "timestamp_epoch": "1555364838.524814000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-4ee8acdd01131b60536c2de1", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10179, "timestamp_epoch": "1555364958.535810000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-ef322e23a1bde40a0be111b9", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10203, "timestamp_epoch": "1555365078.548263000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-66308e6185f89412fe84c279", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10229, "timestamp_epoch": "1555365198.559783000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-e325077140b3e4ab32d1ca54", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10261, "timestamp_epoch": "1555365318.568491000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-c66bc3a9b30cbf055b26a7ab", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10269, "timestamp_epoch": "1555365438.581143000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-4dd2d78fcb761794436e5951", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10271, "timestamp_epoch": "1555365558.593283000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-923320ddf82ff15ed46b2f6a", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10406, "timestamp_epoch": "1555365678.602283000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-4e15cf60d930368aa7550d1c", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10427, "timestamp_epoch": "1555365798.613749000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-424dd023b0710dfbc2cbb17e", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10459, "timestamp_epoch": "1555365918.609559000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-6b098250b8e1ad3ed8d3b70c", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10492, "timestamp_epoch": "1555366038.618911000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-7934f833b468657fd10803dc", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10495, "timestamp_epoch": "1555366158.631139000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-8b4e73482c5a7ddde6dcd074", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10512, "timestamp_epoch": "1555366278.642239000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-359d2a9e10356fb206bfb556", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10518, "timestamp_epoch": "1555366398.654839000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-8a30d461bc6543d33a6fbb8d", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10548, "timestamp_epoch": "1555366518.663765000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-4aad1828eb6eca4240a3c8b8", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10563, "timestamp_epoch": "1555366638.674502000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-aecb9f5c4ac72d77fe638281", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10566, "timestamp_epoch": "1555366758.685034000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-7bdadab3634e758a3ce08e69", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10583, "timestamp_epoch": "1555366878.681418000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-5d7cfad3f8b98be317f2fe23", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10612, "timestamp_epoch": "1555366998.692228000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-4be9a2f1d04f011b2b791919", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10627, "timestamp_epoch": "1555367118.703136000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-eb3f60cf964aed76ece0e601", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10652, "timestamp_epoch": "1555367238.699029000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-a4eb454b4b974c3d7f11c0ad", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10654, "timestamp_epoch": "1555367358.710298000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-ca92fc0c2dc11078d253fac3", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10673, "timestamp_epoch": "1555367478.720409000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-eab83e1f00b2e85a9ab4f75a", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10680, "timestamp_epoch": "1555367598.731420000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-9de3a2723470637afd823f02", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10697, "timestamp_epoch": "1555367718.741767000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-b22bebbb607046f853b3263a", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10737, "timestamp_epoch": "1555367838.753508000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-7ed6212efcac28e59be3ae3c", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10740, "timestamp_epoch": "1555367958.766076000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-9b18dc264b26b3ec2cdf05fb", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10764, "timestamp_epoch": "1555368078.775644000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-3d0c9641f0ab07fac7174f95", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10766, "timestamp_epoch": "1555368198.787922000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.175", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49248, "event_id": "evt-e068bb1dd5aea7bc3993df24", "src_port": 445, "tcp_stream": 95, "udp_stream": null, "frame_number": 10785, "timestamp_epoch": "1555368318.798766000" } ], "directory_service": [ { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-68c0b84cbb85c6e8ff5165b6", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 37, "timestamp_epoch": "1555346526.355510000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-62a394cbecc9b06a3deaecfe", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 39, "timestamp_epoch": "1555346526.355733000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-644d9f0e195bf378348a9a7a", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 72, "timestamp_epoch": "1555346526.407400000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d1f73865cc6c80484bb1552a", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 74, "timestamp_epoch": "1555346526.407973000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-497bc9ac5c250b1d3e141d17", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 75, "timestamp_epoch": "1555346526.409137000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f973a87440d9c30b4101a7f5", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 76, "timestamp_epoch": "1555346526.409311000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8708b95877d30ba01d7efb6e", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 77, "timestamp_epoch": "1555346526.410098000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-33316dbea42a222a7cd75cee", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 78, "timestamp_epoch": "1555346526.410381000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-14292e82942f93512c6534ce", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 149, "timestamp_epoch": "1555346526.521254000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-fd2e19bb154ed70088310c38", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 151, "timestamp_epoch": "1555346526.521591000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e1414ff526817fc8e7d28863", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 160, "timestamp_epoch": "1555346526.571565000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-fb0441cfa71a2660ab0ee84c", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 162, "timestamp_epoch": "1555346526.571859000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1a6e4ce57c1900f6ef8a09fe", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 177, "timestamp_epoch": "1555346526.575676000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b0b14f37907e11505d3c624a", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 179, "timestamp_epoch": "1555346526.576222000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8f8caaf94daf0db6486ce590", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 180, "timestamp_epoch": "1555346526.581695000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-dea51fb191f9cf51562fab19", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 189, "timestamp_epoch": "1555346526.619769000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1f187e066612c4f3a615645c", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 192, "timestamp_epoch": "1555346526.620277000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-594f082afaeb9530c6693389", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 198, "timestamp_epoch": "1555346526.621537000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-89aae81ab234aec764fb69e3", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 200, "timestamp_epoch": "1555346526.621880000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8575e46ad2bdb932e74825ce", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 206, "timestamp_epoch": "1555346526.623950000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-499b28ca74cdbe1ee47f9ca0", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 208, "timestamp_epoch": "1555346526.624241000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f4a4757f3677cfa732348b04", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 209, "timestamp_epoch": "1555346526.624525000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-dd89733ba17a4c3b0aa134fe", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 210, "timestamp_epoch": "1555346526.624748000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-baca9a396fdc48973f8043c1", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 211, "timestamp_epoch": "1555346526.624977000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-fb013e902ec100eee1176c7c", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 281, "timestamp_epoch": "1555346530.104678000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5bfa317d30a631afb6c60961", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 283, "timestamp_epoch": "1555346530.104951000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7b4458a5a3402f571c15b6b9", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 286, "timestamp_epoch": "1555346530.105981000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-bc201d3b3b55f9be2f35ca57", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 288, "timestamp_epoch": "1555346530.106666000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1282bb9edc932c4775cf2276", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 301, "timestamp_epoch": "1555346530.117181000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-940001c47b5eeee4741ca056", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 302, "timestamp_epoch": "1555346530.117479000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-c6be6969502992168099dfa5", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 326, "timestamp_epoch": "1555346530.121497000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-48054bccfbc2aa08c3e2d2c9", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 330, "timestamp_epoch": "1555346530.122121000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-55a97b9227470f30458a3e12", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 333, "timestamp_epoch": "1555346530.122490000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0b949f5cd9f5fd06dea50ac8", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 334, "timestamp_epoch": "1555346530.122618000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f31657a55710e5c47192fc19", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 335, "timestamp_epoch": "1555346530.122821000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2d37d9c35bd12a0d6e332cc8", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 336, "timestamp_epoch": "1555346530.123005000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7e3b2bea0003e38ca1c3b8c1", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 337, "timestamp_epoch": "1555346530.123241000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-46a89b977034431fb6e9b42a", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 338, "timestamp_epoch": "1555346530.123700000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d4e494c518c2c3b0f4bd499e", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 385, "timestamp_epoch": "1555346530.133804000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-138f413b88b4bfac525ad954", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 391, "timestamp_epoch": "1555346531.111987000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a0cc7ce6a05b3d2ebcd9710c", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 523, "timestamp_epoch": "1555346533.413413000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8702695470c22f842bbf192c", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 525, "timestamp_epoch": "1555346533.413982000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7f7fde780f0d7d65975beeab", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 526, "timestamp_epoch": "1555346533.415820000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ddb2faa35c989c507411723a", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 527, "timestamp_epoch": "1555346533.416081000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f15bca6d05885c454087cb85", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 532, "timestamp_epoch": "1555346533.419178000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-290d2fff30061253ae41395e", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 534, "timestamp_epoch": "1555346533.419686000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cc3f52da11c7f881f61569ab", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 535, "timestamp_epoch": "1555346533.420065000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a7014cbea7676fbf947994c6", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 536, "timestamp_epoch": "1555346533.420235000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ec622a2354bef59012b48970", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 537, "timestamp_epoch": "1555346533.420450000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3a45f62b8f122320cbb30dca", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 538, "timestamp_epoch": "1555346533.420803000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a25e7c3423bd405c365e6929", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 539, "timestamp_epoch": "1555346533.421225000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6f4567fc85d54c5d28d07192", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 540, "timestamp_epoch": "1555346533.421925000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-089e6fa5c66515ec56fb51fd", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 557, "timestamp_epoch": "1555346533.428925000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a7c17071a57e2b6790eb0167", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 561, "timestamp_epoch": "1555346534.009929000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e1ab05515f0ea8b640c254c0", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 578, "timestamp_epoch": "1555346537.139734000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a47981962c5f79f4bc1b311b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 580, "timestamp_epoch": "1555346537.140014000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-80591ec57df07d6121f9ae92", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 583, "timestamp_epoch": "1555346537.141592000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c72c67997976f21fbc57e583", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 585, "timestamp_epoch": "1555346537.142162000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d32e1911efa2f12ca5b64e6a", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 586, "timestamp_epoch": "1555346537.143482000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0ce880ef5843e354d712e621", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 587, "timestamp_epoch": "1555346537.143632000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-b90356cd280c94e657a8742b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 588, "timestamp_epoch": "1555346537.143771000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-fdcaef92e32d0cbbe95b40ea", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 589, "timestamp_epoch": "1555346537.143914000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=STINGRAYAHOY-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a1254b753f888c5637485a25", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 590, "timestamp_epoch": "1555346537.144072000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d22e21c15de3612404bdb10d", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 591, "timestamp_epoch": "1555346537.144257000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4da1431c2dff743d7c598b85", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 592, "timestamp_epoch": "1555346537.144417000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a027e3bee112426ddcb3ac3d", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 593, "timestamp_epoch": "1555346537.145300000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cba401f96f987ae6810c235f", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 598, "timestamp_epoch": "1555346537.153441000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0fe57fd60587cdb64d75f375", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 600, "timestamp_epoch": "1555346537.153977000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d6a3404caf98eeddf9c77b3e", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 601, "timestamp_epoch": "1555346537.154414000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2bb954b6c07a6611e0faf6e9", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 602, "timestamp_epoch": "1555346537.154581000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-457a24242d465c44507d520a", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 633, "timestamp_epoch": "1555346537.180058000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-41cf4c8ff1d5667d1c1421b1", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 634, "timestamp_epoch": "1555346537.180842000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f0e03b02213aaec1a3d3da7e", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 635, "timestamp_epoch": "1555346537.181214000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5f4ee63d0d9670ff38e1d352", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 637, "timestamp_epoch": "1555346537.181717000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-507c7036164704f285822264", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 2785, "timestamp_epoch": "1555352174.240226000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8f9d96b0927f5b1f101b6458", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 2786, "timestamp_epoch": "1555352174.240511000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-66cb456bb5310ee24f55a491", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 2787, "timestamp_epoch": "1555352174.240856000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e04d9f27bc900f3162e05275", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 2788, "timestamp_epoch": "1555352174.241405000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-aa32991700265f9e1af61c1a", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 2789, "timestamp_epoch": "1555352174.241671000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-739bd84ad9708122ef42316b", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 2790, "timestamp_epoch": "1555352174.241847000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a09db78aae69083f37d4d59f", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2801, "timestamp_epoch": "1555352174.651882000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ffe0417f68599b08f334a281", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2803, "timestamp_epoch": "1555352174.652149000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9153348f90914b35f90397e5", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2806, "timestamp_epoch": "1555352174.653540000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2fa69065636b6a50a2bd4288", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2808, "timestamp_epoch": "1555352174.654166000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-99f3f0fceeedd5bcd5968212", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2809, "timestamp_epoch": "1555352174.656919000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a04cbe78a4ef3108868d9945", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2810, "timestamp_epoch": "1555352174.657199000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9c8a42f76ce05f305b0c2281", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 2817, "timestamp_epoch": "1555352174.769122000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9b53f52f4bfeadf127dd234b", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 2819, "timestamp_epoch": "1555352174.769919000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e1c5da3990c8009a4a0cc994", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 2820, "timestamp_epoch": "1555352174.770616000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0cf85a3fd4f11306819b6a9e", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 2821, "timestamp_epoch": "1555352174.770834000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4059e83a457b7bba0b6060d7", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 2822, "timestamp_epoch": "1555352174.771256000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7b1f67ad01489541deb5ff27", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 2823, "timestamp_epoch": "1555352174.771536000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ed436b27b701ac055bfb925d", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2824, "timestamp_epoch": "1555352174.771948000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d8ae6f8c0b200e6fade0ee74", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2825, "timestamp_epoch": "1555352174.772305000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-50759379284d3cf7c0c5d786", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 2850, "timestamp_epoch": "1555352174.783711000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-29a20f93cf6666c64d4b5d6e", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 2854, "timestamp_epoch": "1555352175.299598000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-409ff961a6915d2ea5064e28", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2961, "timestamp_epoch": "1555352711.137299000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3243958583679f4f039ce759", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2962, "timestamp_epoch": "1555352711.137533000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-391410571a609e3ea4e55c86", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2963, "timestamp_epoch": "1555352711.137853000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2cc3cb9c74f0555b9bd2de10", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2964, "timestamp_epoch": "1555352711.138143000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7cee65d2f2a3dcbd64f54d70", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2965, "timestamp_epoch": "1555352711.138380000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7a88c6fc24445da8460b52c6", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 2966, "timestamp_epoch": "1555352711.138560000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-541bbcbd0fe473177f213542", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2973, "timestamp_epoch": "1555352711.647662000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-32c02d9a1b001ce51ca0282a", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2975, "timestamp_epoch": "1555352711.648467000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4d1fe7dd05a5516dd3bcdc23", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2978, "timestamp_epoch": "1555352711.756971000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6ce786d8f8588676f14ec8e8", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2979, "timestamp_epoch": "1555352711.757388000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-783dabc4a01df54e60ee626b", "src_port": null, "tcp_stream": 111, "udp_stream": null, "frame_number": 2984, "timestamp_epoch": "1555352711.762320000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b0a55e26067646c9cde16521", "src_port": null, "tcp_stream": 111, "udp_stream": null, "frame_number": 2986, "timestamp_epoch": "1555352711.762961000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-6c7a5f50831393d1554eea82", "src_port": null, "tcp_stream": 111, "udp_stream": null, "frame_number": 2987, "timestamp_epoch": "1555352711.763622000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0dd52c684205b8a703944888", "src_port": null, "tcp_stream": 111, "udp_stream": null, "frame_number": 2988, "timestamp_epoch": "1555352711.763790000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-2698bcadb76f83316d72fd57", "src_port": null, "tcp_stream": 111, "udp_stream": null, "frame_number": 2989, "timestamp_epoch": "1555352711.763988000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-11a000e25e3e055b4a4d6053", "src_port": null, "tcp_stream": 111, "udp_stream": null, "frame_number": 2990, "timestamp_epoch": "1555352711.764190000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-01f144e27a1a0a87dee6207d", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2991, "timestamp_epoch": "1555352711.764407000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c3f7fcb0935332ab19506cc7", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 2992, "timestamp_epoch": "1555352711.764994000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e95ab2dd8316e2e7b7645efa", "src_port": null, "tcp_stream": 111, "udp_stream": null, "frame_number": 3033, "timestamp_epoch": "1555352711.775193000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-77868c5b7799a1b053eb6b55", "src_port": null, "tcp_stream": 110, "udp_stream": null, "frame_number": 3037, "timestamp_epoch": "1555352712.283621000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9f813c88ea6c9ba5e6ec7df3", "src_port": null, "tcp_stream": 125, "udp_stream": null, "frame_number": 3297, "timestamp_epoch": "1555354242.378414000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a9b7351151b6e7538d74181c", "src_port": null, "tcp_stream": 125, "udp_stream": null, "frame_number": 3299, "timestamp_epoch": "1555354242.378668000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4d965f5a88cd524ae390b46e", "src_port": null, "tcp_stream": 125, "udp_stream": null, "frame_number": 3302, "timestamp_epoch": "1555354242.379984000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-deacc3bc274b53c44555e8d1", "src_port": null, "tcp_stream": 125, "udp_stream": null, "frame_number": 3304, "timestamp_epoch": "1555354242.380589000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-997424b8634bd3dd346b42df", "src_port": null, "tcp_stream": 125, "udp_stream": null, "frame_number": 3305, "timestamp_epoch": "1555354242.381061000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a396ae3ed13e6a3d1bf9305b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 3916, "timestamp_epoch": "1555357995.842934000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4ff4b8261b6e25afe90332e6", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 3917, "timestamp_epoch": "1555357995.843182000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4c321c88f104717c4af46eac", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 3918, "timestamp_epoch": "1555357995.843467000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-811e61fa2ffb12363eb44ec1", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 3919, "timestamp_epoch": "1555357995.843815000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5670d11bc9b06f9164681e96", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 3920, "timestamp_epoch": "1555357995.844029000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1cf48b8e92b7e1dd0818a2b6", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 3921, "timestamp_epoch": "1555357995.844187000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-fc1412047345a5e4ff9ec676", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 3929, "timestamp_epoch": "1555357995.954885000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4d356908d7de00895eef87f5", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 3931, "timestamp_epoch": "1555357995.955152000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d885bd54dfcb32d107181f39", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 3934, "timestamp_epoch": "1555357995.956532000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-830b8688fdc4985c1153ec94", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 3936, "timestamp_epoch": "1555357995.957216000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-eaf8a1e462757158a86976b9", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 3937, "timestamp_epoch": "1555357995.959923000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0b51c8d7f02e5f8ae779d39e", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 3938, "timestamp_epoch": "1555357995.960232000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-564c9e690b09065564a0973e", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 3947, "timestamp_epoch": "1555357996.074107000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-85f8e53c73592d613e310d1f", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 3949, "timestamp_epoch": "1555357996.074921000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-97778740b56c3fdd236305e7", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 3950, "timestamp_epoch": "1555357996.075478000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-00e9e985c7d6897181113b05", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 3951, "timestamp_epoch": "1555357996.075674000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-133bf4833bccc9d1d737045d", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 3952, "timestamp_epoch": "1555357996.076097000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-13ee6dffbd7f90d5cc412036", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 3953, "timestamp_epoch": "1555357996.076344000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-e7f19d0e4c4e534e1078cba0", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 3954, "timestamp_epoch": "1555357996.076653000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6cdd4c20dfa6bd2cc9c4736e", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 3955, "timestamp_epoch": "1555357996.077000000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-a3cff9f29ef955d63d37251e", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 3980, "timestamp_epoch": "1555357996.091248000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9c0fba34e5068811aeb62ff1", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 3984, "timestamp_epoch": "1555357996.606694000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-28f227e6255cb50aace7c502", "src_port": null, "tcp_stream": 165, "udp_stream": null, "frame_number": 4237, "timestamp_epoch": "1555359552.313790000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5391469865be65c57e63265e", "src_port": null, "tcp_stream": 165, "udp_stream": null, "frame_number": 4238, "timestamp_epoch": "1555359552.314064000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d1dda7baedca41200cb4e47e", "src_port": null, "tcp_stream": 165, "udp_stream": null, "frame_number": 4239, "timestamp_epoch": "1555359552.314366000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3e8ababc11c653289e131b27", "src_port": null, "tcp_stream": 165, "udp_stream": null, "frame_number": 4240, "timestamp_epoch": "1555359552.314659000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-70d464548bf08a47efe00837", "src_port": null, "tcp_stream": 165, "udp_stream": null, "frame_number": 4241, "timestamp_epoch": "1555359552.314876000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-99b2012ce200a50b32a775dc", "src_port": null, "tcp_stream": 165, "udp_stream": null, "frame_number": 4242, "timestamp_epoch": "1555359552.315032000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5b34dac9119cbd55c67f330c", "src_port": null, "tcp_stream": 166, "udp_stream": null, "frame_number": 4252, "timestamp_epoch": "1555359552.822160000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b321bf6092210d73cf392f97", "src_port": null, "tcp_stream": 166, "udp_stream": null, "frame_number": 4254, "timestamp_epoch": "1555359552.822411000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1ace01564f475ced028ccf38", "src_port": null, "tcp_stream": 166, "udp_stream": null, "frame_number": 4257, "timestamp_epoch": "1555359552.823805000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b69525b9bc25ab5713c3e756", "src_port": null, "tcp_stream": 166, "udp_stream": null, "frame_number": 4259, "timestamp_epoch": "1555359552.824511000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4a18b2cec4b652a238ab3bde", "src_port": null, "tcp_stream": 166, "udp_stream": null, "frame_number": 4262, "timestamp_epoch": "1555359552.928989000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7567c8fa72ff0e68a0fc7647", "src_port": null, "tcp_stream": 166, "udp_stream": null, "frame_number": 4263, "timestamp_epoch": "1555359552.929569000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-4a204dd7a7150e83b6c5c97e", "src_port": null, "tcp_stream": 167, "udp_stream": null, "frame_number": 4268, "timestamp_epoch": "1555359552.934589000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c335521a2cf88930bbd7dfb6", "src_port": null, "tcp_stream": 167, "udp_stream": null, "frame_number": 4270, "timestamp_epoch": "1555359552.935285000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-54f980d1bda2a9d44eea5472", "src_port": null, "tcp_stream": 167, "udp_stream": null, "frame_number": 4271, "timestamp_epoch": "1555359552.935761000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-751dfab189996882bb7dc184", "src_port": null, "tcp_stream": 167, "udp_stream": null, "frame_number": 4272, "timestamp_epoch": "1555359552.935919000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-be1245ba9065712af4771a08", "src_port": null, "tcp_stream": 167, "udp_stream": null, "frame_number": 4273, "timestamp_epoch": "1555359552.936117000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-494ac84d80853eada5fba499", "src_port": null, "tcp_stream": 167, "udp_stream": null, "frame_number": 4274, "timestamp_epoch": "1555359552.936310000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9325b9c3e3756dd23cf627f9", "src_port": null, "tcp_stream": 166, "udp_stream": null, "frame_number": 4275, "timestamp_epoch": "1555359552.936499000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7da0f521e7d78eba164de30f", "src_port": null, "tcp_stream": 166, "udp_stream": null, "frame_number": 4276, "timestamp_epoch": "1555359552.936747000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d74a98b21161c8e5f58a9ce4", "src_port": null, "tcp_stream": 167, "udp_stream": null, "frame_number": 4323, "timestamp_epoch": "1555359552.949832000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9a61fa7b125894579c21395c", "src_port": null, "tcp_stream": 166, "udp_stream": null, "frame_number": 4327, "timestamp_epoch": "1555359553.456526000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d4ed40cfb064b1b683db32b3", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 9814, "timestamp_epoch": "1555363523.743975000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-388b0b8cfe728c89d65d1abf", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 9815, "timestamp_epoch": "1555363523.744208000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-fc158cd234b8340beafffb8c", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 9816, "timestamp_epoch": "1555363523.744507000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-07beb43b68a576e51bcd9be5", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 9817, "timestamp_epoch": "1555363523.744833000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f012b1ea680066ec6b1377df", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 9818, "timestamp_epoch": "1555363523.745028000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3bdcf8a7588151973aaa510b", "src_port": null, "tcp_stream": 203, "udp_stream": null, "frame_number": 9819, "timestamp_epoch": "1555363523.745165000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-f794dc112ef41c0bc3c28e9f", "src_port": null, "tcp_stream": 205, "udp_stream": null, "frame_number": 9869, "timestamp_epoch": "1555363576.617425000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d49b5f6f9e86724d7b9635de", "src_port": null, "tcp_stream": 205, "udp_stream": null, "frame_number": 9870, "timestamp_epoch": "1555363576.617691000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-bed0a960c88911e879603f9f", "src_port": null, "tcp_stream": 205, "udp_stream": null, "frame_number": 9871, "timestamp_epoch": "1555363576.618004000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-50386b27e665e8b432482ebc", "src_port": null, "tcp_stream": 205, "udp_stream": null, "frame_number": 9872, "timestamp_epoch": "1555363576.618409000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8daa2773566955418d930e28", "src_port": null, "tcp_stream": 205, "udp_stream": null, "frame_number": 9873, "timestamp_epoch": "1555363576.618734000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-24d4b5d4811f06b853f7016d", "src_port": null, "tcp_stream": 205, "udp_stream": null, "frame_number": 9874, "timestamp_epoch": "1555363576.618909000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-10b57aa0337e3fd1f2b8e00a", "src_port": null, "tcp_stream": 207, "udp_stream": null, "frame_number": 9894, "timestamp_epoch": "1555363577.236967000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2f129009bccb879212984b64", "src_port": null, "tcp_stream": 207, "udp_stream": null, "frame_number": 9896, "timestamp_epoch": "1555363577.237159000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-912ed879adf2d31116fff42c", "src_port": null, "tcp_stream": 207, "udp_stream": null, "frame_number": 9899, "timestamp_epoch": "1555363577.238374000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-56303481bd8cc3a9623a1d43", "src_port": null, "tcp_stream": 207, "udp_stream": null, "frame_number": 9901, "timestamp_epoch": "1555363577.239010000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-1fe142464d6c86615177553b", "src_port": null, "tcp_stream": 207, "udp_stream": null, "frame_number": 9902, "timestamp_epoch": "1555363577.241265000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1843ddb58205dbc1b51bf97a", "src_port": null, "tcp_stream": 207, "udp_stream": null, "frame_number": 9903, "timestamp_epoch": "1555363577.241528000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-04650cf501a42206ab6efcf7", "src_port": null, "tcp_stream": 208, "udp_stream": null, "frame_number": 9910, "timestamp_epoch": "1555363577.344925000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f312bc8138147c0dd82aed8a", "src_port": null, "tcp_stream": 208, "udp_stream": null, "frame_number": 9912, "timestamp_epoch": "1555363577.345753000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-6f319f232bc71a373bf044f5", "src_port": null, "tcp_stream": 208, "udp_stream": null, "frame_number": 9913, "timestamp_epoch": "1555363577.346351000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-84cff6bd14b6ac5b36a8a245", "src_port": null, "tcp_stream": 208, "udp_stream": null, "frame_number": 9914, "timestamp_epoch": "1555363577.346550000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3b6e3406fd1114e7a96de862", "src_port": null, "tcp_stream": 208, "udp_stream": null, "frame_number": 9915, "timestamp_epoch": "1555363577.346865000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-83166e281616f2dd047079ba", "src_port": null, "tcp_stream": 208, "udp_stream": null, "frame_number": 9916, "timestamp_epoch": "1555363577.347117000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-3b038b56666963812db3f93a", "src_port": null, "tcp_stream": 207, "udp_stream": null, "frame_number": 9917, "timestamp_epoch": "1555363577.347438000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a07627b862351c614903cd82", "src_port": null, "tcp_stream": 207, "udp_stream": null, "frame_number": 9918, "timestamp_epoch": "1555363577.347756000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-9c549460643ff2400347f515", "src_port": null, "tcp_stream": 208, "udp_stream": null, "frame_number": 9943, "timestamp_epoch": "1555363577.360279000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-fd17e7d7bfd0e6a28aacee4d", "src_port": null, "tcp_stream": 207, "udp_stream": null, "frame_number": 9947, "timestamp_epoch": "1555363577.876478000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-21ccf7341f78d0ebfd739dd0", "src_port": null, "tcp_stream": 225, "udp_stream": null, "frame_number": 10314, "timestamp_epoch": "1555365673.587250000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-15802447db65155efe4281c3", "src_port": null, "tcp_stream": 225, "udp_stream": null, "frame_number": 10315, "timestamp_epoch": "1555365673.587522000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7ad723eb87cfa4cdb659e27f", "src_port": null, "tcp_stream": 225, "udp_stream": null, "frame_number": 10316, "timestamp_epoch": "1555365673.587797000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d6e1ba1121e93baab21ae46a", "src_port": null, "tcp_stream": 225, "udp_stream": null, "frame_number": 10317, "timestamp_epoch": "1555365673.588151000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7410d2cb3adb2b8507b8a274", "src_port": null, "tcp_stream": 225, "udp_stream": null, "frame_number": 10318, "timestamp_epoch": "1555365673.588379000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-88feb01e39a3b3146ecb34d1", "src_port": null, "tcp_stream": 225, "udp_stream": null, "frame_number": 10319, "timestamp_epoch": "1555365673.588552000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-8c75241c880ab7ca6f09f57a", "src_port": null, "tcp_stream": 226, "udp_stream": null, "frame_number": 10329, "timestamp_epoch": "1555365673.991139000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0cce1d67989299e9693352be", "src_port": null, "tcp_stream": 226, "udp_stream": null, "frame_number": 10331, "timestamp_epoch": "1555365673.991410000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-7734ac3964df35f57c7ad46e", "src_port": null, "tcp_stream": 226, "udp_stream": null, "frame_number": 10334, "timestamp_epoch": "1555365673.992812000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-377fecd96a45fec1c0744278", "src_port": null, "tcp_stream": 226, "udp_stream": null, "frame_number": 10336, "timestamp_epoch": "1555365673.993535000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-547f91a058d143f72f4ef72b", "src_port": null, "tcp_stream": 226, "udp_stream": null, "frame_number": 10337, "timestamp_epoch": "1555365674.001563000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-dbb7e7d4d01d41c9643ea88c", "src_port": null, "tcp_stream": 226, "udp_stream": null, "frame_number": 10338, "timestamp_epoch": "1555365674.001950000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-d6796d4f1b024b8fe02095c1", "src_port": null, "tcp_stream": 229, "udp_stream": null, "frame_number": 10367, "timestamp_epoch": "1555365674.112248000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-068903258ba63e94caf2fb2e", "src_port": null, "tcp_stream": 229, "udp_stream": null, "frame_number": 10369, "timestamp_epoch": "1555365674.113024000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-186c984af6a0a9ccfde2052b", "src_port": null, "tcp_stream": 229, "udp_stream": null, "frame_number": 10370, "timestamp_epoch": "1555365674.113849000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-251c8f527348847a4c56c7b0", "src_port": null, "tcp_stream": 229, "udp_stream": null, "frame_number": 10371, "timestamp_epoch": "1555365674.114069000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-5d5cfd69e3c6d890a29f499d", "src_port": null, "tcp_stream": 229, "udp_stream": null, "frame_number": 10372, "timestamp_epoch": "1555365674.114648000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d95891dcffa9c5b637990e06", "src_port": null, "tcp_stream": 229, "udp_stream": null, "frame_number": 10373, "timestamp_epoch": "1555365674.114931000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=stingrayahoy,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-64315271236b52a848740951", "src_port": null, "tcp_stream": 226, "udp_stream": null, "frame_number": 10374, "timestamp_epoch": "1555365674.115295000" }, { "kind": "directory_service", "dst_ip": "10.0.90.175", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-585accafe800797634b0a15d", "src_port": null, "tcp_stream": 226, "udp_stream": null, "frame_number": 10375, "timestamp_epoch": "1555365674.115678000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-ab6db196a277b3ace157d782", "src_port": null, "tcp_stream": 229, "udp_stream": null, "frame_number": 10400, "timestamp_epoch": "1555365674.129404000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.175", "dst_port": null, "event_id": "evt-cdee34dff9ef748e7762a8cd", "src_port": null, "tcp_stream": 226, "udp_stream": null, "frame_number": 10404, "timestamp_epoch": "1555365674.642222000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 10807, "interface_ids": [], "source_sha256": "2d27b8be5a880af7cfd5a51bd9a184e546344afe42261c323b41e34b961a288c", "captured_bytes": 7156497, "protocol_counts": { "ip": 10807, "dns": 142, "eth": 10807, "ntp": 30, "smb": 32, "tcp": 10521, "tls": 810, "udp": 276, "data": 157, "dhcp": 8, "http": 26, "igmp": 20, "ldap": 183, "nbns": 42, "nbss": 576, "smb2": 544, "cldap": 42, "llmnr": 12, "media": 4, "dcerpc": 156, "spnego": 207, "x509ce": 470, "gss-api": 269, "x509sat": 1493, "kerberos": 60, "ethertype": 10807, "spnego-krb5": 350, "pkix1explicit": 9, "pkix1implicit": 19, "data-text-lines": 6 }, "duration_seconds": 21854.441361, "last_packet_epoch": "1555368380.651385", "source_size_bytes": 7329433, "first_packet_epoch": "1555346526.210024", "encapsulation_types": [ 1 ] }, "summary": "Decoded 10807 packets across 28 IP endpoints and 348 transport flows. Observed 142 DNS events, 13 HTTP requests, 116 TLS ClientHello events, and 14 recovered file/message object(s). Deterministic rules produced 7 finding(s): 0 high, 3 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 142, "truncated": false }, "dhcp": { "returned": 8, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 721, "truncated": false }, "http_request": { "returned": 13, "truncated": false }, "http_response": { "returned": 13, "truncated": false }, "tls_client_hello": { "returned": 116, "truncated": false }, "unclassified_tcp": { "returned": 144, "truncated": false }, "directory_service": { "returned": 215, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 5793981, "export_status": "completed", "unique_hashes": 14, "hashed_objects": 15, "compact_objects": 0, "detailed_objects": 14, "exported_objects": 15, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 14 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": true, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/client.rar", "source": "151.106.27.208", "destination": "10.0.90.175", "content_type": "", "response_count": 2, "declared_body_bytes": 1182 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 59, "frame_number": 1931, "display_filter": "frame.number == 1931", "timestamp_epoch": "1555346661.898719000" }, { "tcp_stream": 59, "frame_number": 1933, "display_filter": "frame.number == 1933", "timestamp_epoch": "1555346662.032496000" }, { "tcp_stream": 63, "frame_number": 1994, "display_filter": "frame.number == 1994", "timestamp_epoch": "1555346969.613910000" }, { "tcp_stream": 63, "frame_number": 1996, "display_filter": "frame.number == 1996", "timestamp_epoch": "1555346969.751896000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-f09e82e7672fab01200e7f3f", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/klansfuuerifneiferunfasd/modules/client.rar", "source": "89.163.144.224", "destination": "10.0.90.175", "content_type": "application/rar", "response_count": 1, "declared_body_bytes": 581 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 196, "frame_number": 4880, "display_filter": "frame.number == 4880", "timestamp_epoch": "1555363185.829368000" }, { "tcp_stream": 196, "frame_number": 4882, "display_filter": "frame.number == 4882", "timestamp_epoch": "1555363185.975636000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-e7d3369607abfb80fbd97ee1", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/azor.rar", "source": "162.213.250.131", "destination": "10.0.90.175", "content_type": "application/x-rar-compressed", "response_count": 1, "declared_body_bytes": 425549 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 200, "frame_number": 4961, "display_filter": "frame.number == 4961", "timestamp_epoch": "1555363492.940707000" }, { "tcp_stream": 200, "frame_number": 5365, "display_filter": "frame.number == 5365", "timestamp_epoch": "1555363493.397007000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-5c11492821d7f5bcabbee048", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.0.90.175", "protocol": "drsuapi", "destination": "10.0.90.9", "event_count": 21, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 101, "frame_number": 2785, "display_filter": "frame.number == 2785", "timestamp_epoch": "1555352174.240226000" }, { "tcp_stream": 101, "frame_number": 2787, "display_filter": "frame.number == 2787", "timestamp_epoch": "1555352174.240856000" }, { "tcp_stream": 101, "frame_number": 2789, "display_filter": "frame.number == 2789", "timestamp_epoch": "1555352174.241671000" }, { "tcp_stream": 109, "frame_number": 2961, "display_filter": "frame.number == 2961", "timestamp_epoch": "1555352711.137299000" }, { "tcp_stream": 109, "frame_number": 2963, "display_filter": "frame.number == 2963", "timestamp_epoch": "1555352711.137853000" }, { "tcp_stream": 109, "frame_number": 2965, "display_filter": "frame.number == 2965", "timestamp_epoch": "1555352711.138380000" }, { "tcp_stream": 151, "frame_number": 3916, "display_filter": "frame.number == 3916", "timestamp_epoch": "1555357995.842934000" }, { "tcp_stream": 151, "frame_number": 3918, "display_filter": "frame.number == 3918", "timestamp_epoch": "1555357995.843467000" }, { "tcp_stream": 151, "frame_number": 3920, "display_filter": "frame.number == 3920", "timestamp_epoch": "1555357995.844029000" }, { "tcp_stream": 165, "frame_number": 4237, "display_filter": "frame.number == 4237", "timestamp_epoch": "1555359552.313790000" }, { "tcp_stream": 165, "frame_number": 4239, "display_filter": "frame.number == 4239", "timestamp_epoch": "1555359552.314366000" }, { "tcp_stream": 165, "frame_number": 4241, "display_filter": "frame.number == 4241", "timestamp_epoch": "1555359552.314876000" }, { "tcp_stream": 203, "frame_number": 9814, "display_filter": "frame.number == 9814", "timestamp_epoch": "1555363523.743975000" }, { "tcp_stream": 203, "frame_number": 9816, "display_filter": "frame.number == 9816", "timestamp_epoch": "1555363523.744507000" }, { "tcp_stream": 203, "frame_number": 9818, "display_filter": "frame.number == 9818", "timestamp_epoch": "1555363523.745028000" }, { "tcp_stream": 205, "frame_number": 9869, "display_filter": "frame.number == 9869", "timestamp_epoch": "1555363576.617425000" }, { "tcp_stream": 205, "frame_number": 9871, "display_filter": "frame.number == 9871", "timestamp_epoch": "1555363576.618004000" }, { "tcp_stream": 205, "frame_number": 9873, "display_filter": "frame.number == 9873", "timestamp_epoch": "1555363576.618734000" }, { "tcp_stream": 225, "frame_number": 10314, "display_filter": "frame.number == 10314", "timestamp_epoch": "1555365673.587250000" }, { "tcp_stream": 225, "frame_number": 10316, "display_filter": "frame.number == 10316", "timestamp_epoch": "1555365673.587797000" }, { "tcp_stream": 225, "frame_number": 10318, "display_filter": "frame.number == 10318", "timestamp_epoch": "1555365673.588379000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-0fc40c0a731979062f7941f7", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.0.90.175", "protocol": "ldap", "destination": "10.0.90.9", "event_count": 97, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 2, "frame_number": 37, "display_filter": "frame.number == 37", "timestamp_epoch": "1555346526.355510000" }, { "tcp_stream": 2, "frame_number": 72, "display_filter": "frame.number == 72", "timestamp_epoch": "1555346526.407400000" }, { "tcp_stream": 2, "frame_number": 75, "display_filter": "frame.number == 75", "timestamp_epoch": "1555346526.409137000" }, { "tcp_stream": 2, "frame_number": 77, "display_filter": "frame.number == 77", "timestamp_epoch": "1555346526.410098000" }, { "tcp_stream": 2, "frame_number": 149, "display_filter": "frame.number == 149", "timestamp_epoch": "1555346526.521254000" }, { "tcp_stream": 12, "frame_number": 160, "display_filter": "frame.number == 160", "timestamp_epoch": "1555346526.571565000" }, { "tcp_stream": 12, "frame_number": 177, "display_filter": "frame.number == 177", "timestamp_epoch": "1555346526.575676000" }, { "tcp_stream": 12, "frame_number": 180, "display_filter": "frame.number == 180", "timestamp_epoch": "1555346526.581695000" }, { "tcp_stream": 2, "frame_number": 189, "display_filter": "frame.number == 189", "timestamp_epoch": "1555346526.619769000" }, { "tcp_stream": 2, "frame_number": 198, "display_filter": "frame.number == 198", "timestamp_epoch": "1555346526.621537000" }, { "tcp_stream": 2, "frame_number": 206, "display_filter": "frame.number == 206", "timestamp_epoch": "1555346526.623950000" }, { "tcp_stream": 2, "frame_number": 209, "display_filter": "frame.number == 209", "timestamp_epoch": "1555346526.624525000" }, { "tcp_stream": 2, "frame_number": 211, "display_filter": "frame.number == 211", "timestamp_epoch": "1555346526.624977000" }, { "tcp_stream": 20, "frame_number": 281, "display_filter": "frame.number == 281", "timestamp_epoch": "1555346530.104678000" }, { "tcp_stream": 20, "frame_number": 286, "display_filter": "frame.number == 286", "timestamp_epoch": "1555346530.105981000" }, { "tcp_stream": 20, "frame_number": 301, "display_filter": "frame.number == 301", "timestamp_epoch": "1555346530.117181000" }, { "tcp_stream": 23, "frame_number": 326, "display_filter": "frame.number == 326", "timestamp_epoch": "1555346530.121497000" }, { "tcp_stream": 23, "frame_number": 333, "display_filter": "frame.number == 333", "timestamp_epoch": "1555346530.122490000" }, { "tcp_stream": 23, "frame_number": 335, "display_filter": "frame.number == 335", "timestamp_epoch": "1555346530.122821000" }, { "tcp_stream": 20, "frame_number": 337, "display_filter": "frame.number == 337", "timestamp_epoch": "1555346530.123241000" }, { "tcp_stream": 23, "frame_number": 385, "display_filter": "frame.number == 385", "timestamp_epoch": "1555346530.133804000" }, { "tcp_stream": 20, "frame_number": 391, "display_filter": "frame.number == 391", "timestamp_epoch": "1555346531.111987000" }, { "tcp_stream": 36, "frame_number": 523, "display_filter": "frame.number == 523", "timestamp_epoch": "1555346533.413413000" }, { "tcp_stream": 36, "frame_number": 526, "display_filter": "frame.number == 526", "timestamp_epoch": "1555346533.415820000" }, { "tcp_stream": 38, "frame_number": 532, "display_filter": "frame.number == 532", "timestamp_epoch": "1555346533.419178000" }, { "tcp_stream": 38, "frame_number": 535, "display_filter": "frame.number == 535", "timestamp_epoch": "1555346533.420065000" }, { "tcp_stream": 38, "frame_number": 537, "display_filter": "frame.number == 537", "timestamp_epoch": "1555346533.420450000" }, { "tcp_stream": 36, "frame_number": 539, "display_filter": "frame.number == 539", "timestamp_epoch": "1555346533.421225000" }, { "tcp_stream": 38, "frame_number": 557, "display_filter": "frame.number == 557", "timestamp_epoch": "1555346533.428925000" }, { "tcp_stream": 36, "frame_number": 561, "display_filter": "frame.number == 561", "timestamp_epoch": "1555346534.009929000" }, { "tcp_stream": 40, "frame_number": 578, "display_filter": "frame.number == 578", "timestamp_epoch": "1555346537.139734000" }, { "tcp_stream": 40, "frame_number": 583, "display_filter": "frame.number == 583", "timestamp_epoch": "1555346537.141592000" }, { "tcp_stream": 40, "frame_number": 586, "display_filter": "frame.number == 586", "timestamp_epoch": "1555346537.143482000" }, { "tcp_stream": 40, "frame_number": 588, "display_filter": "frame.number == 588", "timestamp_epoch": "1555346537.143771000" }, { "tcp_stream": 40, "frame_number": 590, "display_filter": "frame.number == 590", "timestamp_epoch": "1555346537.144072000" }, { "tcp_stream": 40, "frame_number": 592, "display_filter": "frame.number == 592", "timestamp_epoch": "1555346537.144417000" }, { "tcp_stream": 41, "frame_number": 598, "display_filter": "frame.number == 598", "timestamp_epoch": "1555346537.153441000" }, { "tcp_stream": 41, "frame_number": 601, "display_filter": "frame.number == 601", "timestamp_epoch": "1555346537.154414000" }, { "tcp_stream": 41, "frame_number": 633, "display_filter": "frame.number == 633", "timestamp_epoch": "1555346537.180058000" }, { "tcp_stream": 41, "frame_number": 635, "display_filter": "frame.number == 635", "timestamp_epoch": "1555346537.181214000" }, { "tcp_stream": 40, "frame_number": 637, "display_filter": "frame.number == 637", "timestamp_epoch": "1555346537.181717000" }, { "tcp_stream": 102, "frame_number": 2801, "display_filter": "frame.number == 2801", "timestamp_epoch": "1555352174.651882000" }, { "tcp_stream": 102, "frame_number": 2806, "display_filter": "frame.number == 2806", "timestamp_epoch": "1555352174.653540000" }, { "tcp_stream": 102, "frame_number": 2809, "display_filter": "frame.number == 2809", "timestamp_epoch": "1555352174.656919000" }, { "tcp_stream": 103, "frame_number": 2817, "display_filter": "frame.number == 2817", "timestamp_epoch": "1555352174.769122000" }, { "tcp_stream": 103, "frame_number": 2820, "display_filter": "frame.number == 2820", "timestamp_epoch": "1555352174.770616000" }, { "tcp_stream": 103, "frame_number": 2822, "display_filter": "frame.number == 2822", "timestamp_epoch": "1555352174.771256000" }, { "tcp_stream": 102, "frame_number": 2824, "display_filter": "frame.number == 2824", "timestamp_epoch": "1555352174.771948000" }, { "tcp_stream": 103, "frame_number": 2850, "display_filter": "frame.number == 2850", "timestamp_epoch": "1555352174.783711000" }, { "tcp_stream": 102, "frame_number": 2854, "display_filter": "frame.number == 2854", "timestamp_epoch": "1555352175.299598000" }, { "tcp_stream": 110, "frame_number": 2973, "display_filter": "frame.number == 2973", "timestamp_epoch": "1555352711.647662000" }, { "tcp_stream": 110, "frame_number": 2978, "display_filter": "frame.number == 2978", "timestamp_epoch": "1555352711.756971000" }, { "tcp_stream": 111, "frame_number": 2984, "display_filter": "frame.number == 2984", "timestamp_epoch": "1555352711.762320000" }, { "tcp_stream": 111, "frame_number": 2987, "display_filter": "frame.number == 2987", "timestamp_epoch": "1555352711.763622000" }, { "tcp_stream": 111, "frame_number": 2989, "display_filter": "frame.number == 2989", "timestamp_epoch": "1555352711.763988000" }, { "tcp_stream": 110, "frame_number": 2991, "display_filter": "frame.number == 2991", "timestamp_epoch": "1555352711.764407000" }, { "tcp_stream": 111, "frame_number": 3033, "display_filter": "frame.number == 3033", "timestamp_epoch": "1555352711.775193000" }, { "tcp_stream": 110, "frame_number": 3037, "display_filter": "frame.number == 3037", "timestamp_epoch": "1555352712.283621000" }, { "tcp_stream": 125, "frame_number": 3297, "display_filter": "frame.number == 3297", "timestamp_epoch": "1555354242.378414000" }, { "tcp_stream": 125, "frame_number": 3302, "display_filter": "frame.number == 3302", "timestamp_epoch": "1555354242.379984000" }, { "tcp_stream": 125, "frame_number": 3305, "display_filter": "frame.number == 3305", "timestamp_epoch": "1555354242.381061000" }, { "tcp_stream": 152, "frame_number": 3929, "display_filter": "frame.number == 3929", "timestamp_epoch": "1555357995.954885000" }, { "tcp_stream": 152, "frame_number": 3934, "display_filter": "frame.number == 3934", "timestamp_epoch": "1555357995.956532000" }, { "tcp_stream": 152, "frame_number": 3937, "display_filter": "frame.number == 3937", "timestamp_epoch": "1555357995.959923000" }, { "tcp_stream": 153, "frame_number": 3947, "display_filter": "frame.number == 3947", "timestamp_epoch": "1555357996.074107000" }, { "tcp_stream": 153, "frame_number": 3950, "display_filter": "frame.number == 3950", "timestamp_epoch": "1555357996.075478000" }, { "tcp_stream": 153, "frame_number": 3952, "display_filter": "frame.number == 3952", "timestamp_epoch": "1555357996.076097000" }, { "tcp_stream": 152, "frame_number": 3954, "display_filter": "frame.number == 3954", "timestamp_epoch": "1555357996.076653000" }, { "tcp_stream": 153, "frame_number": 3980, "display_filter": "frame.number == 3980", "timestamp_epoch": "1555357996.091248000" }, { "tcp_stream": 152, "frame_number": 3984, "display_filter": "frame.number == 3984", "timestamp_epoch": "1555357996.606694000" }, { "tcp_stream": 166, "frame_number": 4252, "display_filter": "frame.number == 4252", "timestamp_epoch": "1555359552.822160000" }, { "tcp_stream": 166, "frame_number": 4257, "display_filter": "frame.number == 4257", "timestamp_epoch": "1555359552.823805000" }, { "tcp_stream": 166, "frame_number": 4262, "display_filter": "frame.number == 4262", "timestamp_epoch": "1555359552.928989000" }, { "tcp_stream": 167, "frame_number": 4268, "display_filter": "frame.number == 4268", "timestamp_epoch": "1555359552.934589000" }, { "tcp_stream": 167, "frame_number": 4271, "display_filter": "frame.number == 4271", "timestamp_epoch": "1555359552.935761000" }, { "tcp_stream": 167, "frame_number": 4273, "display_filter": "frame.number == 4273", "timestamp_epoch": "1555359552.936117000" }, { "tcp_stream": 166, "frame_number": 4275, "display_filter": "frame.number == 4275", "timestamp_epoch": "1555359552.936499000" }, { "tcp_stream": 167, "frame_number": 4323, "display_filter": "frame.number == 4323", "timestamp_epoch": "1555359552.949832000" }, { "tcp_stream": 166, "frame_number": 4327, "display_filter": "frame.number == 4327", "timestamp_epoch": "1555359553.456526000" }, { "tcp_stream": 207, "frame_number": 9894, "display_filter": "frame.number == 9894", "timestamp_epoch": "1555363577.236967000" }, { "tcp_stream": 207, "frame_number": 9899, "display_filter": "frame.number == 9899", "timestamp_epoch": "1555363577.238374000" }, { "tcp_stream": 207, "frame_number": 9902, "display_filter": "frame.number == 9902", "timestamp_epoch": "1555363577.241265000" }, { "tcp_stream": 208, "frame_number": 9910, "display_filter": "frame.number == 9910", "timestamp_epoch": "1555363577.344925000" }, { "tcp_stream": 208, "frame_number": 9913, "display_filter": "frame.number == 9913", "timestamp_epoch": "1555363577.346351000" }, { "tcp_stream": 208, "frame_number": 9915, "display_filter": "frame.number == 9915", "timestamp_epoch": "1555363577.346865000" }, { "tcp_stream": 207, "frame_number": 9917, "display_filter": "frame.number == 9917", "timestamp_epoch": "1555363577.347438000" }, { "tcp_stream": 208, "frame_number": 9943, "display_filter": "frame.number == 9943", "timestamp_epoch": "1555363577.360279000" }, { "tcp_stream": 207, "frame_number": 9947, "display_filter": "frame.number == 9947", "timestamp_epoch": "1555363577.876478000" }, { "tcp_stream": 226, "frame_number": 10329, "display_filter": "frame.number == 10329", "timestamp_epoch": "1555365673.991139000" }, { "tcp_stream": 226, "frame_number": 10334, "display_filter": "frame.number == 10334", "timestamp_epoch": "1555365673.992812000" }, { "tcp_stream": 226, "frame_number": 10337, "display_filter": "frame.number == 10337", "timestamp_epoch": "1555365674.001563000" }, { "tcp_stream": 229, "frame_number": 10367, "display_filter": "frame.number == 10367", "timestamp_epoch": "1555365674.112248000" }, { "tcp_stream": 229, "frame_number": 10370, "display_filter": "frame.number == 10370", "timestamp_epoch": "1555365674.113849000" }, { "tcp_stream": 229, "frame_number": 10372, "display_filter": "frame.number == 10372", "timestamp_epoch": "1555365674.114648000" }, { "tcp_stream": 226, "frame_number": 10374, "display_filter": "frame.number == 10374", "timestamp_epoch": "1555365674.115295000" }, { "tcp_stream": 229, "frame_number": 10400, "display_filter": "frame.number == 10400", "timestamp_epoch": "1555365674.129404000" }, { "tcp_stream": 226, "frame_number": 10404, "display_filter": "frame.number == 10404", "timestamp_epoch": "1555365674.642222000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-7ba6eb505dafd105305fa1c3", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.0.90.9", "protocol": "drsuapi", "destination": "10.0.90.175", "event_count": 21, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 101, "frame_number": 2786, "display_filter": "frame.number == 2786", "timestamp_epoch": "1555352174.240511000" }, { "tcp_stream": 101, "frame_number": 2788, "display_filter": "frame.number == 2788", "timestamp_epoch": "1555352174.241405000" }, { "tcp_stream": 101, "frame_number": 2790, "display_filter": "frame.number == 2790", "timestamp_epoch": "1555352174.241847000" }, { "tcp_stream": 109, "frame_number": 2962, "display_filter": "frame.number == 2962", "timestamp_epoch": "1555352711.137533000" }, { "tcp_stream": 109, "frame_number": 2964, "display_filter": "frame.number == 2964", "timestamp_epoch": "1555352711.138143000" }, { "tcp_stream": 109, "frame_number": 2966, "display_filter": "frame.number == 2966", "timestamp_epoch": "1555352711.138560000" }, { "tcp_stream": 151, "frame_number": 3917, "display_filter": "frame.number == 3917", "timestamp_epoch": "1555357995.843182000" }, { "tcp_stream": 151, "frame_number": 3919, "display_filter": "frame.number == 3919", "timestamp_epoch": "1555357995.843815000" }, { "tcp_stream": 151, "frame_number": 3921, "display_filter": "frame.number == 3921", "timestamp_epoch": "1555357995.844187000" }, { "tcp_stream": 165, "frame_number": 4238, "display_filter": "frame.number == 4238", "timestamp_epoch": "1555359552.314064000" }, { "tcp_stream": 165, "frame_number": 4240, "display_filter": "frame.number == 4240", "timestamp_epoch": "1555359552.314659000" }, { "tcp_stream": 165, "frame_number": 4242, "display_filter": "frame.number == 4242", "timestamp_epoch": "1555359552.315032000" }, { "tcp_stream": 203, "frame_number": 9815, "display_filter": "frame.number == 9815", "timestamp_epoch": "1555363523.744208000" }, { "tcp_stream": 203, "frame_number": 9817, "display_filter": "frame.number == 9817", "timestamp_epoch": "1555363523.744833000" }, { "tcp_stream": 203, "frame_number": 9819, "display_filter": "frame.number == 9819", "timestamp_epoch": "1555363523.745165000" }, { "tcp_stream": 205, "frame_number": 9870, "display_filter": "frame.number == 9870", "timestamp_epoch": "1555363576.617691000" }, { "tcp_stream": 205, "frame_number": 9872, "display_filter": "frame.number == 9872", "timestamp_epoch": "1555363576.618409000" }, { "tcp_stream": 205, "frame_number": 9874, "display_filter": "frame.number == 9874", "timestamp_epoch": "1555363576.618909000" }, { "tcp_stream": 225, "frame_number": 10315, "display_filter": "frame.number == 10315", "timestamp_epoch": "1555365673.587522000" }, { "tcp_stream": 225, "frame_number": 10317, "display_filter": "frame.number == 10317", "timestamp_epoch": "1555365673.588151000" }, { "tcp_stream": 225, "frame_number": 10319, "display_filter": "frame.number == 10319", "timestamp_epoch": "1555365673.588552000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-68c3e307936645252945d3b4", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.0.90.9", "protocol": "ldap", "destination": "10.0.90.175", "event_count": 76, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 2, "frame_number": 39, "display_filter": "frame.number == 39", "timestamp_epoch": "1555346526.355733000" }, { "tcp_stream": 2, "frame_number": 74, "display_filter": "frame.number == 74", "timestamp_epoch": "1555346526.407973000" }, { "tcp_stream": 2, "frame_number": 76, "display_filter": "frame.number == 76", "timestamp_epoch": "1555346526.409311000" }, { "tcp_stream": 2, "frame_number": 78, "display_filter": "frame.number == 78", "timestamp_epoch": "1555346526.410381000" }, { "tcp_stream": 2, "frame_number": 151, "display_filter": "frame.number == 151", "timestamp_epoch": "1555346526.521591000" }, { "tcp_stream": 12, "frame_number": 162, "display_filter": "frame.number == 162", "timestamp_epoch": "1555346526.571859000" }, { "tcp_stream": 12, "frame_number": 179, "display_filter": "frame.number == 179", "timestamp_epoch": "1555346526.576222000" }, { "tcp_stream": 2, "frame_number": 192, "display_filter": "frame.number == 192", "timestamp_epoch": "1555346526.620277000" }, { "tcp_stream": 2, "frame_number": 200, "display_filter": "frame.number == 200", "timestamp_epoch": "1555346526.621880000" }, { "tcp_stream": 2, "frame_number": 208, "display_filter": "frame.number == 208", "timestamp_epoch": "1555346526.624241000" }, { "tcp_stream": 2, "frame_number": 210, "display_filter": "frame.number == 210", "timestamp_epoch": "1555346526.624748000" }, { "tcp_stream": 20, "frame_number": 283, "display_filter": "frame.number == 283", "timestamp_epoch": "1555346530.104951000" }, { "tcp_stream": 20, "frame_number": 288, "display_filter": "frame.number == 288", "timestamp_epoch": "1555346530.106666000" }, { "tcp_stream": 20, "frame_number": 302, "display_filter": "frame.number == 302", "timestamp_epoch": "1555346530.117479000" }, { "tcp_stream": 23, "frame_number": 330, "display_filter": "frame.number == 330", "timestamp_epoch": "1555346530.122121000" }, { "tcp_stream": 23, "frame_number": 334, "display_filter": "frame.number == 334", "timestamp_epoch": "1555346530.122618000" }, { "tcp_stream": 23, "frame_number": 336, "display_filter": "frame.number == 336", "timestamp_epoch": "1555346530.123005000" }, { "tcp_stream": 20, "frame_number": 338, "display_filter": "frame.number == 338", "timestamp_epoch": "1555346530.123700000" }, { "tcp_stream": 36, "frame_number": 525, "display_filter": "frame.number == 525", "timestamp_epoch": "1555346533.413982000" }, { "tcp_stream": 36, "frame_number": 527, "display_filter": "frame.number == 527", "timestamp_epoch": "1555346533.416081000" }, { "tcp_stream": 38, "frame_number": 534, "display_filter": "frame.number == 534", "timestamp_epoch": "1555346533.419686000" }, { "tcp_stream": 38, "frame_number": 536, "display_filter": "frame.number == 536", "timestamp_epoch": "1555346533.420235000" }, { "tcp_stream": 38, "frame_number": 538, "display_filter": "frame.number == 538", "timestamp_epoch": "1555346533.420803000" }, { "tcp_stream": 36, "frame_number": 540, "display_filter": "frame.number == 540", "timestamp_epoch": "1555346533.421925000" }, { "tcp_stream": 40, "frame_number": 580, "display_filter": "frame.number == 580", "timestamp_epoch": "1555346537.140014000" }, { "tcp_stream": 40, "frame_number": 585, "display_filter": "frame.number == 585", "timestamp_epoch": "1555346537.142162000" }, { "tcp_stream": 40, "frame_number": 587, "display_filter": "frame.number == 587", "timestamp_epoch": "1555346537.143632000" }, { "tcp_stream": 40, "frame_number": 589, "display_filter": "frame.number == 589", "timestamp_epoch": "1555346537.143914000" }, { "tcp_stream": 40, "frame_number": 591, "display_filter": "frame.number == 591", "timestamp_epoch": "1555346537.144257000" }, { "tcp_stream": 40, "frame_number": 593, "display_filter": "frame.number == 593", "timestamp_epoch": "1555346537.145300000" }, { "tcp_stream": 41, "frame_number": 600, "display_filter": "frame.number == 600", "timestamp_epoch": "1555346537.153977000" }, { "tcp_stream": 41, "frame_number": 602, "display_filter": "frame.number == 602", "timestamp_epoch": "1555346537.154581000" }, { "tcp_stream": 41, "frame_number": 634, "display_filter": "frame.number == 634", "timestamp_epoch": "1555346537.180842000" }, { "tcp_stream": 102, "frame_number": 2803, "display_filter": "frame.number == 2803", "timestamp_epoch": "1555352174.652149000" }, { "tcp_stream": 102, "frame_number": 2808, "display_filter": "frame.number == 2808", "timestamp_epoch": "1555352174.654166000" }, { "tcp_stream": 102, "frame_number": 2810, "display_filter": "frame.number == 2810", "timestamp_epoch": "1555352174.657199000" }, { "tcp_stream": 103, "frame_number": 2819, "display_filter": "frame.number == 2819", "timestamp_epoch": "1555352174.769919000" }, { "tcp_stream": 103, "frame_number": 2821, "display_filter": "frame.number == 2821", "timestamp_epoch": "1555352174.770834000" }, { "tcp_stream": 103, "frame_number": 2823, "display_filter": "frame.number == 2823", "timestamp_epoch": "1555352174.771536000" }, { "tcp_stream": 102, "frame_number": 2825, "display_filter": "frame.number == 2825", "timestamp_epoch": "1555352174.772305000" }, { "tcp_stream": 110, "frame_number": 2975, "display_filter": "frame.number == 2975", "timestamp_epoch": "1555352711.648467000" }, { "tcp_stream": 110, "frame_number": 2979, "display_filter": "frame.number == 2979", "timestamp_epoch": "1555352711.757388000" }, { "tcp_stream": 111, "frame_number": 2986, "display_filter": "frame.number == 2986", "timestamp_epoch": "1555352711.762961000" }, { "tcp_stream": 111, "frame_number": 2988, "display_filter": "frame.number == 2988", "timestamp_epoch": "1555352711.763790000" }, { "tcp_stream": 111, "frame_number": 2990, "display_filter": "frame.number == 2990", "timestamp_epoch": "1555352711.764190000" }, { "tcp_stream": 110, "frame_number": 2992, "display_filter": "frame.number == 2992", "timestamp_epoch": "1555352711.764994000" }, { "tcp_stream": 125, "frame_number": 3299, "display_filter": "frame.number == 3299", "timestamp_epoch": "1555354242.378668000" }, { "tcp_stream": 125, "frame_number": 3304, "display_filter": "frame.number == 3304", "timestamp_epoch": "1555354242.380589000" }, { "tcp_stream": 152, "frame_number": 3931, "display_filter": "frame.number == 3931", "timestamp_epoch": "1555357995.955152000" }, { "tcp_stream": 152, "frame_number": 3936, "display_filter": "frame.number == 3936", "timestamp_epoch": "1555357995.957216000" }, { "tcp_stream": 152, "frame_number": 3938, "display_filter": "frame.number == 3938", "timestamp_epoch": "1555357995.960232000" }, { "tcp_stream": 153, "frame_number": 3949, "display_filter": "frame.number == 3949", "timestamp_epoch": "1555357996.074921000" }, { "tcp_stream": 153, "frame_number": 3951, "display_filter": "frame.number == 3951", "timestamp_epoch": "1555357996.075674000" }, { "tcp_stream": 153, "frame_number": 3953, "display_filter": "frame.number == 3953", "timestamp_epoch": "1555357996.076344000" }, { "tcp_stream": 152, "frame_number": 3955, "display_filter": "frame.number == 3955", "timestamp_epoch": "1555357996.077000000" }, { "tcp_stream": 166, "frame_number": 4254, "display_filter": "frame.number == 4254", "timestamp_epoch": "1555359552.822411000" }, { "tcp_stream": 166, "frame_number": 4259, "display_filter": "frame.number == 4259", "timestamp_epoch": "1555359552.824511000" }, { "tcp_stream": 166, "frame_number": 4263, "display_filter": "frame.number == 4263", "timestamp_epoch": "1555359552.929569000" }, { "tcp_stream": 167, "frame_number": 4270, "display_filter": "frame.number == 4270", "timestamp_epoch": "1555359552.935285000" }, { "tcp_stream": 167, "frame_number": 4272, "display_filter": "frame.number == 4272", "timestamp_epoch": "1555359552.935919000" }, { "tcp_stream": 167, "frame_number": 4274, "display_filter": "frame.number == 4274", "timestamp_epoch": "1555359552.936310000" }, { "tcp_stream": 166, "frame_number": 4276, "display_filter": "frame.number == 4276", "timestamp_epoch": "1555359552.936747000" }, { "tcp_stream": 207, "frame_number": 9896, "display_filter": "frame.number == 9896", "timestamp_epoch": "1555363577.237159000" }, { "tcp_stream": 207, "frame_number": 9901, "display_filter": "frame.number == 9901", "timestamp_epoch": "1555363577.239010000" }, { "tcp_stream": 207, "frame_number": 9903, "display_filter": "frame.number == 9903", "timestamp_epoch": "1555363577.241528000" }, { "tcp_stream": 208, "frame_number": 9912, "display_filter": "frame.number == 9912", "timestamp_epoch": "1555363577.345753000" }, { "tcp_stream": 208, "frame_number": 9914, "display_filter": "frame.number == 9914", "timestamp_epoch": "1555363577.346550000" }, { "tcp_stream": 208, "frame_number": 9916, "display_filter": "frame.number == 9916", "timestamp_epoch": "1555363577.347117000" }, { "tcp_stream": 207, "frame_number": 9918, "display_filter": "frame.number == 9918", "timestamp_epoch": "1555363577.347756000" }, { "tcp_stream": 226, "frame_number": 10331, "display_filter": "frame.number == 10331", "timestamp_epoch": "1555365673.991410000" }, { "tcp_stream": 226, "frame_number": 10336, "display_filter": "frame.number == 10336", "timestamp_epoch": "1555365673.993535000" }, { "tcp_stream": 226, "frame_number": 10338, "display_filter": "frame.number == 10338", "timestamp_epoch": "1555365674.001950000" }, { "tcp_stream": 229, "frame_number": 10369, "display_filter": "frame.number == 10369", "timestamp_epoch": "1555365674.113024000" }, { "tcp_stream": 229, "frame_number": 10371, "display_filter": "frame.number == 10371", "timestamp_epoch": "1555365674.114069000" }, { "tcp_stream": 229, "frame_number": 10373, "display_filter": "frame.number == 10373", "timestamp_epoch": "1555365674.114931000" }, { "tcp_stream": 226, "frame_number": 10375, "display_filter": "frame.number == 10375", "timestamp_epoch": "1555365674.115678000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-5fb502c2d3cc37243f528ff1", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "3abe239c43ad55054578884f6a796ba5", "sha1": "890292f25372e6e896a9f600685e7a61854e95bf", "type": "http-exported-object", "sha256": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "evidence": [ { "tcp_stream": 45, "frame_number": 997, "display_filter": "frame.number == 997", "timestamp_epoch": "1555346551.045091000" } ], "filename": "po2.php%3fl=cupk6.fgs", "filenames": [ "po2.php%3fl=cupk6.fgs" ], "transfers": [ { "url": "http://ljeffery54ae.top/skoex/po2.php?l=cupk6.fgs", "client_ip": "10.0.90.175", "server_ip": "91.240.87.19", "tcp_stream": 45, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 668, "response_frame": 997 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 328192, "artifact_id": "artifact-b57d8ac317ccada04eead7ea", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "3d5f9ae33c8af83ed784ac5834a3e420", "sha1": "47e1584216c5484011607e01a3aafa33dedaf4dd", "type": "http-exported-object", "sha256": "2c60e1e69aeca03fb562c0597bd404df118151e6782d7cfefcbcefb5a1505d21", "evidence": [ { "tcp_stream": 201, "frame_number": 9793, "display_filter": "frame.number == 9793", "timestamp_epoch": "1555363523.235252000" } ], "filename": "index(1).php", "filenames": [ "index(1).php" ], "transfers": [ { "url": "http://85.114.134.49/index.php", "client_ip": "10.0.90.175", "server_ip": "85.114.134.49", "tcp_stream": 201, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 5380, "response_frame": 9793 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 4473518, "artifact_id": "artifact-0dcb49b2834ec7815f6ca366", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b7a3e32bcf7e805220b86c4d7df9ccbd", "sha1": "73135a017a6e5a1db8e5d1a4b277b8c9437558e0", "type": "http-exported-object", "sha256": "aa2f524d89ce598b990d3c8cd74cdc31cfaa9a7c6a63596b0e5b394dc7ede10b", "evidence": [ { "tcp_stream": 200, "frame_number": 5365, "display_filter": "frame.number == 5365", "timestamp_epoch": "1555363493.397007000" } ], "filename": "azor.rar", "filenames": [ "azor.rar" ], "transfers": [ { "url": "http://162.213.250.131/azor.rar", "client_ip": "10.0.90.175", "server_ip": "162.213.250.131", "tcp_stream": 200, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 4961, "response_frame": 5365 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 425549, "artifact_id": "artifact-262bc1ef9a0e3a37744f93f6", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "822827d7e6c48a851becb04476e73569", "sha1": "962afbf6a2aab43ca4cbcebf9a24ab89b4676d61", "type": "http-exported-object", "sha256": "6aed702963283420db151840cb48374f6c48b4f9dc933f7a6c9fdb1d77ce88e1", "evidence": [ { "tcp_stream": 49, "frame_number": 1666, "display_filter": "frame.number == 1666", "timestamp_epoch": "1555346592.486605000" } ], "filename": "c.avi", "filenames": [ "c.avi" ], "transfers": [ { "url": "http://ksoniay95ee.info/images/zqt4lIX7/WURokuO9vh89Yy_2BsUJrS9/PjffqPwJdE/ySWjXv6UbPaKFMooy/6X5boj6wckcc/Ucw3dM3Mi_2/FznVDXGp2L3Py2/JxFQvMX4xN_2FzOJs9Vmk/BMKiWvw71S3sGLtJ/XPIlWh5f6mD5BYu/asfVMoi7/c.avi", "client_ip": "10.0.90.175", "server_ip": "37.230.112.226", "tcp_stream": 49, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1329, "response_frame": 1666 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "video/x-msvideo", "size_bytes": 274540, "artifact_id": "artifact-aabf3bf544d44be880532f11", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0dba75ce98d0f926b510400a7cc7ddac", "sha1": "c33b76ddbad8193f77e7dff82764efed920cbe7c", "type": "http-exported-object", "sha256": "637ccbba391788d61f87d86caf06bdd4c6c03c43aa9386c42bdf2543a072619c", "evidence": [ { "tcp_stream": 46, "frame_number": 1311, "display_filter": "frame.number == 1311", "timestamp_epoch": "1555346589.902272000" } ], "filename": "_2FJr.avi", "filenames": [ "_2FJr.avi" ], "transfers": [ { "url": "http://ksoniay95ee.info/images/CI9BVzd6AqB/ZNUmRFBAKmX4q_/2FIAs9nQJlVF7_2BTvRU5/ZPqTgOgLDp8JzrCL/_2Fcm_2BF41yLbk/eclytPd8CmogXhag5f/iJKuzzkmf/M1zwJZUnnnK6LJcptL1S/m6Hl99BQ3fNUdtPt9So/0Zzs4gdqrhrs/_2FJr.avi", "client_ip": "10.0.90.175", "server_ip": "37.230.112.226", "tcp_stream": 46, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1032, "response_frame": 1311 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "video/x-msvideo", "size_bytes": 218556, "artifact_id": "artifact-685dbd40360a6841894ba0b0", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 218556, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 218556, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "04d79a0dc77a8f449cbff6252862d398", "sha1": "cf925fc512b936fe7d44ceb6e999e4a020ed6ff0", "type": "http-exported-object", "sha256": "4c9c4d831d61c8c38b2513f9b431ef4f4cf6af9fb18a2317cd2178d6e0997822", "evidence": [ { "tcp_stream": 57, "frame_number": 1906, "display_filter": "frame.number == 1906", "timestamp_epoch": "1555346659.617901000" } ], "filename": "authrootstl.cab", "filenames": [ "authrootstl.cab" ], "transfers": [ { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "client_ip": "10.0.90.175", "server_ip": "104.73.85.137", "tcp_stream": 57, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1848, "response_frame": 1906 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 56952, "artifact_id": "artifact-92884b6b3ce758caa4e10539", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 56952, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 56952, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0b3123b2497523a10d60e7eed8c1a88f", "sha1": "e09450ecfa1eac3ba598feb22cb04cfa938fde4a", "type": "http-exported-object", "sha256": "4017ffd0c17a9fbaebd74c6b75b6e8898d53ce401f16a64881bd0ee5837f6591", "evidence": [], "filename": "index(2).php", "filenames": [ "index(2).php" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 6962, "artifact_id": "artifact-1e58309b362d3f9287ddeeb5", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 6962, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f74755b4757448d71fdcb4650a701816", "sha1": "0bcbe73d6a198f6e5ebafa035b734a12809cefa6", "type": "http-exported-object", "sha256": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "evidence": [ { "tcp_stream": 46, "frame_number": 1320, "display_filter": "frame.number == 1320", "timestamp_epoch": "1555346590.143034000" } ], "filename": "favicon.ico", "filenames": [ "favicon.ico" ], "transfers": [ { "url": "http://ksoniay95ee.info/favicon.ico", "client_ip": "10.0.90.175", "server_ip": "37.230.112.226", "tcp_stream": 46, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1314, "response_frame": 1320 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/vnd.microsoft.icon", "size_bytes": 5430, "artifact_id": "artifact-255457f04f430089c02c535f", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5430, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5430, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f7b705c04efd3ed44edd51759b9b72b0", "sha1": "db25053f419c688b0b022501a93e546a9f1bd876", "type": "http-exported-object", "sha256": "91cba2f5400a35c849783d307e016002144c96c9ee817b7a375e225c57b1ff80", "evidence": [ { "tcp_stream": 46, "frame_number": 1674, "display_filter": "frame.number == 1674", "timestamp_epoch": "1555346593.510214000" } ], "filename": "hYP.avi", "filenames": [ "hYP.avi" ], "transfers": [ { "url": "http://ksoniay95ee.info/images/k1bBds2o/QmLUr43VFSfi6mVN0k_2Fri/aRq5qJ_2Bb/9pn_2FrlWUAEwA3DA/8_2BlKV4KDN_/2B_2BLZHLEa/vLvK_2F5G0A625/hGoDuTo8Bf7h2KRBD9vOP/gcTRbqx7bC5Q89C6/6YYly9yOp3zpx2r/BwphZTlcwHbBf1/hYP.avi", "client_ip": "10.0.90.175", "server_ip": "37.230.112.226", "tcp_stream": 46, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1669, "response_frame": 1674 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "video/x-msvideo", "size_bytes": 2396, "artifact_id": "artifact-162b81f0e52355a3332004d4", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2396, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2396, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "19bd86fcf50b4fa2be877dbd494cf5a8", "sha1": "103f8194dd1b0084455ae49abbe60e344b3582bb", "type": "http-exported-object", "sha256": "5f1ea837b7530af44e85e0198beab49e0f2cf9e60a75d76c044313985de822ff", "evidence": [ { "tcp_stream": 59, "frame_number": 1933, "display_filter": "frame.number == 1933", "timestamp_epoch": "1555346662.032496000" }, { "tcp_stream": 63, "frame_number": 1996, "display_filter": "frame.number == 1996", "timestamp_epoch": "1555346969.751896000" } ], "filename": "client(1).rar", "filenames": [ "client(1).rar", "client.rar" ], "transfers": [ { "url": "http://151.106.27.208/client.rar", "client_ip": "10.0.90.175", "server_ip": "151.106.27.208", "tcp_stream": 59, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1931, "response_frame": 1933 }, { "url": "http://151.106.27.208/client.rar", "client_ip": "10.0.90.175", "server_ip": "151.106.27.208", "tcp_stream": 63, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1994, "response_frame": 1996 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 591, "artifact_id": "artifact-ad12500cf1002149e7fc2912", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 591, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 591, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2bde371506e2548b06a95a3dbd6b2be1", "sha1": "3d00bdb8061856bdd99141427f22ab09e1f61bb6", "type": "http-exported-object", "sha256": "6d48f7ed8bafb7e147b7438a21362220adcc24e83a4f9942f6ccf9c09b3b4b02", "evidence": [ { "tcp_stream": 196, "frame_number": 4882, "display_filter": "frame.number == 4882", "timestamp_epoch": "1555363185.975636000" } ], "filename": "client(2).rar", "filenames": [ "client(2).rar" ], "transfers": [ { "url": "http://89.163.144.224/klansfuuerifneiferunfasd/modules/client.rar", "client_ip": "10.0.90.175", "server_ip": "89.163.144.224", "tcp_stream": 196, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 4880, "response_frame": 4882 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 581, "artifact_id": "artifact-14d0014df2af642d8bd597cf", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 581, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 581, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a23dae90dd11ca638414ceddc8565e20", "sha1": "a5cb8b1f01ba1a6e996a786308af1d19b233f0ce", "type": "http-exported-object", "sha256": "f07dbc57bb41792248061012e6479b00ba046d6631e1734bdbbd01bc421ecba4", "evidence": [], "filename": "index.php", "filenames": [ "index.php" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 107, "artifact_id": "artifact-7fb48b0023796a65e77cfe48", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 107, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cd5a4d3fdd5bffc16bf959ef75cf37bc", "sha1": "33bf88d5b82df3723d5863c7d23445e345828904", "type": "http-exported-object", "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [ { "tcp_stream": 28, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1555346531.961189000" } ], "filename": "ncsi.txt", "filenames": [ "ncsi.txt" ], "transfers": [ { "url": "http://www.msftncsi.com/ncsi.txt", "client_ip": "10.0.90.175", "server_ip": "23.218.156.11", "tcp_stream": 28, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 402, "response_frame": 404 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/plain", "size_bytes": 14, "artifact_id": "artifact-4de17e5808f44eabab7ddfdd", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e0aa021e21dddbd6d8cecec71e9cf564", "sha1": "9ce3bd4224c8c1780db56b4125ecf3f24bf748b7", "type": "http-exported-object", "sha256": "565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3", "evidence": [ { "tcp_stream": 201, "frame_number": 9834, "display_filter": "frame.number == 9834", "timestamp_epoch": "1555363524.526057000" } ], "filename": "index(3).php", "filenames": [ "index(3).php" ], "transfers": [ { "url": "http://85.114.134.49/index.php", "client_ip": "10.0.90.175", "server_ip": "85.114.134.49", "tcp_stream": 201, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 9830, "response_frame": 9834 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2, "artifact_id": "artifact-48d9070f8780d5d88d5bc036", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "10.0.90.175", "bytes_sent": 639043, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-b6ef5ac222a1f9f4340bd761", "packets_sent": 4475, "mac_addresses": [ "d0:67:e5:b1:53:fa" ], "bytes_received": 6517454, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1555368380.651385", "first_seen_epoch": "1555346526.210024", "packets_received": 6332 }, { "ip": "10.0.90.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-cbbc6dfb8453d816b62a31ba", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 4296, "evidence_frames": [ 1, 2, 215, 223, 224 ], "last_seen_epoch": "1555363520.680436", "first_seen_epoch": "1555346526.210024", "packets_received": 42 }, { "ip": "10.0.90.9", "bytes_sent": 226323, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-02f3a0de24b6310279c6acd0", "packets_sent": 1119, "mac_addresses": [ "a4:1f:72:c2:09:6a" ], "bytes_received": 349675, "evidence_frames": [ 3, 4, 5, 6, 7 ], "last_seen_epoch": "1555368318.799009", "first_seen_epoch": "1555346526.219136", "packets_received": 1313 }, { "ip": "104.73.85.137", "bytes_sent": 59736, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d42fcb495a881899a0be15a5", "packets_sent": 45, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1255, "evidence_frames": [ 1845, 1846, 1847, 1848, 1849 ], "last_seen_epoch": "1555346719.626317", "first_seen_epoch": "1555346659.534769", "packets_received": 19 }, { "ip": "109.230.199.24", "bytes_sent": 12314, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d275dab5b5bf5c94d6001b06", "packets_sent": 65, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 12102, "evidence_frames": [ 10047, 10048, 10049, 10050, 10051 ], "last_seen_epoch": "1555367890.639197", "first_seen_epoch": "1555364084.673959", "packets_received": 81 }, { "ip": "151.106.27.208", "bytes_sent": 2248, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fe66e1d050512a47ba3f25dd", "packets_sent": 10, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1022, "evidence_frames": [ 1928, 1929, 1930, 1931, 1932 ], "last_seen_epoch": "1555347080.331221", "first_seen_epoch": "1555346661.765642", "packets_received": 12 }, { "ip": "162.213.250.131", "bytes_sent": 442015, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5988804343feadce497723cb", "packets_sent": 300, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 6288, "evidence_frames": [ 4958, 4959, 4960, 4961, 4962 ], "last_seen_epoch": "1555363580.585156", "first_seen_epoch": "1555363492.881919", "packets_received": 113 }, { "ip": "176.10.125.110", "bytes_sent": 6109, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e2a686277fd1cdbe29c8593a", "packets_sent": 32, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5660, "evidence_frames": [ 10233, 10234, 10235, 10236, 10237 ], "last_seen_epoch": "1555368380.651385", "first_seen_epoch": "1555365260.671183", "packets_received": 38 }, { "ip": "185.136.169.160", "bytes_sent": 113391, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f8c740072ffa687ec6c358f5", "packets_sent": 597, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 97549, "evidence_frames": [ 1976, 1977, 1978, 1979, 1980 ], "last_seen_epoch": "1555359380.53123", "first_seen_epoch": "1555346960.346447", "packets_received": 714 }, { "ip": "185.139.69.88", "bytes_sent": 5596, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-63f2c45afa344d2a17867009", "packets_sent": 27, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4637, "evidence_frames": [ 1831, 1832, 1833, 1834, 1835 ], "last_seen_epoch": "1555346778.591322", "first_seen_epoch": "1555346658.887264", "packets_received": 32 }, { "ip": "185.158.249.39", "bytes_sent": 28871, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7c4c8e8bc53228ab52ceb2f4", "packets_sent": 99, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 16668, "evidence_frames": [ 4921, 4922, 4923, 4924, 4925 ], "last_seen_epoch": "1555367120.636496", "first_seen_epoch": "1555363460.62033", "packets_received": 113 }, { "ip": "185.212.47.167", "bytes_sent": 30960, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3f3d9aae7e235e48868cbdff", "packets_sent": 167, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 26706, "evidence_frames": [ 4388, 4389, 4390, 4391, 4392 ], "last_seen_epoch": "1555363304.638531", "first_seen_epoch": "1555359860.543153", "packets_received": 199 }, { "ip": "187.188.166.192", "bytes_sent": 54, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-bf48a30c03e89760d59ff1ee", "packets_sent": 1, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 0, "evidence_frames": [ 1958 ], "last_seen_epoch": "1555346710.250677", "first_seen_epoch": "1555346710.250677", "packets_received": 0 }, { "ip": "198.54.115.33", "bytes_sent": 11628, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-cd6be2a7ae533f05b52e8092", "packets_sent": 23, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2726, "evidence_frames": [ 10181, 10182, 10183, 10184, 10185 ], "last_seen_epoch": "1555368020.953206", "first_seen_epoch": "1555364999.002508", "packets_received": 21 }, { "ip": "198.54.125.57", "bytes_sent": 11628, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-04d300c15ddd9d27fb210f89", "packets_sent": 23, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2812, "evidence_frames": [ 10022, 10023, 10024, 10025, 10026 ], "last_seen_epoch": "1555367120.929142", "first_seen_epoch": "1555364060.598327", "packets_received": 22 }, { "ip": "208.67.222.222", "bytes_sent": 668, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-38f134801c33c33858607439", "packets_sent": 5, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 425, "evidence_frames": [ 1816, 1817, 1818, 1819, 1820 ], "last_seen_epoch": "1555346658.554522", "first_seen_epoch": "1555346658.362882", "packets_received": 5 }, { "ip": "208.91.197.91", "bytes_sent": 162, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8973ab52b5200d4e063b3e38", "packets_sent": 3, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 194, "evidence_frames": [ 4347, 4348, 4349, 4350, 4351 ], "last_seen_epoch": "1555359585.765389", "first_seen_epoch": "1555359584.631482", "packets_received": 3 }, { "ip": "216.98.148.157", "bytes_sent": 54, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d739c55b2e5819a620287bcf", "packets_sent": 1, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 0, "evidence_frames": [ 3271 ], "last_seen_epoch": "1555354236.347416", "first_seen_epoch": "1555354236.347416", "packets_received": 0 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-71e95b6f00080a3525252498", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 540, "evidence_frames": [ 11, 234, 235, 249, 3275 ], "last_seen_epoch": "1555354245.809058", "first_seen_epoch": "1555346526.27506", "packets_received": 10 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e0f80ec06eee592d6160fc70", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 822, "evidence_frames": [ 236, 241, 242, 243, 3279 ], "last_seen_epoch": "1555363518.948865", "first_seen_epoch": "1555346529.285859", "packets_received": 12 }, { "ip": "23.218.156.11", "bytes_sent": 399, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-396d0ea5a2447130720966aa", "packets_sent": 4, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 379, "evidence_frames": [ 399, 400, 401, 402, 403 ], "last_seen_epoch": "1555346531.961634", "first_seen_epoch": "1555346531.913475", "packets_received": 5 }, { "ip": "255.255.255.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-4c1842b09bae1875cfbd7235", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 1368, "evidence_frames": [ 237, 1828, 3325, 5372 ], "last_seen_epoch": "1555363518.816531", "first_seen_epoch": "1555346529.292738", "packets_received": 4 }, { "ip": "37.230.112.226", "bytes_sent": 523453, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3a45889e0bfa1e59c3c9ac54", "packets_sent": 383, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 15549, "evidence_frames": [ 1028, 1029, 1030, 1031, 1032 ], "last_seen_epoch": "1555346594.374807", "first_seen_epoch": "1555346588.433001", "packets_received": 257 }, { "ip": "68.65.122.52", "bytes_sent": 5841, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b84cb01aeddc6d86a89676a7", "packets_sent": 12, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1390, "evidence_frames": [ 10273, 10274, 10275, 10276, 10277 ], "last_seen_epoch": "1555365599.290758", "first_seen_epoch": "1555365599.012105", "packets_received": 11 }, { "ip": "72.21.81.200", "bytes_sent": 50839, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9187338414e7e0c8e476c427", "packets_sent": 48, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3061, "evidence_frames": [ 1682, 1683, 1684, 1685, 1686 ], "last_seen_epoch": "1555346620.079171", "first_seen_epoch": "1555346616.092131", "packets_received": 38 }, { "ip": "85.114.134.49", "bytes_sent": 4642083, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2376015b1cfbccf588ad77c1", "packets_sent": 3115, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 78466, "evidence_frames": [ 5374, 5378, 5379, 5380, 5381 ], "last_seen_epoch": "1555363524.563172", "first_seen_epoch": "1555363518.828676", "packets_received": 1316 }, { "ip": "89.163.144.224", "bytes_sent": 1146, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b53cf2ea862c0ef87af95e1d", "packets_sent": 5, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 544, "evidence_frames": [ 4877, 4878, 4879, 4880, 4881 ], "last_seen_epoch": "1555363304.637931", "first_seen_epoch": "1555363185.655082", "packets_received": 6 }, { "ip": "91.240.87.19", "bytes_sent": 341936, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-239042050f5893807d84d287", "packets_sent": 248, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4909, "evidence_frames": [ 665, 666, 667, 668, 669 ], "last_seen_epoch": "1555346551.047497", "first_seen_epoch": "1555346549.768835", "packets_received": 89 } ], "identities": [ { "type": "account", "value": "kim.jooyoung", "bindings": [ { "account": "", "owner_ip": "10.0.90.175", "frame_number": 411, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 419, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 421, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 433, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 447, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 473, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 485, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 517, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" } ], "evidence": [ { "tcp_stream": 29, "frame_number": 411, "display_filter": "frame.number == 411", "timestamp_epoch": "1555346532.838471000" }, { "tcp_stream": 30, "frame_number": 419, "display_filter": "frame.number == 419", "timestamp_epoch": "1555346532.858739000" }, { "tcp_stream": 30, "frame_number": 421, "display_filter": "frame.number == 421", "timestamp_epoch": "1555346532.859387000" }, { "tcp_stream": 31, "frame_number": 433, "display_filter": "frame.number == 433", "timestamp_epoch": "1555346532.861068000" }, { "tcp_stream": 32, "frame_number": 447, "display_filter": "frame.number == 447", "timestamp_epoch": "1555346532.900040000" }, { "tcp_stream": 34, "frame_number": 473, "display_filter": "frame.number == 473", "timestamp_epoch": "1555346532.932351000" }, { "tcp_stream": 35, "frame_number": 485, "display_filter": "frame.number == 485", "timestamp_epoch": "1555346532.933259000" }, { "tcp_stream": 37, "frame_number": 517, "display_filter": "frame.number == 517", "timestamp_epoch": "1555346533.412768000" } ], "raw_values": [ "kim.jooyoung" ], "identity_id": "identity-602a3fea09775e874d13bc78", "ip_addresses": [ "10.0.90.175" ], "mac_addresses": [ "d0:67:e5:b1:53:fa" ] }, { "type": "account", "value": "seoul-4a67-pc$", "bindings": [ { "account": "", "owner_ip": "10.0.90.175", "frame_number": 44, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 52, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 54, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 66, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 93, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 100, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 102, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 114, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 126, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 171, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 262, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 296, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 314, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 351, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 363, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 606, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 614, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 616, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 628, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 3000, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.175", "conversation_src": "10.0.90.9" } ], "evidence": [ { "tcp_stream": 3, "frame_number": 44, "display_filter": "frame.number == 44", "timestamp_epoch": "1555346526.365190000" }, { "tcp_stream": 4, "frame_number": 52, "display_filter": "frame.number == 52", "timestamp_epoch": "1555346526.395093000" }, { "tcp_stream": 4, "frame_number": 54, "display_filter": "frame.number == 54", "timestamp_epoch": "1555346526.395998000" }, { "tcp_stream": 5, "frame_number": 66, "display_filter": "frame.number == 66", "timestamp_epoch": "1555346526.406041000" }, { "tcp_stream": 7, "frame_number": 93, "display_filter": "frame.number == 93", "timestamp_epoch": "1555346526.441030000" }, { "tcp_stream": 8, "frame_number": 100, "display_filter": "frame.number == 100", "timestamp_epoch": "1555346526.459700000" }, { "tcp_stream": 8, "frame_number": 102, "display_filter": "frame.number == 102", "timestamp_epoch": "1555346526.460600000" }, { "tcp_stream": 9, "frame_number": 114, "display_filter": "frame.number == 114", "timestamp_epoch": "1555346526.463861000" }, { "tcp_stream": 10, "frame_number": 126, "display_filter": "frame.number == 126", "timestamp_epoch": "1555346526.465944000" }, { "tcp_stream": 13, "frame_number": 171, "display_filter": "frame.number == 171", "timestamp_epoch": "1555346526.574603000" }, { "tcp_stream": 19, "frame_number": 262, "display_filter": "frame.number == 262", "timestamp_epoch": "1555346529.921919000" }, { "tcp_stream": 21, "frame_number": 296, "display_filter": "frame.number == 296", "timestamp_epoch": "1555346530.114166000" }, { "tcp_stream": 22, "frame_number": 314, "display_filter": "frame.number == 314", "timestamp_epoch": "1555346530.120242000" }, { "tcp_stream": 26, "frame_number": 351, "display_filter": "frame.number == 351", "timestamp_epoch": "1555346530.128174000" }, { "tcp_stream": 27, "frame_number": 363, "display_filter": "frame.number == 363", "timestamp_epoch": "1555346530.129382000" }, { "tcp_stream": 42, "frame_number": 606, "display_filter": "frame.number == 606", "timestamp_epoch": "1555346537.155891000" }, { "tcp_stream": 43, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1555346537.172564000" }, { "tcp_stream": 43, "frame_number": 616, "display_filter": "frame.number == 616", "timestamp_epoch": "1555346537.174031000" }, { "tcp_stream": 44, "frame_number": 628, "display_filter": "frame.number == 628", "timestamp_epoch": "1555346537.177108000" }, { "tcp_stream": 112, "frame_number": 3000, "display_filter": "frame.number == 3000", "timestamp_epoch": "1555352711.766804000" } ], "raw_values": [ "SEOUL-4A67-PC$", "seoul-4a67-pc$" ], "identity_id": "identity-645d8553af32e25d77899347", "ip_addresses": [ "10.0.90.175" ], "mac_addresses": [ "d0:67:e5:b1:53:fa" ] }, { "type": "hostname", "value": "Seoul-4a67-PC", "bindings": [ { "account": "", "owner_ip": "0.0.0.0", "frame_number": 237, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 1828, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 3325, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 5372, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 1, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 215, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 223, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 227, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 229, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 230, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 231, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 233, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 3327, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 3329, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 3334, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 3336, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 3338, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 3340, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 3342, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": "10.0.90.175", "frame_number": 3344, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" } ], "evidence": [ { "udp_stream": 12, "frame_number": 237, "display_filter": "frame.number == 237", "timestamp_epoch": "1555346529.292738000" }, { "udp_stream": 12, "frame_number": 1828, "display_filter": "frame.number == 1828", "timestamp_epoch": "1555346658.626217000" }, { "udp_stream": 12, "frame_number": 3325, "display_filter": "frame.number == 3325", "timestamp_epoch": "1555354245.322579000" }, { "udp_stream": 12, "frame_number": 5372, "display_filter": "frame.number == 5372", "timestamp_epoch": "1555363518.816531000" }, { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1555346526.210024000" }, { "udp_stream": 0, "frame_number": 215, "display_filter": "frame.number == 215", "timestamp_epoch": "1555346526.718948000" }, { "udp_stream": 0, "frame_number": 223, "display_filter": "frame.number == 223", "timestamp_epoch": "1555346526.959105000" }, { "udp_stream": 0, "frame_number": 227, "display_filter": "frame.number == 227", "timestamp_epoch": "1555346527.469052000" }, { "udp_stream": 0, "frame_number": 229, "display_filter": "frame.number == 229", "timestamp_epoch": "1555346527.709536000" }, { "udp_stream": 0, "frame_number": 230, "display_filter": "frame.number == 230", "timestamp_epoch": "1555346528.219128000" }, { "udp_stream": 0, "frame_number": 231, "display_filter": "frame.number == 231", "timestamp_epoch": "1555346528.459037000" }, { "udp_stream": 0, "frame_number": 233, "display_filter": "frame.number == 233", "timestamp_epoch": "1555346528.980071000" }, { "udp_stream": 0, "frame_number": 3327, "display_filter": "frame.number == 3327", "timestamp_epoch": "1555354245.388296000" }, { "udp_stream": 0, "frame_number": 3329, "display_filter": "frame.number == 3329", "timestamp_epoch": "1555354245.389045000" }, { "udp_stream": 0, "frame_number": 3334, "display_filter": "frame.number == 3334", "timestamp_epoch": "1555354246.152451000" }, { "udp_stream": 0, "frame_number": 3336, "display_filter": "frame.number == 3336", "timestamp_epoch": "1555354246.152686000" }, { "udp_stream": 0, "frame_number": 3338, "display_filter": "frame.number == 3338", "timestamp_epoch": "1555354246.916751000" }, { "udp_stream": 0, "frame_number": 3340, "display_filter": "frame.number == 3340", "timestamp_epoch": "1555354246.917020000" }, { "udp_stream": 0, "frame_number": 3342, "display_filter": "frame.number == 3342", "timestamp_epoch": "1555354247.681153000" }, { "udp_stream": 0, "frame_number": 3344, "display_filter": "frame.number == 3344", "timestamp_epoch": "1555354247.681635000" } ], "raw_values": [ "SEOUL-4A67-PC<00>,SEOUL-4A67-PC<00> (Workstation/Redirector)", "SEOUL-4A67-PC<20>,SEOUL-4A67-PC<20> (Server service)", "Seoul-4a67-PC" ], "identity_id": "identity-64fecadbe74a50dd8a4a928d", "ip_addresses": [ "10.0.90.175" ], "mac_addresses": [ "d0:67:e5:b1:53:fa", "d0:67:e5:b1:53:fa,d0:67:e5:b1:53:fa" ] }, { "type": "netbios-group", "value": "STINGRAYAHOY", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 2, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": null, "frame_number": 224, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": null, "frame_number": 228, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": null, "frame_number": 232, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": null, "frame_number": 3328, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": null, "frame_number": 3335, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": null, "frame_number": 3339, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" }, { "account": "", "owner_ip": null, "frame_number": 3343, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.175" } ], "evidence": [ { "udp_stream": 0, "frame_number": 2, "display_filter": "frame.number == 2", "timestamp_epoch": "1555346526.210760000" }, { "udp_stream": 0, "frame_number": 224, "display_filter": "frame.number == 224", "timestamp_epoch": "1555346526.959207000" }, { "udp_stream": 0, "frame_number": 228, "display_filter": "frame.number == 228", "timestamp_epoch": "1555346527.709372000" }, { "udp_stream": 0, "frame_number": 232, "display_filter": "frame.number == 232", "timestamp_epoch": "1555346528.459179000" }, { "udp_stream": 0, "frame_number": 3328, "display_filter": "frame.number == 3328", "timestamp_epoch": "1555354245.388638000" }, { "udp_stream": 0, "frame_number": 3335, "display_filter": "frame.number == 3335", "timestamp_epoch": "1555354246.152589000" }, { "udp_stream": 0, "frame_number": 3339, "display_filter": "frame.number == 3339", "timestamp_epoch": "1555354246.916930000" }, { "udp_stream": 0, "frame_number": 3343, "display_filter": "frame.number == 3343", "timestamp_epoch": "1555354247.681379000" } ], "raw_values": [ "STINGRAYAHOY<00>,STINGRAYAHOY<00> (Workstation/Redirector)" ], "identity_id": "identity-e8a6688c3c63b864cda49203", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query" ], "value": "222.222.67.208.in-addr.arpa", "evidence": [ { "udp_stream": 37, "frame_number": 1816, "display_filter": "frame.number == 1816", "timestamp_epoch": "1555346658.362882000" }, { "udp_stream": 37, "frame_number": 1817, "display_filter": "frame.number == 1817", "timestamp_epoch": "1555346658.385660000" } ], "is_private": null, "observable_id": "observable-051a7eb6272ddea225133ffd", "last_seen_epoch": "1555346658.385660000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346658.362882000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "adsfinder.xyz", "evidence": [ { "udp_stream": 81, "frame_number": 4919, "display_filter": "frame.number == 4919", "timestamp_epoch": "1555363460.580569000" }, { "udp_stream": 81, "frame_number": 4920, "display_filter": "frame.number == 4920", "timestamp_epoch": "1555363460.619298000" }, { "udp_stream": 97, "frame_number": 10429, "display_filter": "frame.number == 10429", "timestamp_epoch": "1555365860.610855000" }, { "udp_stream": 97, "frame_number": 10430, "display_filter": "frame.number == 10430", "timestamp_epoch": "1555365860.644759000" }, { "tcp_stream": 198, "frame_number": 4924, "display_filter": "frame.number == 4924", "timestamp_epoch": "1555363460.745329000" }, { "tcp_stream": 199, "frame_number": 4946, "display_filter": "frame.number == 4946", "timestamp_epoch": "1555363484.760068000" }, { "tcp_stream": 210, "frame_number": 9987, "display_filter": "frame.number == 9987", "timestamp_epoch": "1555363784.777427000" }, { "tcp_stream": 211, "frame_number": 10002, "display_filter": "frame.number == 10002", "timestamp_epoch": "1555363830.695237000" }, { "tcp_stream": 231, "frame_number": 10434, "display_filter": "frame.number == 10434", "timestamp_epoch": "1555365860.792339000" }, { "tcp_stream": 232, "frame_number": 10449, "display_filter": "frame.number == 10449", "timestamp_epoch": "1555365899.132405000" }, { "tcp_stream": 234, "frame_number": 10500, "display_filter": "frame.number == 10500", "timestamp_epoch": "1555366199.138972000" }, { "tcp_stream": 235, "frame_number": 10523, "display_filter": "frame.number == 10523", "timestamp_epoch": "1555366460.751004000" }, { "tcp_stream": 236, "frame_number": 10538, "display_filter": "frame.number == 10538", "timestamp_epoch": "1555366499.147301000" }, { "tcp_stream": 237, "frame_number": 10571, "display_filter": "frame.number == 10571", "timestamp_epoch": "1555366799.150078000" }, { "tcp_stream": 239, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1555367060.759693000" } ], "is_private": null, "observable_id": "observable-973ed0f9aabaf51bc047f472", "last_seen_epoch": "1555367060.759693000", "enrichment_state": "not_requested", "first_seen_epoch": "1555363460.580569000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "api.bing.com", "evidence": [ { "udp_stream": 29, "frame_number": 1253, "display_filter": "frame.number == 1253", "timestamp_epoch": "1555346589.777190000" }, { "udp_stream": 31, "frame_number": 1255, "display_filter": "frame.number == 1255", "timestamp_epoch": "1555346589.786325000" }, { "udp_stream": 31, "frame_number": 1263, "display_filter": "frame.number == 1263", "timestamp_epoch": "1555346589.804161000" }, { "udp_stream": 29, "frame_number": 1264, "display_filter": "frame.number == 1264", "timestamp_epoch": "1555346589.804242000" } ], "is_private": null, "observable_id": "observable-304e658ebee8d5c67c0a9c09", "last_seen_epoch": "1555346589.804242000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346589.777190000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dns.msftncsi.com", "evidence": [ { "udp_stream": 23, "frame_number": 565, "display_filter": "frame.number == 565", "timestamp_epoch": "1555346534.015562000" }, { "udp_stream": 23, "frame_number": 566, "display_filter": "frame.number == 566", "timestamp_epoch": "1555346534.042221000" }, { "udp_stream": 24, "frame_number": 567, "display_filter": "frame.number == 567", "timestamp_epoch": "1555346534.042568000" }, { "udp_stream": 24, "frame_number": 568, "display_filter": "frame.number == 568", "timestamp_epoch": "1555346534.067372000" }, { "udp_stream": 61, "frame_number": 3307, "display_filter": "frame.number == 3307", "timestamp_epoch": "1555354244.532374000" }, { "udp_stream": 61, "frame_number": 3308, "display_filter": "frame.number == 3308", "timestamp_epoch": "1555354244.556414000" }, { "udp_stream": 62, "frame_number": 3309, "display_filter": "frame.number == 3309", "timestamp_epoch": "1555354244.557459000" }, { "udp_stream": 62, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1555354244.578449000" }, { "udp_stream": 62, "frame_number": 3311, "display_filter": "frame.number == 3311", "timestamp_epoch": "1555354244.578618000" }, { "udp_stream": 62, "frame_number": 3312, "display_filter": "frame.number == 3312", "timestamp_epoch": "1555354244.578811000" }, { "udp_stream": 78, "frame_number": 4358, "display_filter": "frame.number == 4358", "timestamp_epoch": "1555359604.529776000" }, { "udp_stream": 78, "frame_number": 4359, "display_filter": "frame.number == 4359", "timestamp_epoch": "1555359604.557420000" }, { "udp_stream": 79, "frame_number": 4360, "display_filter": "frame.number == 4360", "timestamp_epoch": "1555359604.557969000" }, { "udp_stream": 79, "frame_number": 4361, "display_filter": "frame.number == 4361", "timestamp_epoch": "1555359604.579475000" } ], "is_private": null, "observable_id": "observable-734faaf2788fe052f5de032f", "last_seen_epoch": "1555359604.579475000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346534.015562000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "iecvlist.microsoft.com", "evidence": [ { "udp_stream": 35, "frame_number": 1680, "display_filter": "frame.number == 1680", "timestamp_epoch": "1555346616.038986000" }, { "udp_stream": 35, "frame_number": 1681, "display_filter": "frame.number == 1681", "timestamp_epoch": "1555346616.090612000" }, { "tcp_stream": 50, "frame_number": 1688, "display_filter": "frame.number == 1688", "timestamp_epoch": "1555346616.136011000" }, { "tcp_stream": 51, "frame_number": 1689, "display_filter": "frame.number == 1689", "timestamp_epoch": "1555346616.136095000" } ], "is_private": null, "observable_id": "observable-25a35dcc8aa69a7d2bf4bd8a", "last_seen_epoch": "1555346616.136095000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346616.038986000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.localdomain", "evidence": [ { "udp_stream": 18, "frame_number": 250, "display_filter": "frame.number == 250", "timestamp_epoch": "1555346529.885969000" }, { "udp_stream": 18, "frame_number": 251, "display_filter": "frame.number == 251", "timestamp_epoch": "1555346529.886235000" } ], "is_private": null, "observable_id": "observable-533ee2a12484c6327ac38d06", "last_seen_epoch": "1555346529.886235000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346529.885969000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.stingrayahoy.com", "evidence": [ { "udp_stream": 17, "frame_number": 247, "display_filter": "frame.number == 247", "timestamp_epoch": "1555346529.742162000" }, { "udp_stream": 17, "frame_number": 248, "display_filter": "frame.number == 248", "timestamp_epoch": "1555346529.742371000" }, { "udp_stream": 60, "frame_number": 3292, "display_filter": "frame.number == 3292", "timestamp_epoch": "1555354242.372150000" }, { "udp_stream": 60, "frame_number": 3293, "display_filter": "frame.number == 3293", "timestamp_epoch": "1555354242.372458000" }, { "udp_stream": 67, "frame_number": 3323, "display_filter": "frame.number == 3323", "timestamp_epoch": "1555354245.320304000" }, { "udp_stream": 67, "frame_number": 3324, "display_filter": "frame.number == 3324", "timestamp_epoch": "1555354245.320485000" } ], "is_private": null, "observable_id": "observable-1b2bce32173cce828d112399", "last_seen_epoch": "1555354245.320485000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346529.742162000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "ksoniay95ee.info", "evidence": [ { "udp_stream": 28, "frame_number": 1022, "display_filter": "frame.number == 1022", "timestamp_epoch": "1555346586.179739000" }, { "udp_stream": 28, "frame_number": 1024, "display_filter": "frame.number == 1024", "timestamp_epoch": "1555346587.185863000" }, { "udp_stream": 28, "frame_number": 1026, "display_filter": "frame.number == 1026", "timestamp_epoch": "1555346588.200720000" }, { "udp_stream": 28, "frame_number": 1027, "display_filter": "frame.number == 1027", "timestamp_epoch": "1555346588.429073000" }, { "tcp_stream": 46, "frame_number": 1032, "display_filter": "frame.number == 1032", "timestamp_epoch": "1555346588.624105000" }, { "tcp_stream": 46, "frame_number": 1314, "display_filter": "frame.number == 1314", "timestamp_epoch": "1555346589.965853000" }, { "tcp_stream": 49, "frame_number": 1329, "display_filter": "frame.number == 1329", "timestamp_epoch": "1555346591.226636000" }, { "tcp_stream": 46, "frame_number": 1669, "display_filter": "frame.number == 1669", "timestamp_epoch": "1555346593.303292000" } ], "is_private": null, "observable_id": "observable-43289d50096706ce68814ed9", "last_seen_epoch": "1555346593.303292000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346586.179739000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "ljeffery54ae.top", "evidence": [ { "udp_stream": 27, "frame_number": 663, "display_filter": "frame.number == 663", "timestamp_epoch": "1555346549.360603000" }, { "udp_stream": 27, "frame_number": 664, "display_filter": "frame.number == 664", "timestamp_epoch": "1555346549.748518000" }, { "tcp_stream": 45, "frame_number": 668, "display_filter": "frame.number == 668", "timestamp_epoch": "1555346549.956141000" } ], "is_private": null, "observable_id": "observable-8db76ccc12374aee6cdead55", "last_seen_epoch": "1555346549.956141000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346549.360603000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "myip.opendns.com", "evidence": [ { "udp_stream": 40, "frame_number": 1822, "display_filter": "frame.number == 1822", "timestamp_epoch": "1555346658.500468000" }, { "udp_stream": 40, "frame_number": 1823, "display_filter": "frame.number == 1823", "timestamp_epoch": "1555346658.525048000" }, { "udp_stream": 41, "frame_number": 1824, "display_filter": "frame.number == 1824", "timestamp_epoch": "1555346658.529168000" }, { "udp_stream": 41, "frame_number": 1825, "display_filter": "frame.number == 1825", "timestamp_epoch": "1555346658.554522000" } ], "is_private": null, "observable_id": "observable-78e0d6e6febd85e8f8ec8fb9", "last_seen_epoch": "1555346658.554522000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346658.500468000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "myip.opendns.com.stingrayahoy.com", "evidence": [ { "udp_stream": 38, "frame_number": 1818, "display_filter": "frame.number == 1818", "timestamp_epoch": "1555346658.386451000" }, { "udp_stream": 38, "frame_number": 1819, "display_filter": "frame.number == 1819", "timestamp_epoch": "1555346658.452204000" }, { "udp_stream": 39, "frame_number": 1820, "display_filter": "frame.number == 1820", "timestamp_epoch": "1555346658.452945000" }, { "udp_stream": 39, "frame_number": 1821, "display_filter": "frame.number == 1821", "timestamp_epoch": "1555346658.499622000" } ], "is_private": null, "observable_id": "observable-4eadb7b2d93eb52f21615974", "last_seen_epoch": "1555346658.499622000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346658.386451000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "parolinos.xyz", "evidence": [ { "udp_stream": 92, "frame_number": 10231, "display_filter": "frame.number == 10231", "timestamp_epoch": "1555365260.601857000" }, { "udp_stream": 92, "frame_number": 10232, "display_filter": "frame.number == 10232", "timestamp_epoch": "1555365260.670068000" }, { "udp_stream": 99, "frame_number": 10768, "display_filter": "frame.number == 10768", "timestamp_epoch": "1555368260.642099000" }, { "udp_stream": 99, "frame_number": 10769, "display_filter": "frame.number == 10769", "timestamp_epoch": "1555368260.669941000" }, { "tcp_stream": 221, "frame_number": 10236, "display_filter": "frame.number == 10236", "timestamp_epoch": "1555365260.832179000" }, { "tcp_stream": 222, "frame_number": 10251, "display_filter": "frame.number == 10251", "timestamp_epoch": "1555365299.143211000" }, { "tcp_stream": 246, "frame_number": 10773, "display_filter": "frame.number == 10773", "timestamp_epoch": "1555368260.831257000" }, { "tcp_stream": 247, "frame_number": 10790, "display_filter": "frame.number == 10790", "timestamp_epoch": "1555368320.810353000" } ], "is_private": null, "observable_id": "observable-8b3caf22112482a4443a538c", "last_seen_epoch": "1555368320.810353000", "enrichment_state": "not_requested", "first_seen_epoch": "1555365260.601857000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "pompeiiii.org", "evidence": [ { "udp_stream": 77, "frame_number": 4345, "display_filter": "frame.number == 4345", "timestamp_epoch": "1555359584.579046000" }, { "udp_stream": 77, "frame_number": 4346, "display_filter": "frame.number == 4346", "timestamp_epoch": "1555359584.630094000" } ], "is_private": null, "observable_id": "observable-3e1998ab65b2d3f402f76ce0", "last_seen_epoch": "1555359584.630094000", "enrichment_state": "not_requested", "first_seen_epoch": "1555359584.579046000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "qqtube.club", "evidence": [ { "udp_stream": 90, "frame_number": 10045, "display_filter": "frame.number == 10045", "timestamp_epoch": "1555364084.642498000" }, { "udp_stream": 90, "frame_number": 10046, "display_filter": "frame.number == 10046", "timestamp_epoch": "1555364084.673017000" }, { "udp_stream": 98, "frame_number": 10656, "display_filter": "frame.number == 10656", "timestamp_epoch": "1555367420.644013000" }, { "udp_stream": 98, "frame_number": 10657, "display_filter": "frame.number == 10657", "timestamp_epoch": "1555367420.690245000" }, { "tcp_stream": 213, "frame_number": 10050, "display_filter": "frame.number == 10050", "timestamp_epoch": "1555364084.830341000" }, { "tcp_stream": 214, "frame_number": 10065, "display_filter": "frame.number == 10065", "timestamp_epoch": "1555364111.723360000" }, { "tcp_stream": 216, "frame_number": 10118, "display_filter": "frame.number == 10118", "timestamp_epoch": "1555364384.804171000" }, { "tcp_stream": 217, "frame_number": 10144, "display_filter": "frame.number == 10144", "timestamp_epoch": "1555364660.753511000" }, { "tcp_stream": 218, "frame_number": 10159, "display_filter": "frame.number == 10159", "timestamp_epoch": "1555364699.131332000" }, { "tcp_stream": 241, "frame_number": 10661, "display_filter": "frame.number == 10661", "timestamp_epoch": "1555367420.845474000" }, { "tcp_stream": 242, "frame_number": 10685, "display_filter": "frame.number == 10685", "timestamp_epoch": "1555367660.789976000" }, { "tcp_stream": 243, "frame_number": 10702, "display_filter": "frame.number == 10702", "timestamp_epoch": "1555367720.801170000" } ], "is_private": null, "observable_id": "observable-0499b771ad91c19aab2c4526", "last_seen_epoch": "1555367720.801170000", "enrichment_state": "not_requested", "first_seen_epoch": "1555364084.642498000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "resolver1.opendns.com", "evidence": [ { "udp_stream": 36, "frame_number": 1814, "display_filter": "frame.number == 1814", "timestamp_epoch": "1555346658.335680000" }, { "udp_stream": 36, "frame_number": 1815, "display_filter": "frame.number == 1815", "timestamp_epoch": "1555346658.357872000" } ], "is_private": null, "observable_id": "observable-57d03ddbc26b0f1ad914ba19", "last_seen_epoch": "1555346658.357872000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346658.335680000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "seoul-4a67-pc.stingrayahoy.com", "evidence": [ { "udp_stream": 25, "frame_number": 569, "display_filter": "frame.number == 569", "timestamp_epoch": "1555346534.296811000" }, { "udp_stream": 25, "frame_number": 570, "display_filter": "frame.number == 570", "timestamp_epoch": "1555346534.297105000" }, { "udp_stream": 53, "frame_number": 3276, "display_filter": "frame.number == 3276", "timestamp_epoch": "1555354242.021965000" }, { "udp_stream": 53, "frame_number": 3277, "display_filter": "frame.number == 3277", "timestamp_epoch": "1555354242.022327000" }, { "udp_stream": 56, "frame_number": 3282, "display_filter": "frame.number == 3282", "timestamp_epoch": "1555354242.027081000" }, { "udp_stream": 56, "frame_number": 3283, "display_filter": "frame.number == 3283", "timestamp_epoch": "1555354242.027468000" } ], "is_private": null, "observable_id": "observable-81eee0a02b774df80e14dd49", "last_seen_epoch": "1555354242.027468000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346534.296811000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "stingrayahoy-dc.stingrayahoy.com", "evidence": [ { "udp_stream": 2, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1555346526.221397000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1555346526.221554000" }, { "udp_stream": 16, "frame_number": 245, "display_filter": "frame.number == 245", "timestamp_epoch": "1555346529.737066000" }, { "udp_stream": 16, "frame_number": 246, "display_filter": "frame.number == 246", "timestamp_epoch": "1555346529.737389000" }, { "udp_stream": 44, "frame_number": 2208, "display_filter": "frame.number == 2208", "timestamp_epoch": "1555348326.795358000" }, { "udp_stream": 44, "frame_number": 2209, "display_filter": "frame.number == 2209", "timestamp_epoch": "1555348326.795828000" }, { "udp_stream": 45, "frame_number": 2694, "display_filter": "frame.number == 2694", "timestamp_epoch": "1555351926.908657000" }, { "udp_stream": 45, "frame_number": 2695, "display_filter": "frame.number == 2695", "timestamp_epoch": "1555351926.909196000" }, { "udp_stream": 66, "frame_number": 3319, "display_filter": "frame.number == 3319", "timestamp_epoch": "1555354245.318201000" }, { "udp_stream": 66, "frame_number": 3320, "display_filter": "frame.number == 3320", "timestamp_epoch": "1555354245.318350000" }, { "udp_stream": 68, "frame_number": 3858, "display_filter": "frame.number == 3858", "timestamp_epoch": "1555357902.216762000" }, { "udp_stream": 68, "frame_number": 3859, "display_filter": "frame.number == 3859", "timestamp_epoch": "1555357902.217020000" }, { "udp_stream": 80, "frame_number": 4622, "display_filter": "frame.number == 4622", "timestamp_epoch": "1555361502.329425000" }, { "udp_stream": 80, "frame_number": 4623, "display_filter": "frame.number == 4623", "timestamp_epoch": "1555361502.329738000" }, { "udp_stream": 91, "frame_number": 10205, "display_filter": "frame.number == 10205", "timestamp_epoch": "1555365102.443185000" }, { "udp_stream": 91, "frame_number": 10206, "display_filter": "frame.number == 10206", "timestamp_epoch": "1555365102.443467000" } ], "is_private": null, "observable_id": "observable-65f6862e6f097508befd7717", "last_seen_epoch": "1555365102.443467000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346526.221397000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "stingrayahoy.com", "evidence": [ { "udp_stream": 26, "frame_number": 571, "display_filter": "frame.number == 571", "timestamp_epoch": "1555346534.298446000" }, { "udp_stream": 26, "frame_number": 572, "display_filter": "frame.number == 572", "timestamp_epoch": "1555346534.299123000" }, { "udp_stream": 55, "frame_number": 3280, "display_filter": "frame.number == 3280", "timestamp_epoch": "1555354242.024466000" }, { "udp_stream": 55, "frame_number": 3281, "display_filter": "frame.number == 3281", "timestamp_epoch": "1555354242.025714000" }, { "udp_stream": 57, "frame_number": 3284, "display_filter": "frame.number == 3284", "timestamp_epoch": "1555354242.028227000" }, { "udp_stream": 57, "frame_number": 3285, "display_filter": "frame.number == 3285", "timestamp_epoch": "1555354242.029222000" } ], "is_private": null, "observable_id": "observable-9508fd00e6d2279f31aedf62", "last_seen_epoch": "1555354242.029222000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346534.298446000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.localdomain", "evidence": [ { "udp_stream": 83, "frame_number": 5371, "display_filter": "frame.number == 5371", "timestamp_epoch": "1555363518.814523000" }, { "udp_stream": 83, "frame_number": 5375, "display_filter": "frame.number == 5375", "timestamp_epoch": "1555363518.842569000" } ], "is_private": null, "observable_id": "observable-da39e81f14aa5f90299baf76", "last_seen_epoch": "1555363518.842569000", "enrichment_state": "not_requested", "first_seen_epoch": "1555363518.814523000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.stingrayahoy.com", "evidence": [ { "udp_stream": 14, "frame_number": 239, "display_filter": "frame.number == 239", "timestamp_epoch": "1555346529.296617000" }, { "udp_stream": 14, "frame_number": 240, "display_filter": "frame.number == 240", "timestamp_epoch": "1555346529.296857000" }, { "udp_stream": 64, "frame_number": 3316, "display_filter": "frame.number == 3316", "timestamp_epoch": "1555354245.317477000" }, { "udp_stream": 64, "frame_number": 3317, "display_filter": "frame.number == 3317", "timestamp_epoch": "1555354245.317662000" }, { "udp_stream": 82, "frame_number": 5369, "display_filter": "frame.number == 5369", "timestamp_epoch": "1555363518.813733000" }, { "udp_stream": 82, "frame_number": 5370, "display_filter": "frame.number == 5370", "timestamp_epoch": "1555363518.814081000" } ], "is_private": null, "observable_id": "observable-02fd1eda22ce8ab91e587625", "last_seen_epoch": "1555363518.814081000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346529.296617000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "www.bing.com", "evidence": [ { "udp_stream": 30, "frame_number": 1254, "display_filter": "frame.number == 1254", "timestamp_epoch": "1555346589.785106000" }, { "udp_stream": 32, "frame_number": 1256, "display_filter": "frame.number == 1256", "timestamp_epoch": "1555346589.787265000" }, { "udp_stream": 33, "frame_number": 1257, "display_filter": "frame.number == 1257", "timestamp_epoch": "1555346589.787594000" }, { "udp_stream": 34, "frame_number": 1258, "display_filter": "frame.number == 1258", "timestamp_epoch": "1555346589.788166000" }, { "udp_stream": 32, "frame_number": 1265, "display_filter": "frame.number == 1265", "timestamp_epoch": "1555346589.847335000" }, { "udp_stream": 33, "frame_number": 1266, "display_filter": "frame.number == 1266", "timestamp_epoch": "1555346589.847476000" }, { "udp_stream": 34, "frame_number": 1267, "display_filter": "frame.number == 1267", "timestamp_epoch": "1555346589.847567000" }, { "udp_stream": 30, "frame_number": 1268, "display_filter": "frame.number == 1268", "timestamp_epoch": "1555346589.847659000" } ], "is_private": null, "observable_id": "observable-df7ac7d989402d8d4676efc1", "last_seen_epoch": "1555346589.847659000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346589.785106000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.download.windowsupdate.com", "evidence": [ { "udp_stream": 43, "frame_number": 1843, "display_filter": "frame.number == 1843", "timestamp_epoch": "1555346659.484357000" }, { "udp_stream": 43, "frame_number": 1844, "display_filter": "frame.number == 1844", "timestamp_epoch": "1555346659.532735000" }, { "tcp_stream": 57, "frame_number": 1848, "display_filter": "frame.number == 1848", "timestamp_epoch": "1555346659.556595000" } ], "is_private": null, "observable_id": "observable-a3fdf06e1306b156bbf35e32", "last_seen_epoch": "1555346659.556595000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346659.484357000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.msftncsi.com", "evidence": [ { "udp_stream": 22, "frame_number": 397, "display_filter": "frame.number == 397", "timestamp_epoch": "1555346531.866514000" }, { "udp_stream": 22, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1555346531.908365000" }, { "tcp_stream": 28, "frame_number": 402, "display_filter": "frame.number == 402", "timestamp_epoch": "1555346531.941203000" } ], "is_private": null, "observable_id": "observable-c38832e8f381499048f77541", "last_seen_epoch": "1555346531.941203000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346531.866514000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "zindv.club", "evidence": [ { "udp_stream": 42, "frame_number": 1827, "display_filter": "frame.number == 1827", "timestamp_epoch": "1555346658.623534000" }, { "udp_stream": 42, "frame_number": 1830, "display_filter": "frame.number == 1830", "timestamp_epoch": "1555346658.882999000" }, { "tcp_stream": 56, "frame_number": 1834, "display_filter": "frame.number == 1834", "timestamp_epoch": "1555346659.077320000" }, { "tcp_stream": 58, "frame_number": 1916, "display_filter": "frame.number == 1916", "timestamp_epoch": "1555346660.499057000" }, { "tcp_stream": 60, "frame_number": 1944, "display_filter": "frame.number == 1944", "timestamp_epoch": "1555346672.224837000" } ], "is_private": null, "observable_id": "observable-c8787c4f9169e5f9a98e5855", "last_seen_epoch": "1555346672.224837000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346658.623534000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.0.90.175", "evidence": [ { "udp_stream": 26, "frame_number": 571, "display_filter": "frame.number == 571", "timestamp_epoch": "1555346534.298446000" }, { "udp_stream": 26, "frame_number": 572, "display_filter": "frame.number == 572", "timestamp_epoch": "1555346534.299123000" }, { "udp_stream": 55, "frame_number": 3280, "display_filter": "frame.number == 3280", "timestamp_epoch": "1555354242.024466000" }, { "udp_stream": 55, "frame_number": 3281, "display_filter": "frame.number == 3281", "timestamp_epoch": "1555354242.025714000" }, { "udp_stream": 57, "frame_number": 3284, "display_filter": "frame.number == 3284", "timestamp_epoch": "1555354242.028227000" }, { "udp_stream": 57, "frame_number": 3285, "display_filter": "frame.number == 3285", "timestamp_epoch": "1555354242.029222000" } ], "is_private": true, "observable_id": "observable-9a490fbc18c7564c56753ccc", "last_seen_epoch": "1555354242.029222000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346534.298446000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.0.90.255", "evidence": [], "is_private": true, "observable_id": "observable-df6e5ccd8ff219e1739df82f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.0.90.9", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1555346526.219414000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1555346526.221554000" }, { "udp_stream": 5, "frame_number": 80, "display_filter": "frame.number == 80", "timestamp_epoch": "1555346526.415189000" }, { "udp_stream": 7, "frame_number": 135, "display_filter": "frame.number == 135", "timestamp_epoch": "1555346526.467039000" }, { "udp_stream": 9, "frame_number": 153, "display_filter": "frame.number == 153", "timestamp_epoch": "1555346526.522279000" }, { "udp_stream": 16, "frame_number": 246, "display_filter": "frame.number == 246", "timestamp_epoch": "1555346529.737389000" }, { "udp_stream": 25, "frame_number": 570, "display_filter": "frame.number == 570", "timestamp_epoch": "1555346534.297105000" }, { "udp_stream": 44, "frame_number": 2209, "display_filter": "frame.number == 2209", "timestamp_epoch": "1555348326.795828000" }, { "udp_stream": 45, "frame_number": 2695, "display_filter": "frame.number == 2695", "timestamp_epoch": "1555351926.909196000" }, { "udp_stream": 53, "frame_number": 3277, "display_filter": "frame.number == 3277", "timestamp_epoch": "1555354242.022327000" }, { "udp_stream": 56, "frame_number": 3283, "display_filter": "frame.number == 3283", "timestamp_epoch": "1555354242.027468000" }, { "udp_stream": 66, "frame_number": 3320, "display_filter": "frame.number == 3320", "timestamp_epoch": "1555354245.318350000" }, { "udp_stream": 68, "frame_number": 3859, "display_filter": "frame.number == 3859", "timestamp_epoch": "1555357902.217020000" }, { "udp_stream": 80, "frame_number": 4623, "display_filter": "frame.number == 4623", "timestamp_epoch": "1555361502.329738000" }, { "udp_stream": 91, "frame_number": 10206, "display_filter": "frame.number == 10206", "timestamp_epoch": "1555365102.443467000" } ], "is_private": true, "observable_id": "observable-a2358737e244d3d98e7f9f07", "last_seen_epoch": "1555365102.443467000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346526.219414000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.73.85.137", "evidence": [ { "udp_stream": 43, "frame_number": 1844, "display_filter": "frame.number == 1844", "timestamp_epoch": "1555346659.532735000" } ], "is_private": false, "observable_id": "observable-b65475c00612dd73913539f5", "last_seen_epoch": "1555346659.532735000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346659.532735000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "109.230.199.24", "evidence": [ { "udp_stream": 90, "frame_number": 10046, "display_filter": "frame.number == 10046", "timestamp_epoch": "1555364084.673017000" }, { "udp_stream": 98, "frame_number": 10657, "display_filter": "frame.number == 10657", "timestamp_epoch": "1555367420.690245000" } ], "is_private": false, "observable_id": "observable-aa8dce43359dcabe9d229aca", "last_seen_epoch": "1555367420.690245000", "enrichment_state": "not_requested", "first_seen_epoch": "1555364084.673017000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.107.21.200", "evidence": [ { "udp_stream": 32, "frame_number": 1265, "display_filter": "frame.number == 1265", "timestamp_epoch": "1555346589.847335000" }, { "udp_stream": 33, "frame_number": 1266, "display_filter": "frame.number == 1266", "timestamp_epoch": "1555346589.847476000" }, { "udp_stream": 34, "frame_number": 1267, "display_filter": "frame.number == 1267", "timestamp_epoch": "1555346589.847567000" }, { "udp_stream": 30, "frame_number": 1268, "display_filter": "frame.number == 1268", "timestamp_epoch": "1555346589.847659000" } ], "is_private": false, "observable_id": "observable-0778661b7354dcb57371f80f", "last_seen_epoch": "1555346589.847659000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346589.847335000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.107.5.80", "evidence": [ { "udp_stream": 31, "frame_number": 1263, "display_filter": "frame.number == 1263", "timestamp_epoch": "1555346589.804161000" }, { "udp_stream": 29, "frame_number": 1264, "display_filter": "frame.number == 1264", "timestamp_epoch": "1555346589.804242000" } ], "is_private": false, "observable_id": "observable-13221cbca850a18dbb14d812", "last_seen_epoch": "1555346589.804242000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346589.804161000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "131.107.255.255", "evidence": [ { "udp_stream": 23, "frame_number": 566, "display_filter": "frame.number == 566", "timestamp_epoch": "1555346534.042221000" }, { "udp_stream": 61, "frame_number": 3308, "display_filter": "frame.number == 3308", "timestamp_epoch": "1555354244.556414000" }, { "udp_stream": 78, "frame_number": 4359, "display_filter": "frame.number == 4359", "timestamp_epoch": "1555359604.557420000" } ], "is_private": false, "observable_id": "observable-17b4c0d151c761d388141b36", "last_seen_epoch": "1555359604.557420000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346534.042221000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "151.106.27.208", "evidence": [ { "tcp_stream": 59, "frame_number": 1931, "display_filter": "frame.number == 1931", "timestamp_epoch": "1555346661.898719000" }, { "tcp_stream": 63, "frame_number": 1994, "display_filter": "frame.number == 1994", "timestamp_epoch": "1555346969.613910000" } ], "is_private": false, "observable_id": "observable-6779869cb4ecfa828618a43c", "last_seen_epoch": "1555346969.613910000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346661.898719000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "162.213.250.131", "evidence": [ { "tcp_stream": 200, "frame_number": 4961, "display_filter": "frame.number == 4961", "timestamp_epoch": "1555363492.940707000" } ], "is_private": false, "observable_id": "observable-b8b09d6c335fe97496ace2ae", "last_seen_epoch": "1555363492.940707000", "enrichment_state": "not_requested", "first_seen_epoch": "1555363492.940707000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "173.166.146.112", "evidence": [ { "udp_stream": 40, "frame_number": 1823, "display_filter": "frame.number == 1823", "timestamp_epoch": "1555346658.525048000" } ], "is_private": false, "observable_id": "observable-b7d052195e235aef50e34b3c", "last_seen_epoch": "1555346658.525048000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346658.525048000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "176.10.125.110", "evidence": [ { "udp_stream": 92, "frame_number": 10232, "display_filter": "frame.number == 10232", "timestamp_epoch": "1555365260.670068000" }, { "udp_stream": 99, "frame_number": 10769, "display_filter": "frame.number == 10769", "timestamp_epoch": "1555368260.669941000" } ], "is_private": false, "observable_id": "observable-9d2c0d8bfd7402ed90ee0297", "last_seen_epoch": "1555368260.669941000", "enrichment_state": "not_requested", "first_seen_epoch": "1555365260.670068000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "185.136.169.160", "evidence": [], "is_private": false, "observable_id": "observable-3b1027c90f92330a1b0aa5a2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.139.69.88", "evidence": [ { "udp_stream": 42, "frame_number": 1830, "display_filter": "frame.number == 1830", "timestamp_epoch": "1555346658.882999000" } ], "is_private": false, "observable_id": "observable-b66a61221a689fadcbb4e20d", "last_seen_epoch": "1555346658.882999000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346658.882999000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.158.249.39", "evidence": [ { "udp_stream": 81, "frame_number": 4920, "display_filter": "frame.number == 4920", "timestamp_epoch": "1555363460.619298000" }, { "udp_stream": 97, "frame_number": 10430, "display_filter": "frame.number == 10430", "timestamp_epoch": "1555365860.644759000" } ], "is_private": false, "observable_id": "observable-9864ae4555d111f35bbb8336", "last_seen_epoch": "1555365860.644759000", "enrichment_state": "not_requested", "first_seen_epoch": "1555363460.619298000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "185.212.47.167", "evidence": [], "is_private": false, "observable_id": "observable-e9b794e2ade21c332d22d14c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "187.188.166.192", "evidence": [], "is_private": false, "observable_id": "observable-fe3a78ca441761f253d38a58", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "198.54.115.33", "evidence": [], "is_private": false, "observable_id": "observable-f45ccae72e4fead428dce2b9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "198.54.125.57", "evidence": [], "is_private": false, "observable_id": "observable-1c7330850f53c11c990099df", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "204.79.197.200", "evidence": [ { "udp_stream": 32, "frame_number": 1265, "display_filter": "frame.number == 1265", "timestamp_epoch": "1555346589.847335000" }, { "udp_stream": 33, "frame_number": 1266, "display_filter": "frame.number == 1266", "timestamp_epoch": "1555346589.847476000" }, { "udp_stream": 34, "frame_number": 1267, "display_filter": "frame.number == 1267", "timestamp_epoch": "1555346589.847567000" }, { "udp_stream": 30, "frame_number": 1268, "display_filter": "frame.number == 1268", "timestamp_epoch": "1555346589.847659000" } ], "is_private": false, "observable_id": "observable-c62aa3c22ae89e267937b5b0", "last_seen_epoch": "1555346589.847659000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346589.847335000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "208.67.222.222", "evidence": [ { "udp_stream": 36, "frame_number": 1815, "display_filter": "frame.number == 1815", "timestamp_epoch": "1555346658.357872000" } ], "is_private": false, "observable_id": "observable-59a38ba2731498e335e720ba", "last_seen_epoch": "1555346658.357872000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346658.357872000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "208.91.197.91", "evidence": [ { "udp_stream": 77, "frame_number": 4346, "display_filter": "frame.number == 4346", "timestamp_epoch": "1555359584.630094000" } ], "is_private": false, "observable_id": "observable-8da99076a957ef470de13b9f", "last_seen_epoch": "1555359584.630094000", "enrichment_state": "not_requested", "first_seen_epoch": "1555359584.630094000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "216.98.148.157", "evidence": [], "is_private": false, "observable_id": "observable-1b06848b717dc16908c7f27a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-0e0b987cd109a540f386dde9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-921ae84174f5b120581b750c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.218.156.11", "evidence": [ { "udp_stream": 22, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1555346531.908365000" } ], "is_private": false, "observable_id": "observable-ef1f3fe4e1b03e9d256ba206", "last_seen_epoch": "1555346531.908365000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346531.908365000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.218.156.26", "evidence": [ { "udp_stream": 22, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1555346531.908365000" } ], "is_private": false, "observable_id": "observable-3375dbb4cc2d032431e5a3f6", "last_seen_epoch": "1555346531.908365000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346531.908365000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "255.255.255.255", "evidence": [], "is_private": true, "observable_id": "observable-cdc58e67c013b2990401556f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "37.230.112.226", "evidence": [ { "udp_stream": 28, "frame_number": 1027, "display_filter": "frame.number == 1027", "timestamp_epoch": "1555346588.429073000" } ], "is_private": false, "observable_id": "observable-812eae481da70d82b14c7682", "last_seen_epoch": "1555346588.429073000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346588.429073000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "68.65.122.52", "evidence": [], "is_private": false, "observable_id": "observable-7d75a80d1beb088d42d28140", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.21.81.200", "evidence": [ { "udp_stream": 35, "frame_number": 1681, "display_filter": "frame.number == 1681", "timestamp_epoch": "1555346616.090612000" } ], "is_private": false, "observable_id": "observable-aaafbf8b586ae6e0f9ed0420", "last_seen_epoch": "1555346616.090612000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346616.090612000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "85.114.134.49", "evidence": [ { "tcp_stream": 201, "frame_number": 5380, "display_filter": "frame.number == 5380", "timestamp_epoch": "1555363518.972098000" }, { "tcp_stream": 201, "frame_number": 9830, "display_filter": "frame.number == 9830", "timestamp_epoch": "1555363524.078960000" } ], "is_private": false, "observable_id": "observable-e0be17e02f5cbab96002fb71", "last_seen_epoch": "1555363524.078960000", "enrichment_state": "not_requested", "first_seen_epoch": "1555363518.972098000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "89.163.144.224", "evidence": [ { "tcp_stream": 196, "frame_number": 4880, "display_filter": "frame.number == 4880", "timestamp_epoch": "1555363185.829368000" } ], "is_private": false, "observable_id": "observable-92e075b5d6c7750a77b0eabf", "last_seen_epoch": "1555363185.829368000", "enrichment_state": "not_requested", "first_seen_epoch": "1555363185.829368000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "91.240.87.19", "evidence": [ { "udp_stream": 27, "frame_number": 664, "display_filter": "frame.number == 664", "timestamp_epoch": "1555346549.748518000" } ], "is_private": false, "observable_id": "observable-e00eb74b5fcb5654048f5a1b", "last_seen_epoch": "1555346549.748518000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346549.748518000" }, { "type": "ipv6", "roles": [ "dns-answer" ], "value": "fd3e:4f5a:5b81::1", "evidence": [ { "udp_stream": 24, "frame_number": 568, "display_filter": "frame.number == 568", "timestamp_epoch": "1555346534.067372000" }, { "udp_stream": 62, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1555354244.578449000" }, { "udp_stream": 62, "frame_number": 3312, "display_filter": "frame.number == 3312", "timestamp_epoch": "1555354244.578811000" }, { "udp_stream": 79, "frame_number": 4361, "display_filter": "frame.number == 4361", "timestamp_epoch": "1555359604.579475000" } ], "is_private": true, "observable_id": "observable-07a1e011d4ea98560a4ec537", "last_seen_epoch": "1555359604.579475000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346534.067372000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "4d7a28d6f2263ed61de88ca66eb011e3", "evidence": [ { "tcp_stream": 50, "frame_number": 1688, "display_filter": "frame.number == 1688", "timestamp_epoch": "1555346616.136011000" }, { "tcp_stream": 51, "frame_number": 1689, "display_filter": "frame.number == 1689", "timestamp_epoch": "1555346616.136095000" }, { "tcp_stream": 56, "frame_number": 1834, "display_filter": "frame.number == 1834", "timestamp_epoch": "1555346659.077320000" }, { "tcp_stream": 58, "frame_number": 1916, "display_filter": "frame.number == 1916", "timestamp_epoch": "1555346660.499057000" }, { "tcp_stream": 60, "frame_number": 1944, "display_filter": "frame.number == 1944", "timestamp_epoch": "1555346672.224837000" }, { "tcp_stream": 198, "frame_number": 4924, "display_filter": "frame.number == 4924", "timestamp_epoch": "1555363460.745329000" }, { "tcp_stream": 199, "frame_number": 4946, "display_filter": "frame.number == 4946", "timestamp_epoch": "1555363484.760068000" }, { "tcp_stream": 210, "frame_number": 9987, "display_filter": "frame.number == 9987", "timestamp_epoch": "1555363784.777427000" }, { "tcp_stream": 211, "frame_number": 10002, "display_filter": "frame.number == 10002", "timestamp_epoch": "1555363830.695237000" }, { "tcp_stream": 213, "frame_number": 10050, "display_filter": "frame.number == 10050", "timestamp_epoch": "1555364084.830341000" }, { "tcp_stream": 214, "frame_number": 10065, "display_filter": "frame.number == 10065", "timestamp_epoch": "1555364111.723360000" }, { "tcp_stream": 216, "frame_number": 10118, "display_filter": "frame.number == 10118", "timestamp_epoch": "1555364384.804171000" }, { "tcp_stream": 217, "frame_number": 10144, "display_filter": "frame.number == 10144", "timestamp_epoch": "1555364660.753511000" }, { "tcp_stream": 218, "frame_number": 10159, "display_filter": "frame.number == 10159", "timestamp_epoch": "1555364699.131332000" }, { "tcp_stream": 221, "frame_number": 10236, "display_filter": "frame.number == 10236", "timestamp_epoch": "1555365260.832179000" }, { "tcp_stream": 222, "frame_number": 10251, "display_filter": "frame.number == 10251", "timestamp_epoch": "1555365299.143211000" }, { "tcp_stream": 231, "frame_number": 10434, "display_filter": "frame.number == 10434", "timestamp_epoch": "1555365860.792339000" }, { "tcp_stream": 232, "frame_number": 10449, "display_filter": "frame.number == 10449", "timestamp_epoch": "1555365899.132405000" }, { "tcp_stream": 234, "frame_number": 10500, "display_filter": "frame.number == 10500", "timestamp_epoch": "1555366199.138972000" }, { "tcp_stream": 235, "frame_number": 10523, "display_filter": "frame.number == 10523", "timestamp_epoch": "1555366460.751004000" } ], "is_private": null, "observable_id": "observable-c937285d74f09f6f0e80253e", "last_seen_epoch": "1555368320.810353000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346616.136011000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "74927e242d6c3febf8cb9cab10a7f889", "evidence": [ { "tcp_stream": 62, "frame_number": 1979, "display_filter": "frame.number == 1979", "timestamp_epoch": "1555346960.486726000" }, { "tcp_stream": 64, "frame_number": 2015, "display_filter": "frame.number == 2015", "timestamp_epoch": "1555347260.467997000" }, { "tcp_stream": 65, "frame_number": 2034, "display_filter": "frame.number == 2034", "timestamp_epoch": "1555347280.844697000" }, { "tcp_stream": 66, "frame_number": 2053, "display_filter": "frame.number == 2053", "timestamp_epoch": "1555347306.214706000" }, { "tcp_stream": 68, "frame_number": 2107, "display_filter": "frame.number == 2107", "timestamp_epoch": "1555347580.840612000" }, { "tcp_stream": 69, "frame_number": 2122, "display_filter": "frame.number == 2122", "timestamp_epoch": "1555347595.241177000" }, { "tcp_stream": 70, "frame_number": 2151, "display_filter": "frame.number == 2151", "timestamp_epoch": "1555347860.475131000" }, { "tcp_stream": 71, "frame_number": 2166, "display_filter": "frame.number == 2166", "timestamp_epoch": "1555347884.529654000" }, { "tcp_stream": 72, "frame_number": 2191, "display_filter": "frame.number == 2191", "timestamp_epoch": "1555348184.537856000" }, { "tcp_stream": 74, "frame_number": 2235, "display_filter": "frame.number == 2235", "timestamp_epoch": "1555348460.500200000" }, { "tcp_stream": 75, "frame_number": 2250, "display_filter": "frame.number == 2250", "timestamp_epoch": "1555348484.552664000" }, { "tcp_stream": 76, "frame_number": 2279, "display_filter": "frame.number == 2279", "timestamp_epoch": "1555348784.564976000" }, { "tcp_stream": 77, "frame_number": 2299, "display_filter": "frame.number == 2299", "timestamp_epoch": "1555349060.505864000" }, { "tcp_stream": 78, "frame_number": 2314, "display_filter": "frame.number == 2314", "timestamp_epoch": "1555349084.556969000" }, { "tcp_stream": 80, "frame_number": 2363, "display_filter": "frame.number == 2363", "timestamp_epoch": "1555349384.579174000" }, { "tcp_stream": 81, "frame_number": 2385, "display_filter": "frame.number == 2385", "timestamp_epoch": "1555349660.512944000" }, { "tcp_stream": 82, "frame_number": 2400, "display_filter": "frame.number == 2400", "timestamp_epoch": "1555349684.547991000" }, { "tcp_stream": 83, "frame_number": 2425, "display_filter": "frame.number == 2425", "timestamp_epoch": "1555349984.564403000" }, { "tcp_stream": 85, "frame_number": 2467, "display_filter": "frame.number == 2467", "timestamp_epoch": "1555350260.535120000" }, { "tcp_stream": 86, "frame_number": 2482, "display_filter": "frame.number == 2482", "timestamp_epoch": "1555350284.575657000" } ], "is_private": null, "observable_id": "observable-98655ebc88a8b73ef98b0e52", "last_seen_epoch": "1555368020.731452000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346960.486726000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2c60e1e69aeca03fb562c0597bd404df118151e6782d7cfefcbcefb5a1505d21", "evidence": [], "is_private": null, "observable_id": "observable-6fb32d0d83115116e5a5442f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4017ffd0c17a9fbaebd74c6b75b6e8898d53ce401f16a64881bd0ee5837f6591", "evidence": [], "is_private": null, "observable_id": "observable-d799506e11093ec0f177b558", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4c9c4d831d61c8c38b2513f9b431ef4f4cf6af9fb18a2317cd2178d6e0997822", "evidence": [], "is_private": null, "observable_id": "observable-821c403ab7bfd3c1c24042d2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "evidence": [], "is_private": null, "observable_id": "observable-0c7ba6e27063fea3320330de", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3", "evidence": [], "is_private": null, "observable_id": "observable-8b272da56dc36bb848a3892d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5f1ea837b7530af44e85e0198beab49e0f2cf9e60a75d76c044313985de822ff", "evidence": [], "is_private": null, "observable_id": "observable-2536b65e4486936f06ce8b1d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [], "is_private": null, "observable_id": "observable-ef1031c9037edd8b13bc1528", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "637ccbba391788d61f87d86caf06bdd4c6c03c43aa9386c42bdf2543a072619c", "evidence": [], "is_private": null, "observable_id": "observable-ececc5f341fee35f3d769e5c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6aed702963283420db151840cb48374f6c48b4f9dc933f7a6c9fdb1d77ce88e1", "evidence": [], "is_private": null, "observable_id": "observable-edfa92dc5a61bb051ecbc621", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6d48f7ed8bafb7e147b7438a21362220adcc24e83a4f9942f6ccf9c09b3b4b02", "evidence": [], "is_private": null, "observable_id": "observable-ac0cf83eadde1b26f6d83186", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "91cba2f5400a35c849783d307e016002144c96c9ee817b7a375e225c57b1ff80", "evidence": [], "is_private": null, "observable_id": "observable-32c6af13d180aca6598d65b8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "aa2f524d89ce598b990d3c8cd74cdc31cfaa9a7c6a63596b0e5b394dc7ede10b", "evidence": [], "is_private": null, "observable_id": "observable-e208de6495437c5b2853e934", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "evidence": [], "is_private": null, "observable_id": "observable-f52d488cc49f094c9f5e666b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f07dbc57bb41792248061012e6479b00ba046d6631e1734bdbbd01bc421ecba4", "evidence": [], "is_private": null, "observable_id": "observable-26ccec27b14daecd7584801c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://151.106.27.208/client.rar", "evidence": [ { "tcp_stream": 59, "frame_number": 1931, "display_filter": "frame.number == 1931", "timestamp_epoch": "1555346661.898719000" }, { "tcp_stream": 63, "frame_number": 1994, "display_filter": "frame.number == 1994", "timestamp_epoch": "1555346969.613910000" } ], "is_private": null, "observable_id": "observable-ed13661f424f3db782f869cd", "last_seen_epoch": "1555346969.613910000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346661.898719000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://162.213.250.131/azor.rar", "evidence": [ { "tcp_stream": 200, "frame_number": 4961, "display_filter": "frame.number == 4961", "timestamp_epoch": "1555363492.940707000" } ], "is_private": null, "observable_id": "observable-6278f3fc025b77de4e80b760", "last_seen_epoch": "1555363492.940707000", "enrichment_state": "not_requested", "first_seen_epoch": "1555363492.940707000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://85.114.134.49/index.php", "evidence": [ { "tcp_stream": 201, "frame_number": 5380, "display_filter": "frame.number == 5380", "timestamp_epoch": "1555363518.972098000" }, { "tcp_stream": 201, "frame_number": 9830, "display_filter": "frame.number == 9830", "timestamp_epoch": "1555363524.078960000" } ], "is_private": null, "observable_id": "observable-7ee22136efb4c908cc542dda", "last_seen_epoch": "1555363524.078960000", "enrichment_state": "not_requested", "first_seen_epoch": "1555363518.972098000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://89.163.144.224/klansfuuerifneiferunfasd/modules/client.rar", "evidence": [ { "tcp_stream": 196, "frame_number": 4880, "display_filter": "frame.number == 4880", "timestamp_epoch": "1555363185.829368000" } ], "is_private": null, "observable_id": "observable-cf55b4f165cd11883dd25206", "last_seen_epoch": "1555363185.829368000", "enrichment_state": "not_requested", "first_seen_epoch": "1555363185.829368000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ksoniay95ee.info/favicon.ico", "evidence": [ { "tcp_stream": 46, "frame_number": 1314, "display_filter": "frame.number == 1314", "timestamp_epoch": "1555346589.965853000" } ], "is_private": null, "observable_id": "observable-a87f4b6ce655a40f90ba9c4d", "last_seen_epoch": "1555346589.965853000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346589.965853000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ksoniay95ee.info/images/CI9BVzd6AqB/ZNUmRFBAKmX4q_/2FIAs9nQJlVF7_2BTvRU5/ZPqTgOgLDp8JzrCL/_2Fcm_2BF41yLbk/eclytPd8CmogXhag5f/iJKuzzkmf/M1zwJZUnnnK6LJcptL1S/m6Hl99BQ3fNUdtPt9So/0Zzs4gdqrhrs/_2FJr.avi", "evidence": [ { "tcp_stream": 46, "frame_number": 1032, "display_filter": "frame.number == 1032", "timestamp_epoch": "1555346588.624105000" } ], "is_private": null, "observable_id": "observable-a608dd760b5026bb4bc700e0", "last_seen_epoch": "1555346588.624105000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346588.624105000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ksoniay95ee.info/images/k1bBds2o/QmLUr43VFSfi6mVN0k_2Fri/aRq5qJ_2Bb/9pn_2FrlWUAEwA3DA/8_2BlKV4KDN_/2B_2BLZHLEa/vLvK_2F5G0A625/hGoDuTo8Bf7h2KRBD9vOP/gcTRbqx7bC5Q89C6/6YYly9yOp3zpx2r/BwphZTlcwHbBf1/hYP.avi", "evidence": [ { "tcp_stream": 46, "frame_number": 1669, "display_filter": "frame.number == 1669", "timestamp_epoch": "1555346593.303292000" } ], "is_private": null, "observable_id": "observable-f218ba951a528cba9b7a9b41", "last_seen_epoch": "1555346593.303292000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346593.303292000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ksoniay95ee.info/images/zqt4lIX7/WURokuO9vh89Yy_2BsUJrS9/PjffqPwJdE/ySWjXv6UbPaKFMooy/6X5boj6wckcc/Ucw3dM3Mi_2/FznVDXGp2L3Py2/JxFQvMX4xN_2FzOJs9Vmk/BMKiWvw71S3sGLtJ/XPIlWh5f6mD5BYu/asfVMoi7/c.avi", "evidence": [ { "tcp_stream": 49, "frame_number": 1329, "display_filter": "frame.number == 1329", "timestamp_epoch": "1555346591.226636000" } ], "is_private": null, "observable_id": "observable-daf76f9c39bceaff24525233", "last_seen_epoch": "1555346591.226636000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346591.226636000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://ljeffery54ae.top/skoex/po2.php?l=cupk6.fgs", "evidence": [ { "tcp_stream": 45, "frame_number": 668, "display_filter": "frame.number == 668", "timestamp_epoch": "1555346549.956141000" } ], "is_private": null, "observable_id": "observable-ff547aac41d098b891432d3e", "last_seen_epoch": "1555346549.956141000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346549.956141000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "evidence": [ { "tcp_stream": 57, "frame_number": 1848, "display_filter": "frame.number == 1848", "timestamp_epoch": "1555346659.556595000" } ], "is_private": null, "observable_id": "observable-e9001539262325ec335ba026", "last_seen_epoch": "1555346659.556595000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346659.556595000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.msftncsi.com/ncsi.txt", "evidence": [ { "tcp_stream": 28, "frame_number": 402, "display_filter": "frame.number == 402", "timestamp_epoch": "1555346531.941203000" } ], "is_private": null, "observable_id": "observable-ac90fdc134ba454c14b6d9ae", "last_seen_epoch": "1555346531.941203000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346531.941203000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft NCSI", "evidence": [ { "tcp_stream": 28, "frame_number": 402, "display_filter": "frame.number == 402", "timestamp_epoch": "1555346531.941203000" } ], "is_private": null, "observable_id": "observable-104754cde15db06fa2dd8e3c", "last_seen_epoch": "1555346531.941203000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346531.941203000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft-CryptoAPI/6.1", "evidence": [ { "tcp_stream": 57, "frame_number": 1848, "display_filter": "frame.number == 1848", "timestamp_epoch": "1555346659.556595000" } ], "is_private": null, "observable_id": "observable-d849c6f12e42e2874ac6d83b", "last_seen_epoch": "1555346659.556595000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346659.556595000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", "evidence": [ { "tcp_stream": 201, "frame_number": 5380, "display_filter": "frame.number == 5380", "timestamp_epoch": "1555363518.972098000" }, { "tcp_stream": 201, "frame_number": 9830, "display_filter": "frame.number == 9830", "timestamp_epoch": "1555363524.078960000" } ], "is_private": null, "observable_id": "observable-99eb91ea12d0d104ef11be27", "last_seen_epoch": "1555363524.078960000", "enrichment_state": "not_requested", "first_seen_epoch": "1555363518.972098000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)", "evidence": [ { "tcp_stream": 59, "frame_number": 1931, "display_filter": "frame.number == 1931", "timestamp_epoch": "1555346661.898719000" }, { "tcp_stream": 63, "frame_number": 1994, "display_filter": "frame.number == 1994", "timestamp_epoch": "1555346969.613910000" }, { "tcp_stream": 196, "frame_number": 4880, "display_filter": "frame.number == 4880", "timestamp_epoch": "1555363185.829368000" }, { "tcp_stream": 200, "frame_number": 4961, "display_filter": "frame.number == 4961", "timestamp_epoch": "1555363492.940707000" } ], "is_private": null, "observable_id": "observable-0de047e71f93c214f7f4140e", "last_seen_epoch": "1555363492.940707000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346661.898719000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "evidence": [ { "tcp_stream": 46, "frame_number": 1032, "display_filter": "frame.number == 1032", "timestamp_epoch": "1555346588.624105000" }, { "tcp_stream": 46, "frame_number": 1314, "display_filter": "frame.number == 1314", "timestamp_epoch": "1555346589.965853000" }, { "tcp_stream": 49, "frame_number": 1329, "display_filter": "frame.number == 1329", "timestamp_epoch": "1555346591.226636000" }, { "tcp_stream": 46, "frame_number": 1669, "display_filter": "frame.number == 1669", "timestamp_epoch": "1555346593.303292000" } ], "is_private": null, "observable_id": "observable-3aef4a7a86c546e3ec9646b7", "last_seen_epoch": "1555346593.303292000", "enrichment_state": "not_requested", "first_seen_epoch": "1555346588.624105000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "f31b5bca14bdab1bc44c0c02da4c728a1500276ab131a5fd81499a0d1ec8bc93", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [ { "name": "Ingress Tool Transfer", "status": "suggested", "tactic": "command-and-control", "evidence": [ { "tcp_stream": 59, "frame_number": 1931, "display_filter": "frame.number == 1931", "timestamp_epoch": "1555346661.898719000" }, { "tcp_stream": 59, "frame_number": 1933, "display_filter": "frame.number == 1933", "timestamp_epoch": "1555346662.032496000" }, { "tcp_stream": 63, "frame_number": 1994, "display_filter": "frame.number == 1994", "timestamp_epoch": "1555346969.613910000" }, { "tcp_stream": 63, "frame_number": 1996, "display_filter": "frame.number == 1996", "timestamp_epoch": "1555346969.751896000" }, { "tcp_stream": 196, "frame_number": 4880, "display_filter": "frame.number == 4880", "timestamp_epoch": "1555363185.829368000" }, { "tcp_stream": 196, "frame_number": 4882, "display_filter": "frame.number == 4882", "timestamp_epoch": "1555363185.975636000" }, { "tcp_stream": 200, "frame_number": 4961, "display_filter": "frame.number == 4961", "timestamp_epoch": "1555363492.940707000" }, { "tcp_stream": 200, "frame_number": 5365, "display_filter": "frame.number == 5365", "timestamp_epoch": "1555363493.397007000" } ], "attack_id": "T1105", "confidence": 0.8, "finding_ids": [ "finding-5c11492821d7f5bcabbee048", "finding-e7d3369607abfb80fbd97ee1", "finding-f09e82e7672fab01200e7f3f" ], "mapping_basis": "versioned-deterministic-rule" } ], "analysis_key_material": { "source_sha256": "2d27b8be5a880af7cfd5a51bd9a184e546344afe42261c323b41e34b961a288c", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 91, "observable_limit": 5000, "observables_total": 91, "matched_observables": 0, "observables_checked": 91, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:08:27.698915+00:00", "session_id": "49367ac9-524c-4897-9fde-8da02d97f4cf", "techniques": [ { "url": "https://attack.mitre.org/techniques/T1105", "name": "Ingress Tool Transfer", "status": "catalog-context-not-validation-of-behavior", "attack_id": "T1105", "detection": "", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "WinEventLog:Sysmon", "auditd:SYSCALL", "iptables:LOG", "macos:endpointsecurity", "macos:unifiedlog", "esxi:hostd", "esxi:vmkernel", "NSM:Flow", "snmp:syslog" ], "catalog_version_id": 851, "detection_strategies": [ { "name": "Detect Ingress Tool Transfers via Behavioral Chain", "stix_id": "x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554", "attack_id": "DET0060" } ], "detection_links_truncated": false } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "3b677f25614218ea03df7893b8d36aceb874c1019ad8455a970414edb2faf68c", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "f31b5bca14bdab1bc44c0c02da4c728a1500276ab131a5fd81499a0d1ec8bc93", "cross_case_correlations": [ { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 16, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 15, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 17, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 14, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 1, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 1, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "f31b5bca14bdab1bc44c0c02da4c728a1500276ab131a5fd81499a0d1ec8bc93", "items": [ { "observable_id": "observable-051a7eb6272ddea225133ffd", "type": "domain", "value": "222.222.67.208.in-addr.arpa", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 37, "frame_number": 1816, "display_filter": "frame.number == 1816", "timestamp_epoch": "1555346658.362882000" }, { "udp_stream": 37, "frame_number": 1817, "display_filter": "frame.number == 1817", "timestamp_epoch": "1555346658.385660000" } ], "roles": [ "dns-query" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-973ed0f9aabaf51bc047f472", "type": "domain", "value": "adsfinder.xyz", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:06.036890+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:05.856454+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.854083+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 4919, "display_filter": "frame.number == 4919", "timestamp_epoch": "1555363460.580569000" }, { "udp_stream": 81, "frame_number": 4920, "display_filter": "frame.number == 4920", "timestamp_epoch": "1555363460.619298000" }, { "udp_stream": 97, "frame_number": 10429, "display_filter": "frame.number == 10429", "timestamp_epoch": "1555365860.610855000" }, { "udp_stream": 97, "frame_number": 10430, "display_filter": "frame.number == 10430", "timestamp_epoch": "1555365860.644759000" }, { "tcp_stream": 198, "frame_number": 4924, "display_filter": "frame.number == 4924", "timestamp_epoch": "1555363460.745329000" }, { "tcp_stream": 199, "frame_number": 4946, "display_filter": "frame.number == 4946", "timestamp_epoch": "1555363484.760068000" }, { "tcp_stream": 210, "frame_number": 9987, "display_filter": "frame.number == 9987", "timestamp_epoch": "1555363784.777427000" }, { "tcp_stream": 211, "frame_number": 10002, "display_filter": "frame.number == 10002", "timestamp_epoch": "1555363830.695237000" }, { "tcp_stream": 231, "frame_number": 10434, "display_filter": "frame.number == 10434", "timestamp_epoch": "1555365860.792339000" }, { "tcp_stream": 232, "frame_number": 10449, "display_filter": "frame.number == 10449", "timestamp_epoch": "1555365899.132405000" }, { "tcp_stream": 234, "frame_number": 10500, "display_filter": "frame.number == 10500", "timestamp_epoch": "1555366199.138972000" }, { "tcp_stream": 235, "frame_number": 10523, "display_filter": "frame.number == 10523", "timestamp_epoch": "1555366460.751004000" }, { "tcp_stream": 236, "frame_number": 10538, "display_filter": "frame.number == 10538", "timestamp_epoch": "1555366499.147301000" }, { "tcp_stream": 237, "frame_number": 10571, "display_filter": "frame.number == 10571", "timestamp_epoch": "1555366799.150078000" }, { "tcp_stream": 239, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1555367060.759693000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:05.852254+00:00" }, { "observable_id": "observable-304e658ebee8d5c67c0a9c09", "type": "domain", "value": "api.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 1253, "display_filter": "frame.number == 1253", "timestamp_epoch": "1555346589.777190000" }, { "udp_stream": 31, "frame_number": 1255, "display_filter": "frame.number == 1255", "timestamp_epoch": "1555346589.786325000" }, { "udp_stream": 31, "frame_number": 1263, "display_filter": "frame.number == 1263", "timestamp_epoch": "1555346589.804161000" }, { "udp_stream": 29, "frame_number": 1264, "display_filter": "frame.number == 1264", "timestamp_epoch": "1555346589.804242000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-734faaf2788fe052f5de032f", "type": "domain", "value": "dns.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 23, "frame_number": 565, "display_filter": "frame.number == 565", "timestamp_epoch": "1555346534.015562000" }, { "udp_stream": 23, "frame_number": 566, "display_filter": "frame.number == 566", "timestamp_epoch": "1555346534.042221000" }, { "udp_stream": 24, "frame_number": 567, "display_filter": "frame.number == 567", "timestamp_epoch": "1555346534.042568000" }, { "udp_stream": 24, "frame_number": 568, "display_filter": "frame.number == 568", "timestamp_epoch": "1555346534.067372000" }, { "udp_stream": 61, "frame_number": 3307, "display_filter": "frame.number == 3307", "timestamp_epoch": "1555354244.532374000" }, { "udp_stream": 61, "frame_number": 3308, "display_filter": "frame.number == 3308", "timestamp_epoch": "1555354244.556414000" }, { "udp_stream": 62, "frame_number": 3309, "display_filter": "frame.number == 3309", "timestamp_epoch": "1555354244.557459000" }, { "udp_stream": 62, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1555354244.578449000" }, { "udp_stream": 62, "frame_number": 3311, "display_filter": "frame.number == 3311", "timestamp_epoch": "1555354244.578618000" }, { "udp_stream": 62, "frame_number": 3312, "display_filter": "frame.number == 3312", "timestamp_epoch": "1555354244.578811000" }, { "udp_stream": 78, "frame_number": 4358, "display_filter": "frame.number == 4358", "timestamp_epoch": "1555359604.529776000" }, { "udp_stream": 78, "frame_number": 4359, "display_filter": "frame.number == 4359", "timestamp_epoch": "1555359604.557420000" }, { "udp_stream": 79, "frame_number": 4360, "display_filter": "frame.number == 4360", "timestamp_epoch": "1555359604.557969000" }, { "udp_stream": 79, "frame_number": 4361, "display_filter": "frame.number == 4361", "timestamp_epoch": "1555359604.579475000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-25a35dcc8aa69a7d2bf4bd8a", "type": "domain", "value": "iecvlist.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:06.042247+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:00.584505+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.038726+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 35, "frame_number": 1680, "display_filter": "frame.number == 1680", "timestamp_epoch": "1555346616.038986000" }, { "udp_stream": 35, "frame_number": 1681, "display_filter": "frame.number == 1681", "timestamp_epoch": "1555346616.090612000" }, { "tcp_stream": 50, "frame_number": 1688, "display_filter": "frame.number == 1688", "timestamp_epoch": "1555346616.136011000" }, { "tcp_stream": 51, "frame_number": 1689, "display_filter": "frame.number == 1689", "timestamp_epoch": "1555346616.136095000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:06.036923+00:00" }, { "observable_id": "observable-533ee2a12484c6327ac38d06", "type": "domain", "value": "isatap.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 18, "frame_number": 250, "display_filter": "frame.number == 250", "timestamp_epoch": "1555346529.885969000" }, { "udp_stream": 18, "frame_number": 251, "display_filter": "frame.number == 251", "timestamp_epoch": "1555346529.886235000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1b2bce32173cce828d112399", "type": "domain", "value": "isatap.stingrayahoy.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 247, "display_filter": "frame.number == 247", "timestamp_epoch": "1555346529.742162000" }, { "udp_stream": 17, "frame_number": 248, "display_filter": "frame.number == 248", "timestamp_epoch": "1555346529.742371000" }, { "udp_stream": 60, "frame_number": 3292, "display_filter": "frame.number == 3292", "timestamp_epoch": "1555354242.372150000" }, { "udp_stream": 60, "frame_number": 3293, "display_filter": "frame.number == 3293", "timestamp_epoch": "1555354242.372458000" }, { "udp_stream": 67, "frame_number": 3323, "display_filter": "frame.number == 3323", "timestamp_epoch": "1555354245.320304000" }, { "udp_stream": 67, "frame_number": 3324, "display_filter": "frame.number == 3324", "timestamp_epoch": "1555354245.320485000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-43289d50096706ce68814ed9", "type": "domain", "value": "ksoniay95ee.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:06.203398+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:06.045805+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.044055+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 1022, "display_filter": "frame.number == 1022", "timestamp_epoch": "1555346586.179739000" }, { "udp_stream": 28, "frame_number": 1024, "display_filter": "frame.number == 1024", "timestamp_epoch": "1555346587.185863000" }, { "udp_stream": 28, "frame_number": 1026, "display_filter": "frame.number == 1026", "timestamp_epoch": "1555346588.200720000" }, { "udp_stream": 28, "frame_number": 1027, "display_filter": "frame.number == 1027", "timestamp_epoch": "1555346588.429073000" }, { "tcp_stream": 46, "frame_number": 1032, "display_filter": "frame.number == 1032", "timestamp_epoch": "1555346588.624105000" }, { "tcp_stream": 46, "frame_number": 1314, "display_filter": "frame.number == 1314", "timestamp_epoch": "1555346589.965853000" }, { "tcp_stream": 49, "frame_number": 1329, "display_filter": "frame.number == 1329", "timestamp_epoch": "1555346591.226636000" }, { "tcp_stream": 46, "frame_number": 1669, "display_filter": "frame.number == 1669", "timestamp_epoch": "1555346593.303292000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:06.042269+00:00" }, { "observable_id": "observable-8db76ccc12374aee6cdead55", "type": "domain", "value": "ljeffery54ae.top", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:05.299528+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:05.128021+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.123519+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 663, "display_filter": "frame.number == 663", "timestamp_epoch": "1555346549.360603000" }, { "udp_stream": 27, "frame_number": 664, "display_filter": "frame.number == 664", "timestamp_epoch": "1555346549.748518000" }, { "tcp_stream": 45, "frame_number": 668, "display_filter": "frame.number == 668", "timestamp_epoch": "1555346549.956141000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:05.118647+00:00" }, { "observable_id": "observable-78e0d6e6febd85e8f8ec8fb9", "type": "domain", "value": "myip.opendns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 40, "frame_number": 1822, "display_filter": "frame.number == 1822", "timestamp_epoch": "1555346658.500468000" }, { "udp_stream": 40, "frame_number": 1823, "display_filter": "frame.number == 1823", "timestamp_epoch": "1555346658.525048000" }, { "udp_stream": 41, "frame_number": 1824, "display_filter": "frame.number == 1824", "timestamp_epoch": "1555346658.529168000" }, { "udp_stream": 41, "frame_number": 1825, "display_filter": "frame.number == 1825", "timestamp_epoch": "1555346658.554522000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4eadb7b2d93eb52f21615974", "type": "domain", "value": "myip.opendns.com.stingrayahoy.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 1818, "display_filter": "frame.number == 1818", "timestamp_epoch": "1555346658.386451000" }, { "udp_stream": 38, "frame_number": 1819, "display_filter": "frame.number == 1819", "timestamp_epoch": "1555346658.452204000" }, { "udp_stream": 39, "frame_number": 1820, "display_filter": "frame.number == 1820", "timestamp_epoch": "1555346658.452945000" }, { "udp_stream": 39, "frame_number": 1821, "display_filter": "frame.number == 1821", "timestamp_epoch": "1555346658.499622000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8b3caf22112482a4443a538c", "type": "domain", "value": "parolinos.xyz", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:06.360467+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:06.207035+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.205324+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 10231, "display_filter": "frame.number == 10231", "timestamp_epoch": "1555365260.601857000" }, { "udp_stream": 92, "frame_number": 10232, "display_filter": "frame.number == 10232", "timestamp_epoch": "1555365260.670068000" }, { "udp_stream": 99, "frame_number": 10768, "display_filter": "frame.number == 10768", "timestamp_epoch": "1555368260.642099000" }, { "udp_stream": 99, "frame_number": 10769, "display_filter": "frame.number == 10769", "timestamp_epoch": "1555368260.669941000" }, { "tcp_stream": 221, "frame_number": 10236, "display_filter": "frame.number == 10236", "timestamp_epoch": "1555365260.832179000" }, { "tcp_stream": 222, "frame_number": 10251, "display_filter": "frame.number == 10251", "timestamp_epoch": "1555365299.143211000" }, { "tcp_stream": 246, "frame_number": 10773, "display_filter": "frame.number == 10773", "timestamp_epoch": "1555368260.831257000" }, { "tcp_stream": 247, "frame_number": 10790, "display_filter": "frame.number == 10790", "timestamp_epoch": "1555368320.810353000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:06.203432+00:00" }, { "observable_id": "observable-3e1998ab65b2d3f402f76ce0", "type": "domain", "value": "pompeiiii.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 4345, "display_filter": "frame.number == 4345", "timestamp_epoch": "1555359584.579046000" }, { "udp_stream": 77, "frame_number": 4346, "display_filter": "frame.number == 4346", "timestamp_epoch": "1555359584.630094000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0499b771ad91c19aab2c4526", "type": "domain", "value": "qqtube.club", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:06.513007+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:06.364124+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.362210+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 10045, "display_filter": "frame.number == 10045", "timestamp_epoch": "1555364084.642498000" }, { "udp_stream": 90, "frame_number": 10046, "display_filter": "frame.number == 10046", "timestamp_epoch": "1555364084.673017000" }, { "udp_stream": 98, "frame_number": 10656, "display_filter": "frame.number == 10656", "timestamp_epoch": "1555367420.644013000" }, { "udp_stream": 98, "frame_number": 10657, "display_filter": "frame.number == 10657", "timestamp_epoch": "1555367420.690245000" }, { "tcp_stream": 213, "frame_number": 10050, "display_filter": "frame.number == 10050", "timestamp_epoch": "1555364084.830341000" }, { "tcp_stream": 214, "frame_number": 10065, "display_filter": "frame.number == 10065", "timestamp_epoch": "1555364111.723360000" }, { "tcp_stream": 216, "frame_number": 10118, "display_filter": "frame.number == 10118", "timestamp_epoch": "1555364384.804171000" }, { "tcp_stream": 217, "frame_number": 10144, "display_filter": "frame.number == 10144", "timestamp_epoch": "1555364660.753511000" }, { "tcp_stream": 218, "frame_number": 10159, "display_filter": "frame.number == 10159", "timestamp_epoch": "1555364699.131332000" }, { "tcp_stream": 241, "frame_number": 10661, "display_filter": "frame.number == 10661", "timestamp_epoch": "1555367420.845474000" }, { "tcp_stream": 242, "frame_number": 10685, "display_filter": "frame.number == 10685", "timestamp_epoch": "1555367660.789976000" }, { "tcp_stream": 243, "frame_number": 10702, "display_filter": "frame.number == 10702", "timestamp_epoch": "1555367720.801170000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:06.360500+00:00" }, { "observable_id": "observable-57d03ddbc26b0f1ad914ba19", "type": "domain", "value": "resolver1.opendns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1814, "display_filter": "frame.number == 1814", "timestamp_epoch": "1555346658.335680000" }, { "udp_stream": 36, "frame_number": 1815, "display_filter": "frame.number == 1815", "timestamp_epoch": "1555346658.357872000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-81eee0a02b774df80e14dd49", "type": "domain", "value": "seoul-4a67-pc.stingrayahoy.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:06.777031+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.775061+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 569, "display_filter": "frame.number == 569", "timestamp_epoch": "1555346534.296811000" }, { "udp_stream": 25, "frame_number": 570, "display_filter": "frame.number == 570", "timestamp_epoch": "1555346534.297105000" }, { "udp_stream": 53, "frame_number": 3276, "display_filter": "frame.number == 3276", "timestamp_epoch": "1555354242.021965000" }, { "udp_stream": 53, "frame_number": 3277, "display_filter": "frame.number == 3277", "timestamp_epoch": "1555354242.022327000" }, { "udp_stream": 56, "frame_number": 3282, "display_filter": "frame.number == 3282", "timestamp_epoch": "1555354242.027081000" }, { "udp_stream": 56, "frame_number": 3283, "display_filter": "frame.number == 3283", "timestamp_epoch": "1555354242.027468000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:06.772955+00:00" }, { "observable_id": "observable-65f6862e6f097508befd7717", "type": "domain", "value": "stingrayahoy-dc.stingrayahoy.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:06.945063+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.943296+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 2, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1555346526.221397000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1555346526.221554000" }, { "udp_stream": 16, "frame_number": 245, "display_filter": "frame.number == 245", "timestamp_epoch": "1555346529.737066000" }, { "udp_stream": 16, "frame_number": 246, "display_filter": "frame.number == 246", "timestamp_epoch": "1555346529.737389000" }, { "udp_stream": 44, "frame_number": 2208, "display_filter": "frame.number == 2208", "timestamp_epoch": "1555348326.795358000" }, { "udp_stream": 44, "frame_number": 2209, "display_filter": "frame.number == 2209", "timestamp_epoch": "1555348326.795828000" }, { "udp_stream": 45, "frame_number": 2694, "display_filter": "frame.number == 2694", "timestamp_epoch": "1555351926.908657000" }, { "udp_stream": 45, "frame_number": 2695, "display_filter": "frame.number == 2695", "timestamp_epoch": "1555351926.909196000" }, { "udp_stream": 66, "frame_number": 3319, "display_filter": "frame.number == 3319", "timestamp_epoch": "1555354245.318201000" }, { "udp_stream": 66, "frame_number": 3320, "display_filter": "frame.number == 3320", "timestamp_epoch": "1555354245.318350000" }, { "udp_stream": 68, "frame_number": 3858, "display_filter": "frame.number == 3858", "timestamp_epoch": "1555357902.216762000" }, { "udp_stream": 68, "frame_number": 3859, "display_filter": "frame.number == 3859", "timestamp_epoch": "1555357902.217020000" }, { "udp_stream": 80, "frame_number": 4622, "display_filter": "frame.number == 4622", "timestamp_epoch": "1555361502.329425000" }, { "udp_stream": 80, "frame_number": 4623, "display_filter": "frame.number == 4623", "timestamp_epoch": "1555361502.329738000" }, { "udp_stream": 91, "frame_number": 10205, "display_filter": "frame.number == 10205", "timestamp_epoch": "1555365102.443185000" }, { "udp_stream": 91, "frame_number": 10206, "display_filter": "frame.number == 10206", "timestamp_epoch": "1555365102.443467000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:06.941197+00:00" }, { "observable_id": "observable-9508fd00e6d2279f31aedf62", "type": "domain", "value": "stingrayahoy.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:05.666346+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:05.496555+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.494749+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 571, "display_filter": "frame.number == 571", "timestamp_epoch": "1555346534.298446000" }, { "udp_stream": 26, "frame_number": 572, "display_filter": "frame.number == 572", "timestamp_epoch": "1555346534.299123000" }, { "udp_stream": 55, "frame_number": 3280, "display_filter": "frame.number == 3280", "timestamp_epoch": "1555354242.024466000" }, { "udp_stream": 55, "frame_number": 3281, "display_filter": "frame.number == 3281", "timestamp_epoch": "1555354242.025714000" }, { "udp_stream": 57, "frame_number": 3284, "display_filter": "frame.number == 3284", "timestamp_epoch": "1555354242.028227000" }, { "udp_stream": 57, "frame_number": 3285, "display_filter": "frame.number == 3285", "timestamp_epoch": "1555354242.029222000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:05.491093+00:00" }, { "observable_id": "observable-da39e81f14aa5f90299baf76", "type": "domain", "value": "wpad.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 83, "frame_number": 5371, "display_filter": "frame.number == 5371", "timestamp_epoch": "1555363518.814523000" }, { "udp_stream": 83, "frame_number": 5375, "display_filter": "frame.number == 5375", "timestamp_epoch": "1555363518.842569000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-02fd1eda22ce8ab91e587625", "type": "domain", "value": "wpad.stingrayahoy.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 14, "frame_number": 239, "display_filter": "frame.number == 239", "timestamp_epoch": "1555346529.296617000" }, { "udp_stream": 14, "frame_number": 240, "display_filter": "frame.number == 240", "timestamp_epoch": "1555346529.296857000" }, { "udp_stream": 64, "frame_number": 3316, "display_filter": "frame.number == 3316", "timestamp_epoch": "1555354245.317477000" }, { "udp_stream": 64, "frame_number": 3317, "display_filter": "frame.number == 3317", "timestamp_epoch": "1555354245.317662000" }, { "udp_stream": 82, "frame_number": 5369, "display_filter": "frame.number == 5369", "timestamp_epoch": "1555363518.813733000" }, { "udp_stream": 82, "frame_number": 5370, "display_filter": "frame.number == 5370", "timestamp_epoch": "1555363518.814081000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-df7ac7d989402d8d4676efc1", "type": "domain", "value": "www.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 1254, "display_filter": "frame.number == 1254", "timestamp_epoch": "1555346589.785106000" }, { "udp_stream": 32, "frame_number": 1256, "display_filter": "frame.number == 1256", "timestamp_epoch": "1555346589.787265000" }, { "udp_stream": 33, "frame_number": 1257, "display_filter": "frame.number == 1257", "timestamp_epoch": "1555346589.787594000" }, { "udp_stream": 34, "frame_number": 1258, "display_filter": "frame.number == 1258", "timestamp_epoch": "1555346589.788166000" }, { "udp_stream": 32, "frame_number": 1265, "display_filter": "frame.number == 1265", "timestamp_epoch": "1555346589.847335000" }, { "udp_stream": 33, "frame_number": 1266, "display_filter": "frame.number == 1266", "timestamp_epoch": "1555346589.847476000" }, { "udp_stream": 34, "frame_number": 1267, "display_filter": "frame.number == 1267", "timestamp_epoch": "1555346589.847567000" }, { "udp_stream": 30, "frame_number": 1268, "display_filter": "frame.number == 1268", "timestamp_epoch": "1555346589.847659000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a3fdf06e1306b156bbf35e32", "type": "domain", "value": "www.download.windowsupdate.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:30.124643+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.600395+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 1843, "display_filter": "frame.number == 1843", "timestamp_epoch": "1555346659.484357000" }, { "udp_stream": 43, "frame_number": 1844, "display_filter": "frame.number == 1844", "timestamp_epoch": "1555346659.532735000" }, { "tcp_stream": 57, "frame_number": 1848, "display_filter": "frame.number == 1848", "timestamp_epoch": "1555346659.556595000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:06.597686+00:00" }, { "observable_id": "observable-c38832e8f381499048f77541", "type": "domain", "value": "www.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.604183+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 397, "display_filter": "frame.number == 397", "timestamp_epoch": "1555346531.866514000" }, { "udp_stream": 22, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1555346531.908365000" }, { "tcp_stream": 28, "frame_number": 402, "display_filter": "frame.number == 402", "timestamp_epoch": "1555346531.941203000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:06.602427+00:00" }, { "observable_id": "observable-c8787c4f9169e5f9a98e5855", "type": "domain", "value": "zindv.club", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:06.609304+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.607630+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 1827, "display_filter": "frame.number == 1827", "timestamp_epoch": "1555346658.623534000" }, { "udp_stream": 42, "frame_number": 1830, "display_filter": "frame.number == 1830", "timestamp_epoch": "1555346658.882999000" }, { "tcp_stream": 56, "frame_number": 1834, "display_filter": "frame.number == 1834", "timestamp_epoch": "1555346659.077320000" }, { "tcp_stream": 58, "frame_number": 1916, "display_filter": "frame.number == 1916", "timestamp_epoch": "1555346660.499057000" }, { "tcp_stream": 60, "frame_number": 1944, "display_filter": "frame.number == 1944", "timestamp_epoch": "1555346672.224837000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:06.605994+00:00" }, { "observable_id": "observable-9a490fbc18c7564c56753ccc", "type": "ipv4", "value": "10.0.90.175", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 571, "display_filter": "frame.number == 571", "timestamp_epoch": "1555346534.298446000" }, { "udp_stream": 26, "frame_number": 572, "display_filter": "frame.number == 572", "timestamp_epoch": "1555346534.299123000" }, { "udp_stream": 55, "frame_number": 3280, "display_filter": "frame.number == 3280", "timestamp_epoch": "1555354242.024466000" }, { "udp_stream": 55, "frame_number": 3281, "display_filter": "frame.number == 3281", "timestamp_epoch": "1555354242.025714000" }, { "udp_stream": 57, "frame_number": 3284, "display_filter": "frame.number == 3284", "timestamp_epoch": "1555354242.028227000" }, { "udp_stream": 57, "frame_number": 3285, "display_filter": "frame.number == 3285", "timestamp_epoch": "1555354242.029222000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-df6e5ccd8ff219e1739df82f", "type": "ipv4", "value": "10.0.90.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a2358737e244d3d98e7f9f07", "type": "ipv4", "value": "10.0.90.9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1555346526.219414000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1555346526.221554000" }, { "udp_stream": 5, "frame_number": 80, "display_filter": "frame.number == 80", "timestamp_epoch": "1555346526.415189000" }, { "udp_stream": 7, "frame_number": 135, "display_filter": "frame.number == 135", "timestamp_epoch": "1555346526.467039000" }, { "udp_stream": 9, "frame_number": 153, "display_filter": "frame.number == 153", "timestamp_epoch": "1555346526.522279000" }, { "udp_stream": 16, "frame_number": 246, "display_filter": "frame.number == 246", "timestamp_epoch": "1555346529.737389000" }, { "udp_stream": 25, "frame_number": 570, "display_filter": "frame.number == 570", "timestamp_epoch": "1555346534.297105000" }, { "udp_stream": 44, "frame_number": 2209, "display_filter": "frame.number == 2209", "timestamp_epoch": "1555348326.795828000" }, { "udp_stream": 45, "frame_number": 2695, "display_filter": "frame.number == 2695", "timestamp_epoch": "1555351926.909196000" }, { "udp_stream": 53, "frame_number": 3277, "display_filter": "frame.number == 3277", "timestamp_epoch": "1555354242.022327000" }, { "udp_stream": 56, "frame_number": 3283, "display_filter": "frame.number == 3283", "timestamp_epoch": "1555354242.027468000" }, { "udp_stream": 66, "frame_number": 3320, "display_filter": "frame.number == 3320", "timestamp_epoch": "1555354245.318350000" }, { "udp_stream": 68, "frame_number": 3859, "display_filter": "frame.number == 3859", "timestamp_epoch": "1555357902.217020000" }, { "udp_stream": 80, "frame_number": 4623, "display_filter": "frame.number == 4623", "timestamp_epoch": "1555361502.329738000" }, { "udp_stream": 91, "frame_number": 10206, "display_filter": "frame.number == 10206", "timestamp_epoch": "1555365102.443467000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b65475c00612dd73913539f5", "type": "ipv4", "value": "104.73.85.137", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:07.101570+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.099714+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 1844, "display_filter": "frame.number == 1844", "timestamp_epoch": "1555346659.532735000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:07.097195+00:00" }, { "observable_id": "observable-aa8dce43359dcabe9d229aca", "type": "ipv4", "value": "109.230.199.24", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:07.294230+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.290369+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 10046, "display_filter": "frame.number == 10046", "timestamp_epoch": "1555364084.673017000" }, { "udp_stream": 98, "frame_number": 10657, "display_filter": "frame.number == 10657", "timestamp_epoch": "1555367420.690245000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:07.286137+00:00" }, { "observable_id": "observable-0778661b7354dcb57371f80f", "type": "ipv4", "value": "13.107.21.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1265, "display_filter": "frame.number == 1265", "timestamp_epoch": "1555346589.847335000" }, { "udp_stream": 33, "frame_number": 1266, "display_filter": "frame.number == 1266", "timestamp_epoch": "1555346589.847476000" }, { "udp_stream": 34, "frame_number": 1267, "display_filter": "frame.number == 1267", "timestamp_epoch": "1555346589.847567000" }, { "udp_stream": 30, "frame_number": 1268, "display_filter": "frame.number == 1268", "timestamp_epoch": "1555346589.847659000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-13221cbca850a18dbb14d812", "type": "ipv4", "value": "13.107.5.80", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 1263, "display_filter": "frame.number == 1263", "timestamp_epoch": "1555346589.804161000" }, { "udp_stream": 29, "frame_number": 1264, "display_filter": "frame.number == 1264", "timestamp_epoch": "1555346589.804242000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-17b4c0d151c761d388141b36", "type": "ipv4", "value": "131.107.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 23, "frame_number": 566, "display_filter": "frame.number == 566", "timestamp_epoch": "1555346534.042221000" }, { "udp_stream": 61, "frame_number": 3308, "display_filter": "frame.number == 3308", "timestamp_epoch": "1555354244.556414000" }, { "udp_stream": 78, "frame_number": 4359, "display_filter": "frame.number == 4359", "timestamp_epoch": "1555359604.557420000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6779869cb4ecfa828618a43c", "type": "ipv4", "value": "151.106.27.208", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:07.491322+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.487064+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 59, "frame_number": 1931, "display_filter": "frame.number == 1931", "timestamp_epoch": "1555346661.898719000" }, { "tcp_stream": 63, "frame_number": 1994, "display_filter": "frame.number == 1994", "timestamp_epoch": "1555346969.613910000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:07.481964+00:00" }, { "observable_id": "observable-b8b09d6c335fe97496ace2ae", "type": "ipv4", "value": "162.213.250.131", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:07.688239+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.683470+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 200, "frame_number": 4961, "display_filter": "frame.number == 4961", "timestamp_epoch": "1555363492.940707000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:07.678841+00:00" }, { "observable_id": "observable-b7d052195e235aef50e34b3c", "type": "ipv4", "value": "173.166.146.112", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 40, "frame_number": 1823, "display_filter": "frame.number == 1823", "timestamp_epoch": "1555346658.525048000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9d2c0d8bfd7402ed90ee0297", "type": "ipv4", "value": "176.10.125.110", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:07.868294+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.866311+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 10232, "display_filter": "frame.number == 10232", "timestamp_epoch": "1555365260.670068000" }, { "udp_stream": 99, "frame_number": 10769, "display_filter": "frame.number == 10769", "timestamp_epoch": "1555368260.669941000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:07.864198+00:00" }, { "observable_id": "observable-3b1027c90f92330a1b0aa5a2", "type": "ipv4", "value": "185.136.169.160", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:08.217965+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:08.213551+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:08.208578+00:00" }, { "observable_id": "observable-b66a61221a689fadcbb4e20d", "type": "ipv4", "value": "185.139.69.88", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:08.412424+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:08.407921+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 1830, "display_filter": "frame.number == 1830", "timestamp_epoch": "1555346658.882999000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:08.403356+00:00" }, { "observable_id": "observable-9864ae4555d111f35bbb8336", "type": "ipv4", "value": "185.158.249.39", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:08.617118+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:08.612237+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 4920, "display_filter": "frame.number == 4920", "timestamp_epoch": "1555363460.619298000" }, { "udp_stream": 97, "frame_number": 10430, "display_filter": "frame.number == 10430", "timestamp_epoch": "1555365860.644759000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:08.607458+00:00" }, { "observable_id": "observable-e9b794e2ade21c332d22d14c", "type": "ipv4", "value": "185.212.47.167", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:08.824305+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:08.820214+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:08.815580+00:00" }, { "observable_id": "observable-fe3a78ca441761f253d38a58", "type": "ipv4", "value": "187.188.166.192", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f45ccae72e4fead428dce2b9", "type": "ipv4", "value": "198.54.115.33", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:09.042912+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.038501+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:09.033752+00:00" }, { "observable_id": "observable-1c7330850f53c11c990099df", "type": "ipv4", "value": "198.54.125.57", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:09.254071+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.248451+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:09.243804+00:00" }, { "observable_id": "observable-c62aa3c22ae89e267937b5b0", "type": "ipv4", "value": "204.79.197.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1265, "display_filter": "frame.number == 1265", "timestamp_epoch": "1555346589.847335000" }, { "udp_stream": 33, "frame_number": 1266, "display_filter": "frame.number == 1266", "timestamp_epoch": "1555346589.847476000" }, { "udp_stream": 34, "frame_number": 1267, "display_filter": "frame.number == 1267", "timestamp_epoch": "1555346589.847567000" }, { "udp_stream": 30, "frame_number": 1268, "display_filter": "frame.number == 1268", "timestamp_epoch": "1555346589.847659000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-59a38ba2731498e335e720ba", "type": "ipv4", "value": "208.67.222.222", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1815, "display_filter": "frame.number == 1815", "timestamp_epoch": "1555346658.357872000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8da99076a957ef470de13b9f", "type": "ipv4", "value": "208.91.197.91", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 4346, "display_filter": "frame.number == 4346", "timestamp_epoch": "1555359584.630094000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1b06848b717dc16908c7f27a", "type": "ipv4", "value": "216.98.148.157", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0e0b987cd109a540f386dde9", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-921ae84174f5b120581b750c", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ef1f3fe4e1b03e9d256ba206", "type": "ipv4", "value": "23.218.156.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:09.441120+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.438008+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1555346531.908365000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:09.434532+00:00" }, { "observable_id": "observable-3375dbb4cc2d032431e5a3f6", "type": "ipv4", "value": "23.218.156.26", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1555346531.908365000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cdc58e67c013b2990401556f", "type": "ipv4", "value": "255.255.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-812eae481da70d82b14c7682", "type": "ipv4", "value": "37.230.112.226", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:09.644478+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.639614+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 1027, "display_filter": "frame.number == 1027", "timestamp_epoch": "1555346588.429073000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:09.634654+00:00" }, { "observable_id": "observable-7d75a80d1beb088d42d28140", "type": "ipv4", "value": "68.65.122.52", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:09.884537+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.879169+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:09.874541+00:00" }, { "observable_id": "observable-aaafbf8b586ae6e0f9ed0420", "type": "ipv4", "value": "72.21.81.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:35.712902+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:10.078639+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 35, "frame_number": 1681, "display_filter": "frame.number == 1681", "timestamp_epoch": "1555346616.090612000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:10.072928+00:00" }, { "observable_id": "observable-e0be17e02f5cbab96002fb71", "type": "ipv4", "value": "85.114.134.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:05.852219+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:05.669859+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.668131+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 201, "frame_number": 5380, "display_filter": "frame.number == 5380", "timestamp_epoch": "1555363518.972098000" }, { "tcp_stream": 201, "frame_number": 9830, "display_filter": "frame.number == 9830", "timestamp_epoch": "1555363524.078960000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:05.666377+00:00" }, { "observable_id": "observable-92e075b5d6c7750a77b0eabf", "type": "ipv4", "value": "89.163.144.224", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:10.224935+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:10.221815+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 196, "frame_number": 4880, "display_filter": "frame.number == 4880", "timestamp_epoch": "1555363185.829368000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:10.218364+00:00" }, { "observable_id": "observable-e00eb74b5fcb5654048f5a1b", "type": "ipv4", "value": "91.240.87.19", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:05.491013+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:05.305056+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.301865+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 664, "display_filter": "frame.number == 664", "timestamp_epoch": "1555346549.748518000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:05.299564+00:00" }, { "observable_id": "observable-07a1e011d4ea98560a4ec537", "type": "ipv6", "value": "fd3e:4f5a:5b81::1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 568, "display_filter": "frame.number == 568", "timestamp_epoch": "1555346534.067372000" }, { "udp_stream": 62, "frame_number": 3310, "display_filter": "frame.number == 3310", "timestamp_epoch": "1555354244.578449000" }, { "udp_stream": 62, "frame_number": 3312, "display_filter": "frame.number == 3312", "timestamp_epoch": "1555354244.578811000" }, { "udp_stream": 79, "frame_number": 4361, "display_filter": "frame.number == 4361", "timestamp_epoch": "1555359604.579475000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6fb32d0d83115116e5a5442f", "type": "sha256", "value": "2c60e1e69aeca03fb562c0597bd404df118151e6782d7cfefcbcefb5a1505d21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d799506e11093ec0f177b558", "type": "sha256", "value": "4017ffd0c17a9fbaebd74c6b75b6e8898d53ce401f16a64881bd0ee5837f6591", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-821c403ab7bfd3c1c24042d2", "type": "sha256", "value": "4c9c4d831d61c8c38b2513f9b431ef4f4cf6af9fb18a2317cd2178d6e0997822", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0c7ba6e27063fea3320330de", "type": "sha256", "value": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "classification": "provider-reported-malicious", "ioc_candidate": true, "reasons": [], "signals": [ { "basis": "Exact typed artifact match in malwarebazaar", "actors": [], "source": "malwarebazaar", "status": "ok", "verdict": "provider-reported-malicious", "evidence": { "records": [ { "md5_hash": "3abe239c43ad55054578884f6a796ba5", "last_seen": null, "sha1_hash": "890292f25372e6e896a9f600685e7a61854e95bf", "signature": "Gozi", "first_seen": "2022-04-20 16:52:23", "sha256_hash": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2" } ] }, "cache_hit": false, "queried_at": "2026-09-22T17:47:04.432229+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "target": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "evidence": "malwarebazaar field sha256_hash", "target_type": "hash", "evidence_source": "malwarebazaar" }, { "tier": 1, "source": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "target": "890292f25372e6e896a9f600685e7a61854e95bf", "evidence": "malwarebazaar field sha1_hash", "target_type": "hash", "evidence_source": "malwarebazaar" }, { "tier": 1, "source": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "target": "3abe239c43ad55054578884f6a796ba5", "evidence": "malwarebazaar field md5_hash", "target_type": "hash", "evidence_source": "malwarebazaar" }, { "tier": 1, "source": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "target": "ra3.php%3fq=cupf7.svg", "evidence": "malwarebazaar field file_name", "target_type": "file", "evidence_source": "malwarebazaar" } ] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:04.229971+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:04.226175+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:04.221444+00:00" }, { "observable_id": "observable-8b272da56dc36bb848a3892d", "type": "sha256", "value": "565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2536b65e4486936f06ce8b1d", "type": "sha256", "value": "5f1ea837b7530af44e85e0198beab49e0f2cf9e60a75d76c044313985de822ff", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ef1031c9037edd8b13bc1528", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ececc5f341fee35f3d769e5c", "type": "sha256", "value": "637ccbba391788d61f87d86caf06bdd4c6c03c43aa9386c42bdf2543a072619c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-edfa92dc5a61bb051ecbc621", "type": "sha256", "value": "6aed702963283420db151840cb48374f6c48b4f9dc933f7a6c9fdb1d77ce88e1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac0cf83eadde1b26f6d83186", "type": "sha256", "value": "6d48f7ed8bafb7e147b7438a21362220adcc24e83a4f9942f6ccf9c09b3b4b02", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-32c6af13d180aca6598d65b8", "type": "sha256", "value": "91cba2f5400a35c849783d307e016002144c96c9ee817b7a375e225c57b1ff80", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e208de6495437c5b2853e934", "type": "sha256", "value": "aa2f524d89ce598b990d3c8cd74cdc31cfaa9a7c6a63596b0e5b394dc7ede10b", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f52d488cc49f094c9f5e666b", "type": "sha256", "value": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-26ccec27b14daecd7584801c", "type": "sha256", "value": "f07dbc57bb41792248061012e6479b00ba046d6631e1734bdbbd01bc421ecba4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ed13661f424f3db782f869cd", "type": "url", "value": "http://151.106.27.208/client.rar", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 59, "frame_number": 1931, "display_filter": "frame.number == 1931", "timestamp_epoch": "1555346661.898719000" }, { "tcp_stream": 63, "frame_number": 1994, "display_filter": "frame.number == 1994", "timestamp_epoch": "1555346969.613910000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6278f3fc025b77de4e80b760", "type": "url", "value": "http://162.213.250.131/azor.rar", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 200, "frame_number": 4961, "display_filter": "frame.number == 4961", "timestamp_epoch": "1555363492.940707000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7ee22136efb4c908cc542dda", "type": "url", "value": "http://85.114.134.49/index.php", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 201, "frame_number": 5380, "display_filter": "frame.number == 5380", "timestamp_epoch": "1555363518.972098000" }, { "tcp_stream": 201, "frame_number": 9830, "display_filter": "frame.number == 9830", "timestamp_epoch": "1555363524.078960000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf55b4f165cd11883dd25206", "type": "url", "value": "http://89.163.144.224/klansfuuerifneiferunfasd/modules/client.rar", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 196, "frame_number": 4880, "display_filter": "frame.number == 4880", "timestamp_epoch": "1555363185.829368000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a87f4b6ce655a40f90ba9c4d", "type": "url", "value": "http://ksoniay95ee.info/favicon.ico", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 46, "frame_number": 1314, "display_filter": "frame.number == 1314", "timestamp_epoch": "1555346589.965853000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a608dd760b5026bb4bc700e0", "type": "url", "value": "http://ksoniay95ee.info/images/CI9BVzd6AqB/ZNUmRFBAKmX4q_/2FIAs9nQJlVF7_2BTvRU5/ZPqTgOgLDp8JzrCL/_2Fcm_2BF41yLbk/eclytPd8CmogXhag5f/iJKuzzkmf/M1zwJZUnnnK6LJcptL1S/m6Hl99BQ3fNUdtPt9So/0Zzs4gdqrhrs/_2FJr.avi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 46, "frame_number": 1032, "display_filter": "frame.number == 1032", "timestamp_epoch": "1555346588.624105000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f218ba951a528cba9b7a9b41", "type": "url", "value": "http://ksoniay95ee.info/images/k1bBds2o/QmLUr43VFSfi6mVN0k_2Fri/aRq5qJ_2Bb/9pn_2FrlWUAEwA3DA/8_2BlKV4KDN_/2B_2BLZHLEa/vLvK_2F5G0A625/hGoDuTo8Bf7h2KRBD9vOP/gcTRbqx7bC5Q89C6/6YYly9yOp3zpx2r/BwphZTlcwHbBf1/hYP.avi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 46, "frame_number": 1669, "display_filter": "frame.number == 1669", "timestamp_epoch": "1555346593.303292000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-daf76f9c39bceaff24525233", "type": "url", "value": "http://ksoniay95ee.info/images/zqt4lIX7/WURokuO9vh89Yy_2BsUJrS9/PjffqPwJdE/ySWjXv6UbPaKFMooy/6X5boj6wckcc/Ucw3dM3Mi_2/FznVDXGp2L3Py2/JxFQvMX4xN_2FzOJs9Vmk/BMKiWvw71S3sGLtJ/XPIlWh5f6mD5BYu/asfVMoi7/c.avi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 49, "frame_number": 1329, "display_filter": "frame.number == 1329", "timestamp_epoch": "1555346591.226636000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ff547aac41d098b891432d3e", "type": "url", "value": "http://ljeffery54ae.top/skoex/po2.php?l=cupk6.fgs", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 45, "frame_number": 668, "display_filter": "frame.number == 668", "timestamp_epoch": "1555346549.956141000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e9001539262325ec335ba026", "type": "url", "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 57, "frame_number": 1848, "display_filter": "frame.number == 1848", "timestamp_epoch": "1555346659.556595000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac90fdc134ba454c14b6d9ae", "type": "url", "value": "http://www.msftncsi.com/ncsi.txt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 28, "frame_number": 402, "display_filter": "frame.number == 402", "timestamp_epoch": "1555346531.941203000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 83, "provider-reported-malicious": 1 }, "ioc_candidate_count": 1, "summary": "84 typed observations; 1 evidence-backed IOC candidates for review, including 1 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-6fb32d0d83115116e5a5442f", "type": "sha256", "value": "2c60e1e69aeca03fb562c0597bd404df118151e6782d7cfefcbcefb5a1505d21", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d799506e11093ec0f177b558", "type": "sha256", "value": "4017ffd0c17a9fbaebd74c6b75b6e8898d53ce401f16a64881bd0ee5837f6591", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-821c403ab7bfd3c1c24042d2", "type": "sha256", "value": "4c9c4d831d61c8c38b2513f9b431ef4f4cf6af9fb18a2317cd2178d6e0997822", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8b272da56dc36bb848a3892d", "type": "sha256", "value": "565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2536b65e4486936f06ce8b1d", "type": "sha256", "value": "5f1ea837b7530af44e85e0198beab49e0f2cf9e60a75d76c044313985de822ff", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef1031c9037edd8b13bc1528", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ececc5f341fee35f3d769e5c", "type": "sha256", "value": "637ccbba391788d61f87d86caf06bdd4c6c03c43aa9386c42bdf2543a072619c", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-edfa92dc5a61bb051ecbc621", "type": "sha256", "value": "6aed702963283420db151840cb48374f6c48b4f9dc933f7a6c9fdb1d77ce88e1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ac0cf83eadde1b26f6d83186", "type": "sha256", "value": "6d48f7ed8bafb7e147b7438a21362220adcc24e83a4f9942f6ccf9c09b3b4b02", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-32c6af13d180aca6598d65b8", "type": "sha256", "value": "91cba2f5400a35c849783d307e016002144c96c9ee817b7a375e225c57b1ff80", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e208de6495437c5b2853e934", "type": "sha256", "value": "aa2f524d89ce598b990d3c8cd74cdc31cfaa9a7c6a63596b0e5b394dc7ede10b", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f52d488cc49f094c9f5e666b", "type": "sha256", "value": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-26ccec27b14daecd7584801c", "type": "sha256", "value": "f07dbc57bb41792248061012e6479b00ba046d6631e1734bdbbd01bc421ecba4", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-304e658ebee8d5c67c0a9c09", "type": "domain", "value": "api.bing.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-734faaf2788fe052f5de032f", "type": "domain", "value": "dns.msftncsi.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-533ee2a12484c6327ac38d06", "type": "domain", "value": "isatap.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1b2bce32173cce828d112399", "type": "domain", "value": "isatap.stingrayahoy.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-78e0d6e6febd85e8f8ec8fb9", "type": "domain", "value": "myip.opendns.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4eadb7b2d93eb52f21615974", "type": "domain", "value": "myip.opendns.com.stingrayahoy.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3e1998ab65b2d3f402f76ce0", "type": "domain", "value": "pompeiiii.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-57d03ddbc26b0f1ad914ba19", "type": "domain", "value": "resolver1.opendns.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-da39e81f14aa5f90299baf76", "type": "domain", "value": "wpad.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-02fd1eda22ce8ab91e587625", "type": "domain", "value": "wpad.stingrayahoy.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-df7ac7d989402d8d4676efc1", "type": "domain", "value": "www.bing.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0778661b7354dcb57371f80f", "type": "ipv4", "value": "13.107.21.200", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-13221cbca850a18dbb14d812", "type": "ipv4", "value": "13.107.5.80", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-17b4c0d151c761d388141b36", "type": "ipv4", "value": "131.107.255.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b7d052195e235aef50e34b3c", "type": "ipv4", "value": "173.166.146.112", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fe3a78ca441761f253d38a58", "type": "ipv4", "value": "187.188.166.192", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c62aa3c22ae89e267937b5b0", "type": "ipv4", "value": "204.79.197.200", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-59a38ba2731498e335e720ba", "type": "ipv4", "value": "208.67.222.222", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8da99076a957ef470de13b9f", "type": "ipv4", "value": "208.91.197.91", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1b06848b717dc16908c7f27a", "type": "ipv4", "value": "216.98.148.157", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3375dbb4cc2d032431e5a3f6", "type": "ipv4", "value": "23.218.156.26", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0c7ba6e27063fea3320330de", "type": "sha256", "value": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "priority": 100, "reasons": [ "existing-evidence-candidate", "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-8db76ccc12374aee6cdead55", "type": "domain", "value": "ljeffery54ae.top", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e00eb74b5fcb5654048f5a1b", "type": "ipv4", "value": "91.240.87.19", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9508fd00e6d2279f31aedf62", "type": "domain", "value": "stingrayahoy.com", "priority": 60, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e0be17e02f5cbab96002fb71", "type": "ipv4", "value": "85.114.134.49", "priority": 60, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-973ed0f9aabaf51bc047f472", "type": "domain", "value": "adsfinder.xyz", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-25a35dcc8aa69a7d2bf4bd8a", "type": "domain", "value": "iecvlist.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-43289d50096706ce68814ed9", "type": "domain", "value": "ksoniay95ee.info", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8b3caf22112482a4443a538c", "type": "domain", "value": "parolinos.xyz", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0499b771ad91c19aab2c4526", "type": "domain", "value": "qqtube.club", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a3fdf06e1306b156bbf35e32", "type": "domain", "value": "www.download.windowsupdate.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c38832e8f381499048f77541", "type": "domain", "value": "www.msftncsi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c8787c4f9169e5f9a98e5855", "type": "domain", "value": "zindv.club", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-81eee0a02b774df80e14dd49", "type": "domain", "value": "seoul-4a67-pc.stingrayahoy.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-65f6862e6f097508befd7717", "type": "domain", "value": "stingrayahoy-dc.stingrayahoy.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b65475c00612dd73913539f5", "type": "ipv4", "value": "104.73.85.137", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aa8dce43359dcabe9d229aca", "type": "ipv4", "value": "109.230.199.24", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6779869cb4ecfa828618a43c", "type": "ipv4", "value": "151.106.27.208", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b8b09d6c335fe97496ace2ae", "type": "ipv4", "value": "162.213.250.131", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9d2c0d8bfd7402ed90ee0297", "type": "ipv4", "value": "176.10.125.110", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3b1027c90f92330a1b0aa5a2", "type": "ipv4", "value": "185.136.169.160", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b66a61221a689fadcbb4e20d", "type": "ipv4", "value": "185.139.69.88", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9864ae4555d111f35bbb8336", "type": "ipv4", "value": "185.158.249.39", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e9b794e2ade21c332d22d14c", "type": "ipv4", "value": "185.212.47.167", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f45ccae72e4fead428dce2b9", "type": "ipv4", "value": "198.54.115.33", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1c7330850f53c11c990099df", "type": "ipv4", "value": "198.54.125.57", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef1f3fe4e1b03e9d256ba206", "type": "ipv4", "value": "23.218.156.11", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-812eae481da70d82b14c7682", "type": "ipv4", "value": "37.230.112.226", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7d75a80d1beb088d42d28140", "type": "ipv4", "value": "68.65.122.52", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aaafbf8b586ae6e0f9ed0420", "type": "ipv4", "value": "72.21.81.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-92e075b5d6c7750a77b0eabf", "type": "ipv4", "value": "89.163.144.224", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 65, "next_batch": [ "observable-6fb32d0d83115116e5a5442f", "observable-d799506e11093ec0f177b558", "observable-821c403ab7bfd3c1c24042d2", "observable-8b272da56dc36bb848a3892d", "observable-2536b65e4486936f06ce8b1d", "observable-ef1031c9037edd8b13bc1528", "observable-ececc5f341fee35f3d769e5c", "observable-edfa92dc5a61bb051ecbc621", "observable-ac0cf83eadde1b26f6d83186", "observable-32c6af13d180aca6598d65b8" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "ad14ae51c3f66cbc89ab3442f705b93256a6f178a0dec940d3b8c682f9e63b15" }, "enrichment": { "items": [ { "type": "ipv4", "value": "89.163.144.224", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:10.224935+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:10.221815+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:10.218364+00:00", "observable_id": "observable-92e075b5d6c7750a77b0eabf" }, { "type": "ipv4", "value": "72.21.81.200", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:35.712902+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:10.078639+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:10.072928+00:00", "observable_id": "observable-aaafbf8b586ae6e0f9ed0420" }, { "type": "ipv4", "value": "68.65.122.52", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.884537+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.879169+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:09.874541+00:00", "observable_id": "observable-7d75a80d1beb088d42d28140" }, { "type": "ipv4", "value": "37.230.112.226", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.644478+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.639614+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:09.634654+00:00", "observable_id": "observable-812eae481da70d82b14c7682" }, { "type": "ipv4", "value": "23.218.156.11", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.441120+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.438008+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:09.434532+00:00", "observable_id": "observable-ef1f3fe4e1b03e9d256ba206" }, { "type": "ipv4", "value": "198.54.125.57", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.254071+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.248451+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:09.243804+00:00", "observable_id": "observable-1c7330850f53c11c990099df" }, { "type": "ipv4", "value": "198.54.115.33", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.042912+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:09.038501+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:09.033752+00:00", "observable_id": "observable-f45ccae72e4fead428dce2b9" }, { "type": "ipv4", "value": "185.212.47.167", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:08.824305+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:08.820214+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:08.815580+00:00", "observable_id": "observable-e9b794e2ade21c332d22d14c" }, { "type": "ipv4", "value": "185.158.249.39", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:08.617118+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:08.612237+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:08.607458+00:00", "observable_id": "observable-9864ae4555d111f35bbb8336" }, { "type": "ipv4", "value": "185.139.69.88", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:08.412424+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:08.407921+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:08.403356+00:00", "observable_id": "observable-b66a61221a689fadcbb4e20d" }, { "type": "ipv4", "value": "185.136.169.160", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:08.217965+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:08.213551+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:08.208578+00:00", "observable_id": "observable-3b1027c90f92330a1b0aa5a2" }, { "type": "ipv4", "value": "176.10.125.110", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.868294+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.866311+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:07.864198+00:00", "observable_id": "observable-9d2c0d8bfd7402ed90ee0297" }, { "type": "ipv4", "value": "162.213.250.131", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.688239+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.683470+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:07.678841+00:00", "observable_id": "observable-b8b09d6c335fe97496ace2ae" }, { "type": "ipv4", "value": "151.106.27.208", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.491322+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.487064+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:07.481964+00:00", "observable_id": "observable-6779869cb4ecfa828618a43c" }, { "type": "ipv4", "value": "109.230.199.24", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.294230+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.290369+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:07.286137+00:00", "observable_id": "observable-aa8dce43359dcabe9d229aca" }, { "type": "ipv4", "value": "104.73.85.137", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.101570+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:07.099714+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:07.097195+00:00", "observable_id": "observable-b65475c00612dd73913539f5" }, { "type": "domain", "value": "stingrayahoy-dc.stingrayahoy.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.945063+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.943296+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:06.941197+00:00", "observable_id": "observable-65f6862e6f097508befd7717" }, { "type": "domain", "value": "seoul-4a67-pc.stingrayahoy.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.777031+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.775061+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:06.772955+00:00", "observable_id": "observable-81eee0a02b774df80e14dd49" }, { "type": "domain", "value": "zindv.club", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.609304+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.607630+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:06.605994+00:00", "observable_id": "observable-c8787c4f9169e5f9a98e5855" }, { "type": "domain", "value": "www.msftncsi.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.604183+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:06.602427+00:00", "observable_id": "observable-c38832e8f381499048f77541" }, { "type": "domain", "value": "www.download.windowsupdate.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:30.124643+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.600395+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:06.597686+00:00", "observable_id": "observable-a3fdf06e1306b156bbf35e32" }, { "type": "domain", "value": "qqtube.club", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.513007+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.364124+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.362210+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:06.360500+00:00", "observable_id": "observable-0499b771ad91c19aab2c4526" }, { "type": "domain", "value": "parolinos.xyz", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.360467+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.207035+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.205324+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:06.203432+00:00", "observable_id": "observable-8b3caf22112482a4443a538c" }, { "type": "domain", "value": "ksoniay95ee.info", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.203398+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.045805+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.044055+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:06.042269+00:00", "observable_id": "observable-43289d50096706ce68814ed9" }, { "type": "domain", "value": "iecvlist.microsoft.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.042247+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:00.584505+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.038726+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:06.036923+00:00", "observable_id": "observable-25a35dcc8aa69a7d2bf4bd8a" }, { "type": "domain", "value": "adsfinder.xyz", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:06.036890+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.856454+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.854083+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:05.852254+00:00", "observable_id": "observable-973ed0f9aabaf51bc047f472" }, { "type": "ipv4", "value": "85.114.134.49", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.852219+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.669859+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.668131+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:05.666377+00:00", "observable_id": "observable-e0be17e02f5cbab96002fb71" }, { "type": "domain", "value": "stingrayahoy.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.666346+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.496555+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.494749+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:05.491093+00:00", "observable_id": "observable-9508fd00e6d2279f31aedf62" }, { "type": "ipv4", "value": "91.240.87.19", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.491013+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.305056+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.301865+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:05.299564+00:00", "observable_id": "observable-e00eb74b5fcb5654048f5a1b" }, { "type": "domain", "value": "ljeffery54ae.top", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.299528+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.128021+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:05.123519+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:05.118647+00:00", "observable_id": "observable-8db76ccc12374aee6cdead55" }, { "type": "sha256", "value": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "signals": [ { "basis": "Exact typed artifact match in malwarebazaar", "actors": [], "source": "malwarebazaar", "status": "ok", "verdict": "provider-reported-malicious", "cache_hit": false, "queried_at": "2026-09-22T17:47:04.432229+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "target": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "evidence": "malwarebazaar field sha256_hash", "target_type": "hash", "evidence_source": "malwarebazaar" }, { "tier": 1, "source": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "target": "890292f25372e6e896a9f600685e7a61854e95bf", "evidence": "malwarebazaar field sha1_hash", "target_type": "hash", "evidence_source": "malwarebazaar" }, { "tier": 1, "source": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "target": "3abe239c43ad55054578884f6a796ba5", "evidence": "malwarebazaar field md5_hash", "target_type": "hash", "evidence_source": "malwarebazaar" }, { "tier": 1, "source": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "target": "ra3.php%3fq=cupf7.svg", "evidence": "malwarebazaar field file_name", "target_type": "file", "evidence_source": "malwarebazaar" } ], "evidence_source_sha256": "6f693ebf3593c6049709d87b0e0fcf07a688c8d8062e4d383ff63271a3107f96", "evidence": { "records": [ { "sha256_hash": "50007a82f044a695ec9c1cfcc7a495211061112ea6a927710ebd3e6c4409e3a2", "sha1_hash": "890292f25372e6e896a9f600685e7a61854e95bf", "md5_hash": "3abe239c43ad55054578884f6a796ba5", "signature": "Gozi", "first_seen": "2022-04-20 16:52:23", "last_seen": null } ], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:04.229971+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:04.226175+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:04.221444+00:00", "observable_id": "observable-0c7ba6e27063fea3320330de" } ], "coverage": { "cache_hits": 0, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-92e075b5d6c7750a77b0eabf" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-92e075b5d6c7750a77b0eabf" } ], "batch_targets": 1, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 31, "full_urls_disclosed": 0, "provider_lookups_started": 1 }, "updated_at": "2026-09-22T17:47:10.406659+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "6dd4ab555394e9bd349512a04ecf3e33274872473f8b0f2fdb5a42169f60911b", "source_semantic_sha256": "f31b5bca14bdab1bc44c0c02da4c728a1500276ab131a5fd81499a0d1ec8bc93", "previous_snapshot_sha256": "d1eae18b5c583ce9cdd8ccc8375dbb967e157c62c8894bb6edb294f330a08126" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "tactic": "command-and-control", "confidence": 0.8, "evidence": "T1105 Ingress Tool Transfer", "review_status": "suggested", "evidence_start": 4930, "evidence_end": 4957, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null } ], "apt_matches": [ { "group_attack_id": "G0123", "group_name": "Volatile Cedar", "similarity": 0.2, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0044", "group_name": "Winnti Group", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0130", "group_name": "Ajax Security Team", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0136", "group_name": "IndigoZebra", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0133", "group_name": "Nomadic Octopus", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G1013", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0107", "group_name": "Whitefly", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0066", "group_name": "Elderwood", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0075", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0120", "group_name": "Evilnum", "similarity": 0.0909, "shared_count": 1, "shared_techniques": [ "T1105" ] } ], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }