{
  "analysis_id": "8879e360-655c-4073-beb9-68018699a4d4",
  "session_id": "e0273fe8-1b24-4097-8d55-e2f1086ac0f2",
  "status": "completed",
  "filename": "2019-06-22-traffic-analysis-exercise.pcap",
  "source_sha256": "6a89013b9e9bc6d443810245b92f49db4df33c1671a43db03a6bbde8f2bc6e63",
  "source_size_bytes": 4694048,
  "schema_version": "pcap-analysis-v1",
  "semantic_sha256": "a523d37fb652442f09fef8af2215fc4fe4de55bef981e80127078b946b703d19",
  "analyzer_manifest": {
    "limits": {
      "max_flows": 50000,
      "max_endpoints": 20000,
      "max_upload_bytes": 536870912,
      "max_exported_files": 50000,
      "max_events_per_kind": 50000,
      "max_exported_objects": 500,
      "tool_timeout_seconds": 300,
      "max_object_hash_index": 50000,
      "max_tool_output_bytes": 268435456,
      "max_exported_total_bytes": 268435456,
      "max_exported_object_bytes": 52428800
    },
    "profile_id": "tshark-evidence-v6",
    "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465",
    "schema_version": "pcap-analyzer-manifest-v1",
    "tshark_version": "TShark (Wireshark) 4.4.18.",
    "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0",
    "capinfos_version": "Capinfos (Wireshark) 4.4.18.",
    "rulepack_version": "pcap-rules-v5",
    "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c",
    "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3",
    "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994"
  },
  "summary": "Decoded 7103 packets across 47 IP endpoints and 367 transport flows. Observed 163 DNS events, 52 HTTP requests, 67 TLS ClientHello events, and 34 recovered file/message object(s). Deterministic rules produced 20 finding(s): 0 high, 12 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.",
  "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2019-06-22-traffic-analysis-exercise.pcap\nCapture SHA-256: `6a89013b9e9bc6d443810245b92f49db4df33c1671a43db03a6bbde8f2bc6e63`\nSemantic result SHA-256: `a523d37fb652442f09fef8af2215fc4fe4de55bef981e80127078b946b703d19`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 7103 packets across 47 IP endpoints and 367 transport flows. Observed 163 DNS events, 52 HTTP requests, 67 TLS ClientHello events, and 34 recovered file/message object(s). Deterministic rules produced 20 finding(s): 0 high, 12 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 7103\n- Duration: 232.185013 seconds\n- Captured bytes: 4580376\n- Endpoints: 47\n- Flows: 367\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 1462 / TCP stream 140, frame 1524 / TCP stream 140.\n\nMetrics: `{\"content_type\":\"text/javascript; charset=utf-8\",\"declared_body_bytes\":33951,\"destination\":\"10.0.76.193\",\"response_count\":1,\"source\":\"172.217.164.74\",\"uri\":\"/ajax/libs/jquery/1.12.4/jquery.min.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 1720 / TCP stream 148, frame 1734 / TCP stream 148.\n\nMetrics: `{\"content_type\":\"text/javascript; charset=utf-8\",\"declared_body_bytes\":8916,\"destination\":\"10.0.76.193\",\"response_count\":1,\"source\":\"172.217.2.34\",\"uri\":\"/pagead/conversion_async.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 1781 / TCP stream 152, frame 1809 / TCP stream 152.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":17168,\"destination\":\"10.0.76.193\",\"response_count\":1,\"source\":\"74.125.138.138\",\"uri\":\"/ga.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 1836 / TCP stream 156, frame 1851 / TCP stream 156.\n\nMetrics: `{\"content_type\":\"application/x-javascript; charset=utf-8\",\"declared_body_bytes\":1781,\"destination\":\"10.0.76.193\",\"response_count\":1,\"source\":\"31.13.65.7\",\"uri\":\"/en_US/all.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 2649 / TCP stream 169, frame 2787 / TCP stream 169.\n\nMetrics: `{\"content_type\":\"text/javascript; charset=utf-8\",\"declared_body_bytes\":0,\"destination\":\"10.0.76.193\",\"response_count\":1,\"source\":\"74.125.136.102\",\"uri\":\"/adsense/search/async-ads.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 3893 / TCP stream 207, frame 4397 / TCP stream 207.\n\nMetrics: `{\"content_type\":\"application/x-msdownload\",\"declared_body_bytes\":584192,\"destination\":\"10.0.76.109\",\"response_count\":1,\"source\":\"37.46.135.170\",\"uri\":\"/?MzU4NjA0&kaZDWzI&AkwenzFXp=perpetual&EIDOXmpaHLIMQ=blackmail&PmNkusRzUKjdxi=known&embBMhXHEVqMM=already&nvQgwJI=community&PtVAedNAUU=difference&jDCoPDPCLNkpJ=heartfelt&SJjNZIaGHxK=known&vvHefJ=heartfelt&t4tsdfsg4=PAVMb_q6p3EiEnR6U0pGB_xyNZgITqZucEbg_2lT3ybZGJsJ1kx_R6GcBxewtW10Z6AwalanCH6fAnUctFEsxYQ&IJbAFjBSlWY=heartfelt&hyYviEG=criticized&ff5sdfds=xHjQMrnYbRbFFYTfKPPEUKNEMUjWA0-KwYmZhafVF5mxFDHGpbX1FxXspVSdCFSEmvRvdLUHIwSh1U3ASwNizYk&SfDdcBJQLntZc=everyone&ZwddKCJISaTB=blackmail&IqnFgRnJ=known&WWmEHUqy=vest&niUheyKPRbLYEdyNjEwOTgy\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 4417 / TCP stream 210, frame 4881 / TCP stream 210.\n\nMetrics: `{\"content_type\":\"application/x-msdownload\",\"declared_body_bytes\":584192,\"destination\":\"10.0.76.109\",\"response_count\":1,\"source\":\"37.46.135.170\",\"uri\":\"/?NDk4MTE5&tmCVgJMQbeHjv&znbcjFaUOmZy=vest&aTijcut=blackmail&kBgQawTJSFlOAu=difference&NCThQKrrQh=blackmail&lvQmqFyq=constitution&zCrDVEX=known&wLBVVjhJGAWC=detonator&PLFPhyyqZCa=known&lfJYgkH=perpetual&t4tsdfsg4=YPAVwb_q6p3EaEnRGU0p6B_x2NZgMTqZWcEbk_2lv3ybhGJs11kx_R6GYBxewtUFMT4wMWmKjKHqj58EgwV0sC&nVJnyJYij=vest&eZvTJjAeJ=professional&ISzjHlO=strategy&tAMbBJnq=referred&bwgDFqD=strategy&kdPRkesmuQ=heartfelt&ff5sdfds=xHjQMrbYbRfFFYvfKPzEUKxEMUbWA0GKwYeZhajVF5exFD7Gpbr1FxXspVWdCFWEmvtvdLUHIwuh1UPASwJizY&kxbRJWYrNpZbNlVMzU3NDAz\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6343 / TCP stream 227, frame 6470 / TCP stream 227.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":0,\"destination\":\"10.0.76.193\",\"response_count\":1,\"source\":\"35.226.156.55\",\"uri\":\"/scripts/bootstrap.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6367 / TCP stream 226, frame 6514 / TCP stream 226.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":0,\"destination\":\"10.0.76.193\",\"response_count\":1,\"source\":\"35.226.156.55\",\"uri\":\"/scripts/jquery.selectbox-0.2.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6432 / TCP stream 234, frame 6807 / TCP stream 234.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":58269,\"destination\":\"10.0.76.193\",\"response_count\":1,\"source\":\"35.226.156.55\",\"uri\":\"/scripts/amcharts/amcharts.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6475 / TCP stream 227, frame 6560 / TCP stream 227.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":0,\"destination\":\"10.0.76.193\",\"response_count\":1,\"source\":\"35.226.156.55\",\"uri\":\"/scripts/amcharts/serial.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 6497 / TCP stream 228, frame 6562 / TCP stream 228.\n\nMetrics: `{\"content_type\":\"application/javascript\",\"declared_body_bytes\":1142,\"destination\":\"10.0.76.193\",\"response_count\":1,\"source\":\"35.226.156.55\",\"uri\":\"/scripts/amcharts/themes/light.js\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 798 / TCP stream 70, frame 800 / TCP stream 70, frame 802 / TCP stream 70, frame 804 / TCP stream 70, frame 1282 / TCP stream 70.\n\nMetrics: `{\"destination\":\"10.0.76.6\",\"event_count\":8,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.76.109\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 589 / TCP stream 55, frame 624 / TCP stream 55, frame 627 / TCP stream 55, frame 629 / TCP stream 55, frame 698 / TCP stream 55.\n\nMetrics: `{\"destination\":\"10.0.76.6\",\"event_count\":41,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.0.76.109\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 279 / TCP stream 17, frame 281 / TCP stream 17, frame 283 / TCP stream 17, frame 285 / TCP stream 17, frame 1096 / TCP stream 17.\n\nMetrics: `{\"destination\":\"10.0.76.6\",\"event_count\":8,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.76.193\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 42 / TCP stream 2, frame 49 / TCP stream 3, frame 96 / TCP stream 2, frame 105 / TCP stream 2, frame 109 / TCP stream 2.\n\nMetrics: `{\"destination\":\"10.0.76.6\",\"event_count\":41,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.0.76.193\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 799 / TCP stream 70, frame 801 / TCP stream 70, frame 803 / TCP stream 70, frame 805 / TCP stream 70, frame 1283 / TCP stream 70.\n\nMetrics: `{\"destination\":\"10.0.76.109\",\"event_count\":8,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.76.6\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 591 / TCP stream 55, frame 626 / TCP stream 55, frame 628 / TCP stream 55, frame 630 / TCP stream 55, frame 700 / TCP stream 55.\n\nMetrics: `{\"destination\":\"10.0.76.109\",\"event_count\":33,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.0.76.6\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 280 / TCP stream 17, frame 282 / TCP stream 17, frame 284 / TCP stream 17, frame 286 / TCP stream 17, frame 1097 / TCP stream 17.\n\nMetrics: `{\"destination\":\"10.0.76.193\",\"event_count\":8,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.76.6\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 44 / TCP stream 2, frame 51 / TCP stream 3, frame 100 / TCP stream 2, frame 106 / TCP stream 2, frame 110 / TCP stream 2.\n\nMetrics: `{\"destination\":\"10.0.76.193\",\"event_count\":33,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.0.76.6\"}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `bangkok-8ac2-pc$`; client IPs: 10.0.76.109; frames: 596, 604, 606, 618, 645\n- account: `bristol-c71f-pc$`; client IPs: 10.0.76.193; frames: 58, 60, 72, 74, 86\n- account: `edris.haight`; client IPs: 10.0.76.109; frames: 1229, 1237, 1239, 1251, 1271\n- account: `setsuko.overton`; client IPs: 10.0.76.193; frames: 1044, 1052, 1054, 1066, 1085\n- hostname: `Bangkok-8ac2-PC`; client IPs: 10.0.76.109; frames: 934, 4887, 552, 771, 772\n- hostname: `Bristol-c71f-PC`; client IPs: 10.0.76.193; frames: 228, 1395, 1, 197, 217\n- netbios-group: `PHENOMENOC`; client IPs: unbound subject; frames: 2, 218, 220, 224, 553\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `ads-bid.l.doubleclick.net`; roles: dns-cname\n- domain: `ajax.googleapis.com`; roles: dns-query, http-host\n- domain: `api.bing.com`; roles: dns-query\n- domain: `bangkok-8ac2-pc.phenomenoc.com`; roles: dns-query\n- domain: `beef2live.com`; roles: dns-query, http-host, tls-sni\n- domain: `bid.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `bristol-c71f-pc.phenomenoc.com`; roles: dns-query\n- domain: `clients.l.google.com`; roles: dns-cname\n- domain: `clients1.google.com`; roles: dns-query, http-host\n- domain: `connect.facebook.net`; roles: dns-query, http-host, tls-sni\n- domain: `cse.google.com`; roles: dns-query, http-host, tls-sni\n- domain: `d3569ngd5kwbnf.cloudfront.net`; roles: dns-cname\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `fghjkmgru34.site`; roles: dns-query, http-host\n- domain: `fonts.googleapis.com`; roles: dns-query, tls-sni\n- domain: `fonts.gstatic.com`; roles: dns-query, tls-sni\n- domain: `googleadapis.l.google.com`; roles: dns-cname\n- domain: `googleads.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `googleapis.l.google.com`; roles: dns-cname\n- domain: `gstaticadssl.l.google.com`; roles: dns-cname\n- domain: `iecvlist.microsoft.com`; roles: dns-query, tls-sni\n- domain: `isatap.localdomain`; roles: dns-query\n- domain: `isatap.phenomenoc.com`; roles: dns-query\n- domain: `letsdoitquick.site`; roles: dns-query, http-host\n- domain: `pagead.l.doubleclick.net`; roles: dns-cname\n- domain: `pagead46.l.doubleclick.net`; roles: dns-cname\n- domain: `phenomenoc-dc.phenomenoc.com`; roles: dns-query\n- domain: `phenomenoc.com`; roles: dns-query\n- domain: `platform.twitter.com`; roles: dns-query, tls-sni\n- domain: `portal.farmcentric.com`; roles: dns-query, http-host, tls-sni\n- domain: `scontent.xx.fbcdn.net`; roles: dns-cname\n- domain: `ssl.gstatic.com`; roles: dns-query, tls-sni\n- domain: `star-mini.c10r.facebook.com`; roles: dns-cname\n- domain: `static.xx.fbcdn.net`; roles: dns-query, tls-sni\n- domain: `staticxx.facebook.com`; roles: dns-query, tls-sni\n- domain: `syndication.twitter.com`; roles: dns-query, tls-sni\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `wpad.phenomenoc.com`; roles: dns-query\n- domain: `www-google-analytics.l.google.com`; roles: dns-cname\n- domain: `www-googletagmanager.l.google.com`; roles: dns-cname\n- domain: `www.bing.com`; roles: dns-query, http-host\n- domain: `www.facebook.com`; roles: dns-query, tls-sni\n- domain: `www.farmprogress.com`; roles: dns-query, tls-sni\n- domain: `www.google-analytics.com`; roles: dns-query, http-host\n- domain: `www.google.com`; roles: dns-query, tls-sni\n- domain: `www.googleadservices.com`; roles: dns-query, http-host\n- domain: `www.googleapis.com`; roles: dns-query, tls-sni\n- domain: `www.googletagmanager.com`; roles: dns-query, tls-sni\n- domain: `www.gstatic.com`; roles: dns-query, tls-sni\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- ipv4: `10.0.76.109`; roles: dns-answer, network-endpoint\n- ipv4: `10.0.76.193`; roles: dns-answer, network-endpoint\n- ipv4: `10.0.76.255`; roles: network-endpoint\n- ipv4: `10.0.76.6`; roles: dns-answer, network-endpoint\n- ipv4: `104.244.42.136`; roles: dns-answer\n- ipv4: `104.244.42.200`; roles: dns-answer\n- ipv4: `104.244.42.72`; roles: dns-answer\n- ipv4: `104.244.42.8`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.80`; roles: dns-answer\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `172.217.0.67`; roles: network-endpoint\n- ipv4: `172.217.0.74`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.12.110`; roles: network-endpoint\n- ipv4: `172.217.164.66`; roles: network-endpoint\n- ipv4: `172.217.164.74`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.2.34`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.2.35`; roles: dns-answer, network-endpoint\n- ipv4: `173.194.219.154`; roles: dns-answer, network-endpoint\n- ipv4: `173.194.219.155`; roles: dns-answer\n- ipv4: `173.194.219.156`; roles: dns-answer, network-endpoint\n- ipv4: `173.194.219.157`; roles: dns-answer\n- ipv4: `173.194.219.94`; roles: network-endpoint\n- ipv4: `173.194.219.97`; roles: dns-answer, network-endpoint\n- ipv4: `185.254.190.200`; roles: network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer\n- ipv4: `216.58.193.163`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.63.249.144`; roles: dns-answer, network-endpoint\n- ipv4: `23.63.249.186`; roles: dns-answer, network-endpoint\n- ipv4: `23.63.249.194`; roles: dns-answer\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `31.13.65.36`; roles: dns-answer, network-endpoint\n- ipv4: `31.13.65.7`; roles: dns-answer, network-endpoint\n- ipv4: `35.226.156.55`; roles: dns-answer, network-endpoint\n- ipv4: `37.46.135.170`; roles: http-host, network-endpoint\n- ipv4: `54.192.207.126`; roles: dns-answer, network-endpoint\n- ipv4: `54.192.207.150`; roles: dns-answer\n- ipv4: `54.192.207.51`; roles: dns-answer\n- ipv4: `54.192.207.79`; roles: dns-answer\n- ipv4: `64.233.185.101`; roles: network-endpoint\n- ipv4: `64.233.185.102`; roles: network-endpoint\n- ipv4: `64.233.185.103`; roles: dns-answer, network-endpoint\n- ipv4: `64.233.185.104`; roles: dns-answer\n- ipv4: `64.233.185.105`; roles: dns-answer\n- ipv4: `64.233.185.106`; roles: dns-answer\n- ipv4: `64.233.185.147`; roles: dns-answer\n- ipv4: `64.233.185.154`; roles: dns-answer\n- ipv4: `64.233.185.155`; roles: dns-answer, network-endpoint\n- ipv4: `64.233.185.156`; roles: dns-answer\n- ipv4: `64.233.185.157`; roles: dns-answer\n- ipv4: `64.233.185.94`; roles: dns-answer, network-endpoint\n- ipv4: `64.233.185.95`; roles: dns-answer, network-endpoint\n- ipv4: `64.233.185.99`; roles: dns-answer\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `72.21.91.66`; roles: dns-answer, network-endpoint\n- ipv4: `74.125.136.100`; roles: dns-answer\n- ipv4: `74.125.136.101`; roles: dns-answer, network-endpoint\n- ipv4: `74.125.136.102`; roles: dns-answer, network-endpoint\n- ipv4: `74.125.136.106`; roles: network-endpoint\n- ipv4: `74.125.136.113`; roles: dns-answer\n- ipv4: `74.125.136.138`; roles: dns-answer\n- ipv4: `74.125.136.139`; roles: dns-answer\n- ipv4: `74.125.136.95`; roles: network-endpoint\n- ipv4: `74.125.138.100`; roles: dns-answer\n- ipv4: `74.125.138.101`; roles: dns-answer\n- ipv4: `74.125.138.102`; roles: dns-answer\n- ipv4: `74.125.138.113`; roles: dns-answer\n- ipv4: `74.125.138.138`; roles: dns-answer, network-endpoint\n- ipv4: `74.125.138.139`; roles: dns-answer\n- ipv4: `74.125.138.97`; roles: network-endpoint\n- ipv4: `74.125.21.95`; roles: dns-answer, network-endpoint\n- ipv4: `8.209.83.76`; roles: dns-answer, network-endpoint\n- ipv4: `91.235.129.60`; roles: dns-answer, network-endpoint\n- ipv6: `fd3e:4f5a:5b81::1`; roles: dns-answer\n- ja3: `4d7a28d6f2263ed61de88ca66eb011e3`; roles: tls-client-fingerprint\n- sha256: `09d46019c7a75b96187202c3c8412182f27c413a9c3661857923dc8e94e91b7b`; roles: exported-object\n- sha256: `1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f`; roles: exported-object\n- sha256: `13163ed737fd61106e44f7078caebe16df4549bc45b39c8928a956f987690fee`; roles: exported-object\n- sha256: `3103a01f90e95eef3300a895ab3411575325e0d2a1a4807e2fb5ae8e6f110f99`; roles: exported-object\n- sha256: `39bf8220d772efc49f7a8f0709ac8607af17997d38525eacec1448d5317dcf38`; roles: exported-object\n- sha256: `3b1ac036763d3a59c88578486ae698d22a37dd2d46a553485e1eabb9fe255b3f`; roles: exported-object\n- sha256: `4bbea1dbbdc058cc976c290bc9c0f506c6d175011da6fed42a499db1d2377af3`; roles: exported-object\n- sha256: `4cfe13f4450dd2250c80995a84e11eff6c3300a17ff3d6518362a2a0696d51da`; roles: exported-object\n- sha256: `4fe572e7d49282f6bb5dde888b8e5d06e8264add26b8aebd6b706b79f11d0893`; roles: exported-object\n- sha256: `502de2a45dc07ff1b837e168cbe37ca77056804aff81a5a510cecb199fbde654`; roles: exported-object\n- sha256: `565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3`; roles: exported-object\n- sha256: `5ce99a897720a7b57ff1da615b9d99b4eb5035ffcfd036e1de93536b507d4089`; roles: exported-object\n- sha256: `5d3e3d13333f572afe8df9cd7079c23b1049802e277d2cabce0221e2eaddc807`; roles: exported-object\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- sha256: `63386b64f7d940f3864917cd9dc6443500ae82f0c717e7a82bec5b7b80361393`; roles: exported-object\n- sha256: `668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404`; roles: exported-object\n- sha256: `6a77c8ea3af1cd0853993af5fa4724dee868e2c9a285eed61f8d0de3753b40ba`; roles: exported-object\n- sha256: `6d4ae7517a2914b5de787ebe33efc2915d5872f4d0c5839a0f84149adedb306e`; roles: exported-object\n- sha256: `6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914`; roles: exported-object\n- sha256: `78bcd250cc75ff96fd3f96452b04875ebc3e990f0982f8cb2053c2897a3fde4c`; roles: exported-object\n- sha256: `8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015`; roles: exported-object\n- sha256: `96d61a66fda99897f47232a1f3d15fe711fee6726c2e976eed42011948d87049`; roles: exported-object\n- sha256: `9a392fadea3ef641a75223fba61b5bc5c4d21c231360fe25d12218288d65ef0d`; roles: exported-object\n- sha256: `9bb35e2cb32e2507d2294fda6265966fe617d567b20845d53d2667a150b34311`; roles: exported-object\n- sha256: `9bf59058c99ed3af3b2568fa61791e9b31ca2f85a1a0b630e78449f3598fae33`; roles: exported-object\n- sha256: `9ed561402e41c753f32f30917a1b1e50ea12c272f203fae74d1cfee3d091da3a`; roles: exported-object\n- sha256: `a22fdaf4fdff6850730248a8c81a482e2c10bf0f1a5cfb5861dc5893442cf279`; roles: exported-object\n- sha256: `afa93c8baeaf1c28d1c5646ccdc701c636109bbc765549777a6417fa41fb5d6d`; roles: exported-object\n- sha256: `be7a8e1f7fddc3fd63f2540ea7103ba91c47d55c340504f69b286a64823678a0`; roles: exported-object\n- sha256: `c1f5379165637b2d8c5dea37642242e5aae279d5e2b4b2a00bc2a1f6463f02de`; roles: exported-object\n- sha256: `ca5a37a5c3401ffcd1b7c98c3a22a921c013d1121fe33122e94dd81c382bf9b0`; roles: exported-object\n- sha256: `cc900a14f6b6e17c5299c3f619b98ac2048780932d3b409cc9c5be79db70d15a`; roles: exported-object\n- sha256: `d428b93962535e52f3631fe647be46828868b6a88e2ecb203c706a86919502a0`; roles: exported-object\n- sha256: `dd4da68f83df075213351c713fa2067594e9ff7a402de406d3fe20f0c2a2f47e`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://37.46.135.170/?MTg0MzEy&UOViokhlz&aposAqGuAYQhGJO=difference&JhdAxqxZHPMIkeK=difference&dsWGIXdorJRe=detonator&qIHWsvSKCKW=referred&zoZXprPP=known&lbepukXxCTe=vest&WQLDTkVC=heartfelt&hziRqmWCrsMaus=constitution&evkJcGbq=referred&ff5sdfds=w3bQMvXcJxjQFYbGMvzDSKNbNknWHViPxomG9MildZeqZGX_k7vDfF-qoVXcCgWRxfQ&sIusXJLxas=community&DFWEKmZUkxxeB=golfer&t4tsdfsg4=ufOADNQToihfRLwJpzo1fUlIUof-ni0nRyxSa0p7Ur0HeYAMU9qKcELk82VzFjLdTJvs&gSlEAaKzG=criticized&sXTxIOfYGsZL=golfer&qSnbemVoJtsl=criticized&UjrvHHTG=blackmail&bpiAMNrElSNjI0OTM5`; roles: http-request\n- url: `http://37.46.135.170/?MTQwMjg3&ZqHoAiAzR&ff5sdfds=xXjQMvWUbRXQDJ3EKvPcT6NMMVHRFUCL2YedmrHZefjac1WkzrvFTF_7ozKATQSG6_ptdfJ&ZJull=known&ClGaW=known&PETxiFG=community&sMRo=wrapped&HuUMPiKpj=heartfelt&LfBYp=criticized&trlQvmgW=wrapped&t4tsdfsg4=WDQCwhBfTcwJom9xbAw4b8futjEnVzkCb1p6H-hGPYwNDrcSdRuVo31ykxrkkQPshg1TH4GI&QVQi=detonator&scUJaJdNW=golfer&eaqBiV=referred&eunX=heartfelt&lTfNSvPso=wrapped&cuxKdC=constitution&TGbNZdI=known&YAVpMLL=difference&KcBDoegcFMTU1OTU1`; roles: http-request\n- url: `http://37.46.135.170/?MzU4NjA0&kaZDWzI&AkwenzFXp=perpetual&EIDOXmpaHLIMQ=blackmail&PmNkusRzUKjdxi=known&embBMhXHEVqMM=already&nvQgwJI=community&PtVAedNAUU=difference&jDCoPDPCLNkpJ=heartfelt&SJjNZIaGHxK=known&vvHefJ=heartfelt&t4tsdfsg4=PAVMb_q6p3EiEnR6U0pGB_xyNZgITqZucEbg_2lT3ybZGJsJ1kx_R6GcBxewtW10Z6AwalanCH6fAnUctFEsxYQ&IJbAFjBSlWY=heartfelt&hyYviEG=criticized&ff5sdfds=xHjQMrnYbRbFFYTfKPPEUKNEMUjWA0-KwYmZhafVF5mxFDHGpbX1FxXspVSdCFSEmvRvdLUHIwSh1U3ASwNizYk&SfDdcBJQLntZc=everyone&ZwddKCJISaTB=blackmail&IqnFgRnJ=known&WWmEHUqy=vest&niUheyKPRbLYEdyNjEwOTgy`; roles: http-request\n- url: `http://37.46.135.170/?NDk4MTE5&tmCVgJMQbeHjv&znbcjFaUOmZy=vest&aTijcut=blackmail&kBgQawTJSFlOAu=difference&NCThQKrrQh=blackmail&lvQmqFyq=constitution&zCrDVEX=known&wLBVVjhJGAWC=detonator&PLFPhyyqZCa=known&lfJYgkH=perpetual&t4tsdfsg4=YPAVwb_q6p3EaEnRGU0p6B_x2NZgMTqZWcEbk_2lv3ybhGJs11kx_R6GYBxewtUFMT4wMWmKjKHqj58EgwV0sC&nVJnyJYij=vest&eZvTJjAeJ=professional&ISzjHlO=strategy&tAMbBJnq=referred&bwgDFqD=strategy&kdPRkesmuQ=heartfelt&ff5sdfds=xHjQMrbYbRfFFYvfKPzEUKxEMUbWA0GKwYeZhajVF5exFD7Gpbr1FxXspVWdCFWEmvtvdLUHIwuh1UPASwJizY&kxbRJWYrNpZbNlVMzU3NDAz`; roles: http-request\n- url: `http://37.46.135.170/favicon.ico`; roles: http-request\n- url: `http://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js`; roles: http-request\n- url: `http://beef2live.com/images/clear.gif`; roles: http-request\n- url: `http://beef2live.com/images/options.png`; roles: http-request\n- url: `http://beef2live.com/images/selectbox-sprite.png`; roles: http-request\n- url: `http://beef2live.com/markets`; roles: http-request\n- url: `http://beef2live.com/scripts/amcharts/amcharts.js`; roles: http-request\n- url: `http://beef2live.com/scripts/amcharts/serial.js`; roles: http-request\n- url: `http://beef2live.com/scripts/amcharts/themes/light.js`; roles: http-request\n- url: `http://beef2live.com/scripts/bootstrap.js`; roles: http-request\n- url: `http://beef2live.com/scripts/jquery-ui/images/ui-bg_flat_75_ffffff_40x100.png`; roles: http-request\n- url: `http://beef2live.com/scripts/jquery-ui/images/ui-bg_glass_75_e6e6e6_1x400.png`; roles: http-request\n- url: `http://beef2live.com/scripts/jquery-ui/images/ui-bg_highlight-soft_75_cccccc_1x100.png`; roles: http-request\n- url: `http://beef2live.com/scripts/jquery-ui/images/ui-icons_222222_256x240.png`; roles: http-request\n- url: `http://beef2live.com/scripts/jquery.selectbox-0.2.js`; roles: http-request\n- url: `http://beef2live.com/story-anatomy-beef-cattle-154-104357`; roles: http-request\n- url: `http://beef2live.com/style/marketsResponsiveNoSidebar.css`; roles: http-request\n- url: `http://beef2live.com/style/templates/controls/tabbedQuotesResponsive.css?v=2`; roles: http-request\n- url: `http://beef2live.com/style/templates/images/chgDnArrow.png`; roles: http-request\n- url: `http://beef2live.com/style/templates/images/chgUpArrow.png`; roles: http-request\n- url: `http://beef2live.com/style/templates/page/markets.css?v=1`; roles: http-request\n- url: `http://clients1.google.com/generate_204`; roles: http-request\n- url: `http://connect.facebook.net/en_US/all.js`; roles: http-request\n- url: `http://cse.google.com/adsense/search/async-ads.js`; roles: http-request\n- url: `http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php`; roles: http-request\n- url: `http://letsdoitquick.site/`; roles: http-request\n- url: `http://portal.farmcentric.com/images/arrow-down-large.png`; roles: http-request\n- url: `http://portal.farmcentric.com/images/pointerup.png`; roles: http-request\n- url: `http://www.bing.com/favicon.ico`; roles: http-request\n- url: `http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=3&utmn=2054411788&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853867&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~`; roles: http-request\n- url: `http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=4&utmn=1186798248&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853872&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~`; roles: http-request\n- url: `http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=5&utmn=1173868244&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982849&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~`; roles: http-request\n- url: `http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=6&utmn=1716294095&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982853&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~`; roles: http-request\n- url: `http://www.google-analytics.com/ga.js`; roles: http-request\n- url: `http://www.googleadservices.com/pagead/conversion_async.js`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko`; roles: http-client\n- user_agent: `�`; roles: http-client\n- exported object `story-anatomy-beef-cattle-154-104357`; SHA-256 `3103a01f90e95eef3300a895ab3411575325e0d2a1a4807e2fb5ae8e6f110f99`; size 117009 bytes\n  SHA-1: `803183fa83fba219cfbe1fb902cd22d52ad4b88a`; MD5: `4aa3c0266b5cef79849996efce7679d6`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1403,\"response_frame\":1449,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":138,\"url\":\"http://beef2live.com/story-anatomy-beef-cattle-154-104357\"}]`.\n  Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"downloadFile\",\"feature\":\"powershell-download\",\"offset\":90794}],\"inspected_bytes\":117009,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":117009,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%3fMzU4NjA0&kaZDWzI&AkwenzFXp=perpetual&EIDOXmpaHLIMQ=blackmail&PmNkusRzUKjdxi=known&embBMhXHEVqMM=already&nvQgwJI=community&PtVAedNAUU=difference&jDCoPDPCLNkpJ=heartfelt&SJjNZIaGHxK=known&vvHefJ=heartfelt&t4tsdfsg4=PAVMb_q6p3EiEnR6U0pGB_xyNZgITqZucEbg_2l`; SHA-256 `4fe572e7d49282f6bb5dde888b8e5d06e8264add26b8aebd6b706b79f11d0893`; size 584192 bytes\n  SHA-1: `2a4c971012e6f8d48d43193e21d73f547df05989`; MD5: `49f65c766a37afefd42941c0197b752a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":3893,\"response_frame\":4397,\"server_ip\":\"37.46.135.170\",\"status_code\":\"200\",\"tcp_stream\":207,\"url\":\"http://37.46.135.170/?MzU4NjA0&kaZDWzI&AkwenzFXp=perpetual&EIDOXmpaHLIMQ=blackmail&PmNkusRzUKjdxi=known&embBMhXHEVqMM=already&nvQgwJI=community&PtVAedNAUU=difference&jDCoPDPCLNkpJ=heartfelt&SJjNZIaGHxK=known&vvHefJ=heartfelt&t4tsdfsg4=PAVMb_q6p3EiEnR6U0pGB_xyNZgITqZucEbg_2lT3ybZGJsJ1kx_R6GcBxewtW10Z6AwalanCH6fAnUctFEsxYQ&IJbAFjBSlWY=heartfelt&hyYviEG=criticized&ff5sdfds=xHjQMrnYbRbFFYTfKPPEUKNEMUjWA0-KwYmZhafVF5mxFDHGpbX1FxXspVSdCFSEmvRvdLUHIwSh1U3ASwNizYk&SfDdcBJQLntZc=everyone&ZwddKCJISaTB=blackmail&IqnFgRnJ=known&WWmEHUqy=vest&niUheyKPRbLYEdyNjEwOTgy\"},{\"client_ip\":\"10.0.76.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4417,\"response_frame\":4881,\"server_ip\":\"37.46.135.170\",\"status_code\":\"200\",\"tcp_stream\":210,\"url\":\"http://37.46.135.170/?NDk4MTE5&tmCVgJMQbeHjv&znbcjFaUOmZy=vest&aTijcut=blackmail&kBgQawTJSFlOAu=difference&NCThQKrrQh=blackmail&lvQmqFyq=constitution&zCrDVEX=known&wLBVVjhJGAWC=detonator&PLFPhyyqZCa=known&lfJYgkH=perpetual&t4tsdfsg4=YPAVwb_q6p3EaEnRGU0p6B_x2NZgMTqZWcEbk_2lv3ybhGJs11kx_R6GYBxewtUFMT4wMWmKjKHqj58EgwV0sC&nVJnyJYij=vest&eZvTJjAeJ=professional&ISzjHlO=strategy&tAMbBJnq=referred&bwgDFqD=strategy&kdPRkesmuQ=heartfelt&ff5sdfds=xHjQMrbYbRfFFYvfKPzEUKxEMUbWA0GKwYeZhajVF5exFD7Gpbr1FxXspVWdCFWEmvtvdLUHIwuh1UPASwJizY&kxbRJWYrNpZbNlVMzU3NDAz\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `markets`; SHA-256 `13163ed737fd61106e44f7078caebe16df4549bc45b39c8928a956f987690fee`; size 203254 bytes\n  SHA-1: `2d499c384d002ee0bd7e0388fff0774cdc92d330`; MD5: `94951087f4fbd935efc4f0ed5e46331f`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6268,\"response_frame\":6313,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":227,\"url\":\"http://beef2live.com/markets\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":203254,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `amcharts.js`; SHA-256 `6a77c8ea3af1cd0853993af5fa4724dee868e2c9a285eed61f8d0de3753b40ba`; size 196326 bytes\n  SHA-1: `e644217d26c526b926d8a13471b49bf5f11fdbcc`; MD5: `f80f55813b04817d9984e7a5527531ca`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6432,\"response_frame\":6807,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":234,\"url\":\"http://beef2live.com/scripts/amcharts/amcharts.js\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":196326,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `async-ads.js`; SHA-256 `c1f5379165637b2d8c5dea37642242e5aae279d5e2b4b2a00bc2a1f6463f02de`; size 170211 bytes\n  SHA-1: `e0ea0914223407e4b5109e0301f7515c4f60dca0`; MD5: `e611411ad7ea052b8507cf1f34185e04`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2649,\"response_frame\":2787,\"server_ip\":\"74.125.136.102\",\"status_code\":\"200\",\"tcp_stream\":169,\"url\":\"http://cse.google.com/adsense/search/async-ads.js\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":170211,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%3fMTQwMjg3&ZqHoAiAzR&ff5sdfds=xXjQMvWUbRXQDJ3EKvPcT6NMMVHRFUCL2YedmrHZefjac1WkzrvFTF_7ozKATQSG6_ptdfJ&ZJull=known&ClGaW=known&PETxiFG=community&sMRo=wrapped&HuUMPiKpj=heartfelt&LfBYp=criticized&trlQvmgW=wrapped&t4tsdfsg4=WDQCwhBfTcwJom9xbAw4b8futjEnVzkCb`; SHA-256 `ca5a37a5c3401ffcd1b7c98c3a22a921c013d1121fe33122e94dd81c382bf9b0`; size 136566 bytes\n  SHA-1: `f28789fa0dff9d1c3e920fb2de2d447c7077b834`; MD5: `3c26f9d32bf489799f4730d58c6ddf7d`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.109\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":3761,\"response_frame\":3840,\"server_ip\":\"37.46.135.170\",\"status_code\":\"200\",\"tcp_stream\":202,\"url\":\"http://37.46.135.170/?MTQwMjg3&ZqHoAiAzR&ff5sdfds=xXjQMvWUbRXQDJ3EKvPcT6NMMVHRFUCL2YedmrHZefjac1WkzrvFTF_7ozKATQSG6_ptdfJ&ZJull=known&ClGaW=known&PETxiFG=community&sMRo=wrapped&HuUMPiKpj=heartfelt&LfBYp=criticized&trlQvmgW=wrapped&t4tsdfsg4=WDQCwhBfTcwJom9xbAw4b8futjEnVzkCb1p6H-hGPYwNDrcSdRuVo31ykxrkkQPshg1TH4GI&QVQi=detonator&scUJaJdNW=golfer&eaqBiV=referred&eunX=heartfelt&lTfNSvPso=wrapped&cuxKdC=constitution&TGbNZdI=known&YAVpMLL=difference&KcBDoegcFMTU1OTU1\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":136566,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `jquery.min.js`; SHA-256 `668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404`; size 97163 bytes\n  SHA-1: `5a9dcfbef655a2668e78baebeaa8dc6f41d8dabb`; MD5: `4f252523d4af0b478c810c2547a63e19`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1462,\"response_frame\":1524,\"server_ip\":\"172.217.164.74\",\"status_code\":\"200\",\"tcp_stream\":140,\"url\":\"http://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":97163,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `bootstrap.js`; SHA-256 `9bb35e2cb32e2507d2294fda6265966fe617d567b20845d53d2667a150b34311`; size 60543 bytes\n  SHA-1: `7da7214a24bb216ea0af7e681cf6ce47b004fe5c`; MD5: `4b3178a05eb4409547c69b1ba2d91ebe`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6343,\"response_frame\":6470,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":227,\"url\":\"http://beef2live.com/scripts/bootstrap.js\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":60543,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ga.js`; SHA-256 `1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f`; size 46274 bytes\n  SHA-1: `2c7d19d1af7d97085c977d1b69dcb8b84483d87c`; MD5: `e9372f0ebbcf71f851e3d321ef2a8e5a`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1781,\"response_frame\":1809,\"server_ip\":\"74.125.138.138\",\"status_code\":\"200\",\"tcp_stream\":152,\"url\":\"http://www.google-analytics.com/ga.js\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":46274,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `serial.js`; SHA-256 `78bcd250cc75ff96fd3f96452b04875ebc3e990f0982f8cb2053c2897a3fde4c`; size 29452 bytes\n  SHA-1: `3fb950502b08e96dcb73266ac2ba6b87128495b4`; MD5: `d01adfedd3b9213acff9aa48bee9b80c`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6475,\"response_frame\":6560,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":227,\"url\":\"http://beef2live.com/scripts/amcharts/serial.js\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":29452,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `marketsResponsiveNoSidebar.css`; SHA-256 `dd4da68f83df075213351c713fa2067594e9ff7a402de406d3fe20f0c2a2f47e`; size 27596 bytes\n  SHA-1: `9dd42fc32af368e3bd0558d071aaa465baadac93`; MD5: `c25b36731d52c094ce3491405c06c5dc`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6317,\"response_frame\":6363,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":228,\"url\":\"http://beef2live.com/style/marketsResponsiveNoSidebar.css\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":27596,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `conversion_async.js`; SHA-256 `cc900a14f6b6e17c5299c3f619b98ac2048780932d3b409cc9c5be79db70d15a`; size 23681 bytes\n  SHA-1: `16ab4d6f91adf712015d9d9f026582335f431de2`; MD5: `f96dcfac5f448a5c2dc1048e018658d2`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1720,\"response_frame\":1734,\"server_ip\":\"172.217.2.34\",\"status_code\":\"200\",\"tcp_stream\":148,\"url\":\"http://www.googleadservices.com/pagead/conversion_async.js\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":23681,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `markets.css%3fv=1`; SHA-256 `9a392fadea3ef641a75223fba61b5bc5c4d21c231360fe25d12218288d65ef0d`; size 23171 bytes\n  SHA-1: `df3651cc4299958b13998788bdeac30a022389c4`; MD5: `21067d64142f462995b41bed5ccdf88b`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6286,\"response_frame\":6358,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":226,\"url\":\"http://beef2live.com/style/templates/page/markets.css?v=1\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":23171,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `jquery.selectbox-0.2.js`; SHA-256 `afa93c8baeaf1c28d1c5646ccdc701c636109bbc765549777a6417fa41fb5d6d`; size 15200 bytes\n  SHA-1: `9da7bb059331f243d319233b11dbd1d0cd565c7b`; MD5: `601d78b19306deaad10a952262acb9af`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6367,\"response_frame\":6514,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":226,\"url\":\"http://beef2live.com/scripts/jquery.selectbox-0.2.js\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":15200,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%3fMTg0MzEy&UOViokhlz&aposAqGuAYQhGJO=difference&JhdAxqxZHPMIkeK=difference&dsWGIXdorJRe=detonator&qIHWsvSKCKW=referred&zoZXprPP=known&lbepukXxCTe=vest&WQLDTkVC=heartfelt&hziRqmWCrsMaus=constitution&evkJcGbq=referred&ff5sdfds=w3bQMvXcJxjQFYbGMvzDSKNbNknWH`; SHA-256 `39bf8220d772efc49f7a8f0709ac8607af17997d38525eacec1448d5317dcf38`; size 9207 bytes\n  SHA-1: `2bb089210e1b25b2823ad69ffedf6c41bbc46e47`; MD5: `4fbe475a6d26f20e2a3f4c8becc0b14f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":3842,\"response_frame\":3856,\"server_ip\":\"37.46.135.170\",\"status_code\":\"200\",\"tcp_stream\":201,\"url\":\"http://37.46.135.170/?MTg0MzEy&UOViokhlz&aposAqGuAYQhGJO=difference&JhdAxqxZHPMIkeK=difference&dsWGIXdorJRe=detonator&qIHWsvSKCKW=referred&zoZXprPP=known&lbepukXxCTe=vest&WQLDTkVC=heartfelt&hziRqmWCrsMaus=constitution&evkJcGbq=referred&ff5sdfds=w3bQMvXcJxjQFYbGMvzDSKNbNknWHViPxomG9MildZeqZGX_k7vDfF-qoVXcCgWRxfQ&sIusXJLxas=community&DFWEKmZUkxxeB=golfer&t4tsdfsg4=ufOADNQToihfRLwJpzo1fUlIUof-ni0nRyxSa0p7Ur0HeYAMU9qKcELk82VzFjLdTJvs&gSlEAaKzG=criticized&sXTxIOfYGsZL=golfer&qSnbemVoJtsl=criticized&UjrvHHTG=blackmail&bpiAMNrElSNjI0OTM5\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":9207,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `tabbedQuotesResponsive.css%3fv=2`; SHA-256 `5d3e3d13333f572afe8df9cd7079c23b1049802e277d2cabce0221e2eaddc807`; size 8436 bytes\n  SHA-1: `c9b2961eadf70e89b74c3b6d7433c79110988f39`; MD5: `3b9f0ae5d1c1a2eb4583c26a7d8be234`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6369,\"response_frame\":6495,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":228,\"url\":\"http://beef2live.com/style/templates/controls/tabbedQuotesResponsive.css?v=2\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":8436,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ui-icons_222222_256x240.png`; SHA-256 `3b1ac036763d3a59c88578486ae698d22a37dd2d46a553485e1eabb9fe255b3f`; size 6922 bytes\n  SHA-1: `692a53cad7f748bc7b691b98b9116ce3269cd22b`; MD5: `a1b3887a86cf1791f23c0b53b4d3585f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6996,\"response_frame\":7037,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":228,\"url\":\"http://beef2live.com/scripts/jquery-ui/images/ui-icons_222222_256x240.png\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":6922,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `options.png`; SHA-256 `9bf59058c99ed3af3b2568fa61791e9b31ca2f85a1a0b630e78449f3598fae33`; size 5529 bytes\n  SHA-1: `910e8b22b7b72ce8c88f06e3f6dfe58d2d39a214`; MD5: `917bc6e18c28339b4b37cdc82e081aa0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6520,\"response_frame\":6582,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":226,\"url\":\"http://beef2live.com/images/options.png\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5529,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `light.js`; SHA-256 `a22fdaf4fdff6850730248a8c81a482e2c10bf0f1a5cfb5861dc5893442cf279`; size 4148 bytes\n  SHA-1: `5d0029490e6f588d9a2573f9e50ef12c85f9f456`; MD5: `8c44f1aeb278b446a54e3f0633b21a6e`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6497,\"response_frame\":6562,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":228,\"url\":\"http://beef2live.com/scripts/amcharts/themes/light.js\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":4148,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `all.js`; SHA-256 `63386b64f7d940f3864917cd9dc6443500ae82f0c717e7a82bec5b7b80361393`; size 3224 bytes\n  SHA-1: `1e86b2bc4fe3a0125a17aad61c47101efdda0ad3`; MD5: `7b57777fcb9e7ff1e92210e10234d229`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1836,\"response_frame\":1851,\"server_ip\":\"31.13.65.7\",\"status_code\":\"200\",\"tcp_stream\":156,\"url\":\"http://connect.facebook.net/en_US/all.js\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3224,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `arrow-down-large.png`; SHA-256 `be7a8e1f7fddc3fd63f2540ea7103ba91c47d55c340504f69b286a64823678a0`; size 1251 bytes\n  SHA-1: `82fcd25af93476b243720ab3ef6ee891987b7d32`; MD5: `47a8a2fc33e074d4fa87a87f554e52b8`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6442,\"response_frame\":6567,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":237,\"url\":\"http://portal.farmcentric.com/images/arrow-down-large.png\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1251,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `pointerup.png`; SHA-256 `5ce99a897720a7b57ff1da615b9d99b4eb5035ffcfd036e1de93536b507d4089`; size 1134 bytes\n  SHA-1: `3c903642f2eca9a59d76a31738ef6b1bc0b5c237`; MD5: `fdf70590e40bca3b6ffbafc3cc43c3cc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6434,\"response_frame\":6565,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":236,\"url\":\"http://portal.farmcentric.com/images/pointerup.png\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1134,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `selectbox-sprite.png`; SHA-256 `9ed561402e41c753f32f30917a1b1e50ea12c272f203fae74d1cfee3d091da3a`; size 656 bytes\n  SHA-1: `33b20577d9526aa2e002bda4e7b0dd623716f9b4`; MD5: `1304e47ee146ad1ccc25aa974d08b2bb`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6860,\"response_frame\":6983,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":226,\"url\":\"http://beef2live.com/images/selectbox-sprite.png\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":656,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `chgUpArrow.png`; SHA-256 `6d4ae7517a2914b5de787ebe33efc2915d5872f4d0c5839a0f84149adedb306e`; size 652 bytes\n  SHA-1: `ed3a6357e68e3885ccf33c72bbc4bed5040e5815`; MD5: `0ac321c65470aaf896bc1876311feac1`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6854,\"response_frame\":6985,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":227,\"url\":\"http://beef2live.com/style/templates/images/chgUpArrow.png\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":652,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `chgDnArrow.png`; SHA-256 `d428b93962535e52f3631fe647be46828868b6a88e2ecb203c706a86919502a0`; size 636 bytes\n  SHA-1: `a8e3b135807d5fd51fa7b280f2df9adfa8ac8143`; MD5: `d5bb0e3566d122a3603d7cb05404bd58`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6852,\"response_frame\":6988,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":234,\"url\":\"http://beef2live.com/style/templates/images/chgDnArrow.png\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":636,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `gate(1).php`; SHA-256 `96d61a66fda99897f47232a1f3d15fe711fee6726c2e976eed42011948d87049`; size 340 bytes\n  SHA-1: `1a432047dcfb568db5cbaa3ee2be97d4020bf4a5`; MD5: `c625f8d2e4186d71288c0d0a8256b013`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.76.109\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4893,\"response_frame\":4896,\"server_ip\":\"8.209.83.76\",\"status_code\":\"200\",\"tcp_stream\":211,\"url\":\"http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php\"},{\"client_ip\":\"10.0.76.109\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":4907,\"response_frame\":4909,\"server_ip\":\"8.209.83.76\",\"status_code\":\"200\",\"tcp_stream\":212,\"url\":\"http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":340,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ui-bg_highlight-soft_75_cccccc_1x100.png`; SHA-256 `4cfe13f4450dd2250c80995a84e11eff6c3300a17ff3d6518362a2a0696d51da`; size 280 bytes\n  SHA-1: `56539786a832d295600ea915173fe64c480c7f22`; MD5: `e9d07947ff17487e3d602395bac7fcce`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6979,\"response_frame\":7026,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":256,\"url\":\"http://beef2live.com/scripts/jquery-ui/images/ui-bg_highlight-soft_75_cccccc_1x100.png\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":280,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ui-bg_glass_75_e6e6e6_1x400.png`; SHA-256 `4bbea1dbbdc058cc976c290bc9c0f506c6d175011da6fed42a499db1d2377af3`; size 262 bytes\n  SHA-1: `bdc92d1acdd555d1542d040bcc5aae52348c6094`; MD5: `da3dfa9e609b29a0e29bb75af39cebec`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6998,\"response_frame\":7028,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":257,\"url\":\"http://beef2live.com/scripts/jquery-ui/images/ui-bg_glass_75_e6e6e6_1x400.png\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `favicon(1).ico`; SHA-256 `6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914`; size 237 bytes\n  SHA-1: `ea13848d33c2c7f4f4baa39348aeb1dbfad3df31`; MD5: `9fb559a691078558e77d6848202f6541`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":3186,\"response_frame\":3190,\"server_ip\":\"13.107.21.200\",\"status_code\":\"200\",\"tcp_stream\":183,\"url\":\"http://www.bing.com/favicon.ico\"},{\"client_ip\":\"10.0.76.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":3879,\"response_frame\":3883,\"server_ip\":\"13.107.21.200\",\"status_code\":\"200\",\"tcp_stream\":205,\"url\":\"http://www.bing.com/favicon.ico\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":237,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ui-bg_flat_75_ffffff_40x100.png`; SHA-256 `502de2a45dc07ff1b837e168cbe37ca77056804aff81a5a510cecb199fbde654`; size 208 bytes\n  SHA-1: `911c2981c458857ec55cf77362a1773808199c68`; MD5: `2e084c534bd4a2df7088eef4be117b0a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6862,\"response_frame\":6986,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":228,\"url\":\"http://beef2live.com/scripts/jquery-ui/images/ui-bg_flat_75_ffffff_40x100.png\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":208,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `clear.gif`; SHA-256 `09d46019c7a75b96187202c3c8412182f27c413a9c3661857923dc8e94e91b7b`; size 67 bytes\n  SHA-1: `211639854b03d88502835b2649d42066016fa452`; MD5: `c2db45a8f494c4b40095f4fd38d613fd`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6600,\"response_frame\":6692,\"server_ip\":\"35.226.156.55\",\"status_code\":\"200\",\"tcp_stream\":227,\"url\":\"http://beef2live.com/images/clear.gif\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":67,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `__utm.gif%3futmwv=5.7.2&utms=3&utmn=2054411788&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~`; SHA-256 `8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015`; size 35 bytes\n  SHA-1: `0f4e929dd5bb2564f7ab9c76338e04e292a42ace`; MD5: `28d6814f309ea289f847c69cf91194c6`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1811,\"response_frame\":1815,\"server_ip\":\"74.125.138.138\",\"status_code\":\"200\",\"tcp_stream\":152,\"url\":\"http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=3&utmn=2054411788&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853867&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~\"},{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1813,\"response_frame\":1817,\"server_ip\":\"74.125.138.138\",\"status_code\":\"200\",\"tcp_stream\":153,\"url\":\"http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=4&utmn=1186798248&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853872&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~\"},{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6375,\"response_frame\":6389,\"server_ip\":\"74.125.138.138\",\"status_code\":\"200\",\"tcp_stream\":232,\"url\":\"http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=5&utmn=1173868244&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982849&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~\"},{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6379,\"response_frame\":6394,\"server_ip\":\"74.125.138.138\",\"status_code\":\"200\",\"tcp_stream\":231,\"url\":\"http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=6&utmn=1716294095&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982853&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":35,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ncsi(1).txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n  SHA-1: `33bf88d5b82df3723d5863c7d23445e345828904`; MD5: `cd5a4d3fdd5bffc16bf959ef75cf37bc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.193\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":431,\"response_frame\":433,\"server_ip\":\"23.63.249.186\",\"status_code\":\"200\",\"tcp_stream\":30,\"url\":\"http://www.msftncsi.com/ncsi.txt\"},{\"client_ip\":\"10.0.76.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":959,\"response_frame\":961,\"server_ip\":\"23.63.249.144\",\"status_code\":\"200\",\"tcp_stream\":80,\"url\":\"http://www.msftncsi.com/ncsi.txt\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `gate(2).php`; SHA-256 `565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3`; size 2 bytes\n  SHA-1: `9ce3bd4224c8c1780db56b4125ecf3f24bf748b7`; MD5: `e0aa021e21dddbd6d8cecec71e9cf564`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.76.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5364,\"response_frame\":5898,\"server_ip\":\"8.209.83.76\",\"status_code\":\"200\",\"tcp_stream\":213,\"url\":\"http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php\"},{\"client_ip\":\"10.0.76.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5852,\"response_frame\":5908,\"server_ip\":\"8.209.83.76\",\"status_code\":\"200\",\"tcp_stream\":214,\"url\":\"http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `8ac0eedd56c6a97172dc8bee623d3a504e6f14b3aea8a9a8245d2b6bc4e641da`; recorded 2026-09-22T16:04:29.263843+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":208,\"observable_limit\":5000,\"observables_checked\":208,\"observables_total\":208,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `961bdc9a-7460-440f-a246-f55748149bcc` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `1c2e6d58-c62a-4009-939b-3aa82de281a2` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `76f521c2-4e4a-41d5-95ad-a44fd9887dd8` shares 35 observations. This does not establish a common campaign.\n- Prior analysis `fa0da8be-03fb-404d-a526-6c99c6b4f000` shares 20 observations. This does not establish a common campaign.\n- Prior analysis `05851801-c224-489b-b9da-9e5d035c60b4` shares 17 observations. This does not establish a common campaign.\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 39 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 28 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `31f265dc-3055-4628-8df4-136d4058e842` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `8174eaa7-e189-467f-b05e-fb7397bfcf16` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `e37603cf-d241-45ee-95ec-bcf92a063147` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `7c54479c-cce3-4570-80c9-69d03571a645` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `21da2cda-3a07-4c03-b352-af8740c84bc0` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `eb5ccbc6-145e-4422-8b9a-f42ae48aad5c` shares 1 observations. This does not establish a common campaign.\n- Prior analysis `9923b3d5-8d06-4f6a-b1f1-810507712be3` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `8f0da1cd-9998-4d41-9fc7-683302a6ee24` shares 10 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":34,\"export_status\":\"completed\",\"exported_objects\":42,\"hashed_bytes\":2358768,\"hashed_objects\":42,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":34,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":34}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 20/20, identities 7/7, observables 208/208, artifacts 34/34. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n202 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `10891b5d20b12429ae762387421890bd522cfaa329a0ca623ad0005a225f43a2`.\n\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `e8debbb454bae644a487596fd1b3e692b62d77105a4af15347a03f61566d97fb`; updated 2026-09-22T17:47:02.178791+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-b7dc4639fc754303031a0b8a\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-b7dc4639fc754303031a0b8a\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-0b9972b1d21f8ccaff80eb6a\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-0b9972b1d21f8ccaff80eb6a\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-5b1d4d021241dcdb0a15ed4e\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-5b1d4d021241dcdb0a15ed4e\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-23aaa6f3e412eeead34ec3e4\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-23aaa6f3e412eeead34ec3e4\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-0c2be4245f3922f5c26ece09\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-0c2be4245f3922f5c26ece09\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-94b60df33482de05fc570f75\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-94b60df33482de05fc570f75\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-6f3b10f19ea885a057e0ec2e\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-6f3b10f19ea885a057e0ec2e\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":7,\"cache_hits\":1,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":6,\"retained_targets\":57,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n",
  "result": {
    "flows": [
      {
        "bytes": 2424,
        "stream": 0,
        "flow_id": "flow-5b626a3b38dd7a924e46ba69",
        "packets": 24,
        "transport": "udp",
        "last_frame": 3008,
        "first_frame": 1,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.255",
        "initiator_port": 137,
        "responder_port": 137,
        "initiator_bytes": 2424,
        "last_seen_epoch": "1561247264.409978",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247190.373494"
      },
      {
        "bytes": 254,
        "stream": 1,
        "flow_id": "flow-c166d09adfd2bd611dbf5227",
        "packets": 2,
        "transport": "udp",
        "last_frame": 4,
        "first_frame": 3,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 55941,
        "responder_port": 53,
        "initiator_bytes": 95,
        "last_seen_epoch": "1561247190.414558",
        "responder_bytes": 159,
        "first_seen_epoch": "1561247190.413389"
      },
      {
        "bytes": 192,
        "stream": 2,
        "flow_id": "flow-cee278122a77c0caf24d0978",
        "packets": 2,
        "transport": "udp",
        "last_frame": 6,
        "first_frame": 5,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59782,
        "responder_port": 53,
        "initiator_bytes": 88,
        "last_seen_epoch": "1561247190.433338",
        "responder_bytes": 104,
        "first_seen_epoch": "1561247190.433077"
      },
      {
        "bytes": 316,
        "stream": 3,
        "flow_id": "flow-940edf31efc66cd05da0ee2d",
        "packets": 2,
        "transport": "udp",
        "last_frame": 8,
        "first_frame": 7,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59596,
        "responder_port": 53,
        "initiator_bytes": 126,
        "last_seen_epoch": "1561247190.436697",
        "responder_bytes": 190,
        "first_seen_epoch": "1561247190.436474"
      },
      {
        "bytes": 489,
        "stream": 4,
        "flow_id": "flow-6319dfc927bef470e582fcdc",
        "packets": 2,
        "transport": "udp",
        "last_frame": 10,
        "first_frame": 9,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59599,
        "responder_port": 389,
        "initiator_bytes": 257,
        "last_seen_epoch": "1561247190.498927",
        "responder_bytes": 232,
        "first_seen_epoch": "1561247190.498539"
      },
      {
        "bytes": 445,
        "stream": 5,
        "flow_id": "flow-f2aa7007848ccb3aa01b6f57",
        "packets": 2,
        "transport": "udp",
        "last_frame": 12,
        "first_frame": 11,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59600,
        "responder_port": 389,
        "initiator_bytes": 213,
        "last_seen_epoch": "1561247190.506906",
        "responder_bytes": 232,
        "first_seen_epoch": "1561247190.506588"
      },
      {
        "bytes": 1878,
        "stream": 0,
        "flow_id": "flow-98ad88cd3ab7904bc7f56b1d",
        "packets": 15,
        "transport": "tcp",
        "last_frame": 539,
        "first_frame": 13,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49155,
        "responder_port": 135,
        "initiator_bytes": 994,
        "last_seen_epoch": "1561247218.717481",
        "responder_bytes": 884,
        "first_seen_epoch": "1561247190.615444"
      },
      {
        "bytes": 4480,
        "stream": 1,
        "flow_id": "flow-824fb9153f972ee0a55c1ca4",
        "packets": 20,
        "transport": "tcp",
        "last_frame": 537,
        "first_frame": 20,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49156,
        "responder_port": 49158,
        "initiator_bytes": 2598,
        "last_seen_epoch": "1561247218.717377",
        "responder_bytes": 1882,
        "first_seen_epoch": "1561247190.626347"
      },
      {
        "bytes": 296,
        "stream": 6,
        "flow_id": "flow-0de5e63d8e8296ed77228eca",
        "packets": 2,
        "transport": "udp",
        "last_frame": 36,
        "first_frame": 34,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 56960,
        "responder_port": 53,
        "initiator_bytes": 116,
        "last_seen_epoch": "1561247190.633924",
        "responder_bytes": 180,
        "first_seen_epoch": "1561247190.633595"
      },
      {
        "bytes": 446,
        "stream": 7,
        "flow_id": "flow-dbb80387dc4dc455de04d824",
        "packets": 2,
        "transport": "udp",
        "last_frame": 38,
        "first_frame": 37,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 56961,
        "responder_port": 389,
        "initiator_bytes": 214,
        "last_seen_epoch": "1561247190.636862",
        "responder_bytes": 232,
        "first_seen_epoch": "1561247190.636626"
      },
      {
        "bytes": 9001,
        "stream": 2,
        "flow_id": "flow-659f9cf0df3d9a6bb4466cfa",
        "packets": 28,
        "transport": "tcp",
        "last_frame": 215,
        "first_frame": 39,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49157,
        "responder_port": 389,
        "initiator_bytes": 4390,
        "last_seen_epoch": "1561247190.924639",
        "responder_bytes": 4611,
        "first_seen_epoch": "1561247190.638026"
      },
      {
        "bytes": 5485,
        "stream": 3,
        "flow_id": "flow-7a0e09b652ad141926dcd96f",
        "packets": 14,
        "transport": "tcp",
        "last_frame": 129,
        "first_frame": 45,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49158,
        "responder_port": 389,
        "initiator_bytes": 2605,
        "last_seen_epoch": "1561247190.69421",
        "responder_bytes": 2880,
        "first_seen_epoch": "1561247190.639126"
      },
      {
        "bytes": 990,
        "stream": 4,
        "flow_id": "flow-0d3fc43fc34bcc92793b62f4",
        "packets": 8,
        "transport": "tcp",
        "last_frame": 65,
        "first_frame": 53,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49159,
        "responder_port": 88,
        "initiator_bytes": 472,
        "last_seen_epoch": "1561247190.655615",
        "responder_bytes": 518,
        "first_seen_epoch": "1561247190.653341"
      },
      {
        "bytes": 990,
        "stream": 5,
        "flow_id": "flow-5d500b04548d5f5b9fdb2f23",
        "packets": 8,
        "transport": "tcp",
        "last_frame": 68,
        "first_frame": 55,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49160,
        "responder_port": 88,
        "initiator_bytes": 472,
        "last_seen_epoch": "1561247190.662445",
        "responder_bytes": 518,
        "first_seen_epoch": "1561247190.653834"
      },
      {
        "bytes": 2507,
        "stream": 6,
        "flow_id": "flow-803fbe0ae1a00e76c7e2fa58",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 78,
        "first_frame": 69,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49161,
        "responder_port": 88,
        "initiator_bytes": 606,
        "last_seen_epoch": "1561247190.68179",
        "responder_bytes": 1901,
        "first_seen_epoch": "1561247190.678222"
      },
      {
        "bytes": 3928,
        "stream": 7,
        "flow_id": "flow-5460d355e9786ea03adc8388",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 92,
        "first_frame": 79,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49162,
        "responder_port": 88,
        "initiator_bytes": 1975,
        "last_seen_epoch": "1561247190.684628",
        "responder_bytes": 1953,
        "first_seen_epoch": "1561247190.682499"
      },
      {
        "bytes": 2507,
        "stream": 8,
        "flow_id": "flow-18c3a3eede7b7858bf1d02d5",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 104,
        "first_frame": 87,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49163,
        "responder_port": 88,
        "initiator_bytes": 606,
        "last_seen_epoch": "1561247190.686784",
        "responder_bytes": 1901,
        "first_seen_epoch": "1561247190.68434"
      },
      {
        "bytes": 3955,
        "stream": 9,
        "flow_id": "flow-12c51e6e97a09b12f4d7fe2b",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 120,
        "first_frame": 107,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49164,
        "responder_port": 88,
        "initiator_bytes": 1991,
        "last_seen_epoch": "1561247190.690702",
        "responder_bytes": 1964,
        "first_seen_epoch": "1561247190.687964"
      },
      {
        "bytes": 326,
        "stream": 8,
        "flow_id": "flow-ce015c9ddde7b645ef4e6c42",
        "packets": 2,
        "transport": "udp",
        "last_frame": 125,
        "first_frame": 124,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 61179,
        "responder_port": 53,
        "initiator_bytes": 131,
        "last_seen_epoch": "1561247190.691526",
        "responder_bytes": 195,
        "first_seen_epoch": "1561247190.691217"
      },
      {
        "bytes": 428,
        "stream": 9,
        "flow_id": "flow-b7707371e0a0d0196aee457e",
        "packets": 2,
        "transport": "udp",
        "last_frame": 131,
        "first_frame": 130,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 61180,
        "responder_port": 389,
        "initiator_bytes": 192,
        "last_seen_epoch": "1561247190.69485",
        "responder_bytes": 236,
        "first_seen_epoch": "1561247190.694642"
      },
      {
        "bytes": 6843,
        "stream": 10,
        "flow_id": "flow-29297118a33e308f085b827b",
        "packets": 25,
        "transport": "tcp",
        "last_frame": 523,
        "first_frame": 132,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49165,
        "responder_port": 445,
        "initiator_bytes": 4867,
        "last_seen_epoch": "1561247207.111306",
        "responder_bytes": 1976,
        "first_seen_epoch": "1561247190.695719"
      },
      {
        "bytes": 3928,
        "stream": 11,
        "flow_id": "flow-d4ae975c8faac7fafcc7736d",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 150,
        "first_frame": 139,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49166,
        "responder_port": 88,
        "initiator_bytes": 1975,
        "last_seen_epoch": "1561247190.706638",
        "responder_bytes": 1953,
        "first_seen_epoch": "1561247190.703118"
      },
      {
        "bytes": 3631,
        "stream": 12,
        "flow_id": "flow-81c4053b9fd820fdeeb80422",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 162,
        "first_frame": 151,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49167,
        "responder_port": 88,
        "initiator_bytes": 1809,
        "last_seen_epoch": "1561247190.70864",
        "responder_bytes": 1822,
        "first_seen_epoch": "1561247190.706717"
      },
      {
        "bytes": 348,
        "stream": 13,
        "flow_id": "flow-115b737111b511ab8fb0209b",
        "packets": 6,
        "transport": "tcp",
        "last_frame": 178,
        "first_frame": 172,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49168,
        "responder_port": 389,
        "initiator_bytes": 174,
        "last_seen_epoch": "1561247190.799795",
        "responder_bytes": 174,
        "first_seen_epoch": "1561247190.79673"
      },
      {
        "bytes": 326,
        "stream": 10,
        "flow_id": "flow-2f2c7c40ddd5b5e28dc311c3",
        "packets": 2,
        "transport": "udp",
        "last_frame": 181,
        "first_frame": 180,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59769,
        "responder_port": 53,
        "initiator_bytes": 131,
        "last_seen_epoch": "1561247190.801337",
        "responder_bytes": 195,
        "first_seen_epoch": "1561247190.801087"
      },
      {
        "bytes": 428,
        "stream": 11,
        "flow_id": "flow-2f8ae26689b638d278f43b3b",
        "packets": 2,
        "transport": "udp",
        "last_frame": 183,
        "first_frame": 182,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59770,
        "responder_port": 389,
        "initiator_bytes": 192,
        "last_seen_epoch": "1561247190.802385",
        "responder_bytes": 236,
        "first_seen_epoch": "1561247190.802064"
      },
      {
        "bytes": 348,
        "stream": 14,
        "flow_id": "flow-c874e4b631140c33bea233d5",
        "packets": 6,
        "transport": "tcp",
        "last_frame": 192,
        "first_frame": 186,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49170,
        "responder_port": 389,
        "initiator_bytes": 174,
        "last_seen_epoch": "1561247190.906529",
        "responder_bytes": 174,
        "first_seen_epoch": "1561247190.89666"
      },
      {
        "bytes": 348,
        "stream": 15,
        "flow_id": "flow-bb5c182905ccd6079e6b90c8",
        "packets": 6,
        "transport": "tcp",
        "last_frame": 201,
        "first_frame": 194,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49171,
        "responder_port": 389,
        "initiator_bytes": 174,
        "last_seen_epoch": "1561247190.916605",
        "responder_bytes": 174,
        "first_seen_epoch": "1561247190.907012"
      },
      {
        "bytes": 348,
        "stream": 16,
        "flow_id": "flow-afd13a123bf11ee589545e4d",
        "packets": 6,
        "transport": "tcp",
        "last_frame": 209,
        "first_frame": 203,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49172,
        "responder_port": 389,
        "initiator_bytes": 174,
        "last_seen_epoch": "1561247190.92235",
        "responder_bytes": 174,
        "first_seen_epoch": "1561247190.919701"
      },
      {
        "bytes": 150,
        "stream": 12,
        "flow_id": "flow-e545fb964fdfe2ca9bf7aedb",
        "packets": 2,
        "transport": "udp",
        "last_frame": 233,
        "first_frame": 227,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "224.0.0.252",
        "initiator_port": 60713,
        "responder_port": 5355,
        "initiator_bytes": 150,
        "last_seen_epoch": "1561247192.881095",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247192.786579"
      },
      {
        "bytes": 684,
        "stream": 13,
        "flow_id": "flow-c979848be744cdf2a3affa61",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1395,
        "first_frame": 228,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "255.255.255.255",
        "initiator_port": 68,
        "responder_port": 67,
        "initiator_bytes": 684,
        "last_seen_epoch": "1561247260.59355",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247192.794459"
      },
      {
        "bytes": 684,
        "stream": 14,
        "flow_id": "flow-e1a0d25a1d310795e8887475",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1396,
        "first_frame": 229,
        "initiator_ip": "10.0.76.6",
        "responder_ip": "10.0.76.193",
        "initiator_port": 67,
        "responder_port": 68,
        "initiator_bytes": 684,
        "last_seen_epoch": "1561247260.593853",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247192.794896"
      },
      {
        "bytes": 233,
        "stream": 15,
        "flow_id": "flow-78dac3de759946d455bd9a7a",
        "packets": 2,
        "transport": "udp",
        "last_frame": 231,
        "first_frame": 230,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 64280,
        "responder_port": 53,
        "initiator_bytes": 79,
        "last_seen_epoch": "1561247192.799167",
        "responder_bytes": 154,
        "first_seen_epoch": "1561247192.798982"
      },
      {
        "bytes": 128,
        "stream": 16,
        "flow_id": "flow-14f9b392e3ae3e4d0b2f3d2d",
        "packets": 2,
        "transport": "udp",
        "last_frame": 234,
        "first_frame": 232,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "224.0.0.252",
        "initiator_port": 62348,
        "responder_port": 5355,
        "initiator_bytes": 128,
        "last_seen_epoch": "1561247192.890864",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247192.80007"
      },
      {
        "bytes": 192,
        "stream": 17,
        "flow_id": "flow-5ea71eaf2e8589ebb774fab9",
        "packets": 2,
        "transport": "udp",
        "last_frame": 240,
        "first_frame": 239,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 57110,
        "responder_port": 53,
        "initiator_bytes": 88,
        "last_seen_epoch": "1561247193.919255",
        "responder_bytes": 104,
        "first_seen_epoch": "1561247193.918939"
      },
      {
        "bytes": 237,
        "stream": 18,
        "flow_id": "flow-59a4e4eab3d00942e972c235",
        "packets": 2,
        "transport": "udp",
        "last_frame": 244,
        "first_frame": 242,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 57517,
        "responder_port": 53,
        "initiator_bytes": 81,
        "last_seen_epoch": "1561247193.927737",
        "responder_bytes": 156,
        "first_seen_epoch": "1561247193.927451"
      },
      {
        "bytes": 150,
        "stream": 19,
        "flow_id": "flow-97c73cced5a6eabb75a6f23d",
        "packets": 2,
        "transport": "udp",
        "last_frame": 246,
        "first_frame": 245,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "224.0.0.252",
        "initiator_port": 54678,
        "responder_port": 5355,
        "initiator_bytes": 150,
        "last_seen_epoch": "1561247194.021847",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247193.927976"
      },
      {
        "bytes": 233,
        "stream": 20,
        "flow_id": "flow-989edc22500850f378de46b6",
        "packets": 2,
        "transport": "udp",
        "last_frame": 253,
        "first_frame": 251,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 51790,
        "responder_port": 53,
        "initiator_bytes": 79,
        "last_seen_epoch": "1561247195.371564",
        "responder_bytes": 154,
        "first_seen_epoch": "1561247195.371302"
      },
      {
        "bytes": 152,
        "stream": 21,
        "flow_id": "flow-3d4fc8deed04d7a574830caf",
        "packets": 2,
        "transport": "udp",
        "last_frame": 287,
        "first_frame": 255,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59754,
        "responder_port": 53,
        "initiator_bytes": 76,
        "last_seen_epoch": "1561247195.395072",
        "responder_bytes": 76,
        "first_seen_epoch": "1561247195.371989"
      },
      {
        "bytes": 192,
        "stream": 22,
        "flow_id": "flow-179a4d1e118cdfa0e4c08146",
        "packets": 2,
        "transport": "udp",
        "last_frame": 257,
        "first_frame": 256,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 55747,
        "responder_port": 53,
        "initiator_bytes": 88,
        "last_seen_epoch": "1561247195.372677",
        "responder_bytes": 104,
        "first_seen_epoch": "1561247195.372409"
      },
      {
        "bytes": 10811,
        "stream": 17,
        "flow_id": "flow-64bad640fb266a29327fa324",
        "packets": 37,
        "transport": "tcp",
        "last_frame": 3736,
        "first_frame": 258,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49173,
        "responder_port": 49155,
        "initiator_bytes": 7027,
        "last_seen_epoch": "1561247278.715605",
        "responder_bytes": 3784,
        "first_seen_epoch": "1561247195.373284"
      },
      {
        "bytes": 3955,
        "stream": 18,
        "flow_id": "flow-c9b5db554936897cf4530f82",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 272,
        "first_frame": 261,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49174,
        "responder_port": 88,
        "initiator_bytes": 1991,
        "last_seen_epoch": "1561247195.375629",
        "responder_bytes": 1964,
        "first_seen_epoch": "1561247195.373961"
      },
      {
        "bytes": 128,
        "stream": 23,
        "flow_id": "flow-0f23461ccd6919ec7e828d2b",
        "packets": 2,
        "transport": "udp",
        "last_frame": 293,
        "first_frame": 288,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "224.0.0.252",
        "initiator_port": 63109,
        "responder_port": 5355,
        "initiator_bytes": 128,
        "last_seen_epoch": "1561247195.503044",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247195.395595"
      },
      {
        "bytes": 220,
        "stream": 24,
        "flow_id": "flow-027b2424be15443b907e4a48",
        "packets": 2,
        "transport": "udp",
        "last_frame": 290,
        "first_frame": 289,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 123,
        "responder_port": 123,
        "initiator_bytes": 110,
        "last_seen_epoch": "1561247195.426014",
        "responder_bytes": 110,
        "first_seen_epoch": "1561247195.425037"
      },
      {
        "bytes": 231,
        "stream": 25,
        "flow_id": "flow-7e45856013bc98c61920b6f6",
        "packets": 2,
        "transport": "udp",
        "last_frame": 292,
        "first_frame": 291,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59351,
        "responder_port": 53,
        "initiator_bytes": 78,
        "last_seen_epoch": "1561247195.456212",
        "responder_bytes": 153,
        "first_seen_epoch": "1561247195.455927"
      },
      {
        "bytes": 54,
        "stream": 19,
        "flow_id": "flow-d035741b4fcbefbeb89e2a84",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 298,
        "first_frame": 298,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49226,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247195.705642",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247195.705642"
      },
      {
        "bytes": 54,
        "stream": 20,
        "flow_id": "flow-21c445886ccb201b8eceb846",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 299,
        "first_frame": 299,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49227,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247195.723489",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247195.723489"
      },
      {
        "bytes": 335,
        "stream": 26,
        "flow_id": "flow-f125708132159ec940524fde",
        "packets": 2,
        "transport": "udp",
        "last_frame": 301,
        "first_frame": 300,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 60603,
        "responder_port": 53,
        "initiator_bytes": 130,
        "last_seen_epoch": "1561247195.95897",
        "responder_bytes": 205,
        "first_seen_epoch": "1561247195.958611"
      },
      {
        "bytes": 273,
        "stream": 27,
        "flow_id": "flow-187870cd701ae351e9721b3a",
        "packets": 2,
        "transport": "udp",
        "last_frame": 303,
        "first_frame": 302,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 63739,
        "responder_port": 53,
        "initiator_bytes": 99,
        "last_seen_epoch": "1561247195.95985",
        "responder_bytes": 174,
        "first_seen_epoch": "1561247195.959568"
      },
      {
        "bytes": 8044,
        "stream": 21,
        "flow_id": "flow-63dcbae5f10c5638fd5992d4",
        "packets": 18,
        "transport": "tcp",
        "last_frame": 416,
        "first_frame": 304,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49175,
        "responder_port": 389,
        "initiator_bytes": 3344,
        "last_seen_epoch": "1561247196.415638",
        "responder_bytes": 4700,
        "first_seen_epoch": "1561247195.961955"
      },
      {
        "bytes": 3873,
        "stream": 22,
        "flow_id": "flow-5e35a0be66e3072c6ab10b21",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 326,
        "first_frame": 315,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49176,
        "responder_port": 88,
        "initiator_bytes": 1957,
        "last_seen_epoch": "1561247195.976269",
        "responder_bytes": 1916,
        "first_seen_epoch": "1561247195.974168"
      },
      {
        "bytes": 3435,
        "stream": 23,
        "flow_id": "flow-f196db67101b5f2635a99fd1",
        "packets": 14,
        "transport": "tcp",
        "last_frame": 412,
        "first_frame": 329,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49177,
        "responder_port": 389,
        "initiator_bytes": 2583,
        "last_seen_epoch": "1561247196.001938",
        "responder_bytes": 852,
        "first_seen_epoch": "1561247195.980214"
      },
      {
        "bytes": 3655,
        "stream": 24,
        "flow_id": "flow-85af7eaf2e4676c95b8b908f",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 358,
        "first_frame": 342,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49178,
        "responder_port": 88,
        "initiator_bytes": 1815,
        "last_seen_epoch": "1561247195.989134",
        "responder_bytes": 1840,
        "first_seen_epoch": "1561247195.986427"
      },
      {
        "bytes": 8697,
        "stream": 25,
        "flow_id": "flow-0cb510130de32bdb99fd86a4",
        "packets": 34,
        "transport": "tcp",
        "last_frame": 972,
        "first_frame": 348,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49179,
        "responder_port": 445,
        "initiator_bytes": 5893,
        "last_seen_epoch": "1561247231.118502",
        "responder_bytes": 2804,
        "first_seen_epoch": "1561247195.987749"
      },
      {
        "bytes": 3319,
        "stream": 26,
        "flow_id": "flow-bef495f832ea41440f57ef9a",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 373,
        "first_frame": 359,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49180,
        "responder_port": 88,
        "initiator_bytes": 2895,
        "last_seen_epoch": "1561247195.99179",
        "responder_bytes": 424,
        "first_seen_epoch": "1561247195.989397"
      },
      {
        "bytes": 3928,
        "stream": 27,
        "flow_id": "flow-19442bfc5ae96f7d840e5656",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 380,
        "first_frame": 365,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49181,
        "responder_port": 88,
        "initiator_bytes": 1975,
        "last_seen_epoch": "1561247195.99373",
        "responder_bytes": 1953,
        "first_seen_epoch": "1561247195.990281"
      },
      {
        "bytes": 3631,
        "stream": 28,
        "flow_id": "flow-515774de2dbb1b4565c9f620",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 392,
        "first_frame": 381,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49182,
        "responder_port": 88,
        "initiator_bytes": 1809,
        "last_seen_epoch": "1561247195.995244",
        "responder_bytes": 1822,
        "first_seen_epoch": "1561247195.993981"
      },
      {
        "bytes": 85,
        "stream": 29,
        "flow_id": "flow-8aed6c77a7b6d34b45f2c269",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 418,
        "first_frame": 418,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49229,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247196.937152",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247196.937152"
      },
      {
        "bytes": 257,
        "stream": 28,
        "flow_id": "flow-7528ee69c86ae8f7fa7c7d64",
        "packets": 2,
        "transport": "udp",
        "last_frame": 421,
        "first_frame": 420,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 54745,
        "responder_port": 53,
        "initiator_bytes": 90,
        "last_seen_epoch": "1561247197.797726",
        "responder_bytes": 167,
        "first_seen_epoch": "1561247197.797419"
      },
      {
        "bytes": 312,
        "stream": 29,
        "flow_id": "flow-b749eb1f0af965c7c4b3abf8",
        "packets": 2,
        "transport": "udp",
        "last_frame": 423,
        "first_frame": 422,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 64657,
        "responder_port": 53,
        "initiator_bytes": 156,
        "last_seen_epoch": "1561247197.799092",
        "responder_bytes": 156,
        "first_seen_epoch": "1561247197.798498"
      },
      {
        "bytes": 258,
        "stream": 30,
        "flow_id": "flow-089ab96c9ffaa0ef6ca3b5d7",
        "packets": 2,
        "transport": "udp",
        "last_frame": 425,
        "first_frame": 424,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 52027,
        "responder_port": 53,
        "initiator_bytes": 76,
        "last_seen_epoch": "1561247198.020798",
        "responder_bytes": 182,
        "first_seen_epoch": "1561247198.002372"
      },
      {
        "bytes": 258,
        "stream": 31,
        "flow_id": "flow-62fd64399854783ff56d1adc",
        "packets": 2,
        "transport": "udp",
        "last_frame": 427,
        "first_frame": 426,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 61007,
        "responder_port": 53,
        "initiator_bytes": 76,
        "last_seen_epoch": "1561247198.022718",
        "responder_bytes": 182,
        "first_seen_epoch": "1561247198.02234"
      },
      {
        "bytes": 778,
        "stream": 30,
        "flow_id": "flow-910aafd6d237b430428164ec",
        "packets": 9,
        "transport": "tcp",
        "last_frame": 436,
        "first_frame": 428,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "23.63.249.186",
        "initiator_port": 49183,
        "responder_port": 80,
        "initiator_bytes": 379,
        "last_seen_epoch": "1561247198.050414",
        "responder_bytes": 399,
        "first_seen_epoch": "1561247198.02439"
      },
      {
        "bytes": 85,
        "stream": 31,
        "flow_id": "flow-5a8b68b65eac37ac0377d1b4",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 437,
        "first_frame": 437,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49228,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247198.322058",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247198.322058"
      },
      {
        "bytes": 85,
        "stream": 32,
        "flow_id": "flow-db73f91b024bc90bab378032",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 438,
        "first_frame": 438,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49245,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247198.938433",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247198.938433"
      },
      {
        "bytes": 85,
        "stream": 33,
        "flow_id": "flow-1a57603020d9aa0a0d6672c1",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 439,
        "first_frame": 439,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49244,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247198.93848",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247198.93848"
      },
      {
        "bytes": 85,
        "stream": 34,
        "flow_id": "flow-efbcd348c4318d259c8ee7ff",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 440,
        "first_frame": 440,
        "initiator_ip": "31.13.65.36",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49242,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247200.147469",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247200.147469"
      },
      {
        "bytes": 85,
        "stream": 35,
        "flow_id": "flow-c3da49911e04ebb0540ffac5",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 441,
        "first_frame": 441,
        "initiator_ip": "31.13.65.36",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49243,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247200.178826",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247200.178826"
      },
      {
        "bytes": 85,
        "stream": 36,
        "flow_id": "flow-b3e90239e70d27673536e246",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 442,
        "first_frame": 442,
        "initiator_ip": "31.13.65.36",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49250,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247200.422643",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247200.422643"
      },
      {
        "bytes": 85,
        "stream": 37,
        "flow_id": "flow-5851e66aded5738e501b1c69",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 443,
        "first_frame": 443,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49251,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247201.004159",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247201.004159"
      },
      {
        "bytes": 85,
        "stream": 38,
        "flow_id": "flow-0b7fb824b6cea6a68aa330ba",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 444,
        "first_frame": 444,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49253,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247201.004179",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247201.004179"
      },
      {
        "bytes": 85,
        "stream": 39,
        "flow_id": "flow-7dd0123e5228032462ecc0ea",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 445,
        "first_frame": 445,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49254,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247201.004189",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247201.004189"
      },
      {
        "bytes": 85,
        "stream": 40,
        "flow_id": "flow-1985f03bca0747543a83ff5f",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 446,
        "first_frame": 446,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49252,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247201.004952",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247201.004952"
      },
      {
        "bytes": 7174,
        "stream": 41,
        "flow_id": "flow-575f1cb23347748147ad9134",
        "packets": 21,
        "transport": "tcp",
        "last_frame": 510,
        "first_frame": 447,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49185,
        "responder_port": 389,
        "initiator_bytes": 3405,
        "last_seen_epoch": "1561247201.267147",
        "responder_bytes": 3769,
        "first_seen_epoch": "1561247201.218981"
      },
      {
        "bytes": 4166,
        "stream": 42,
        "flow_id": "flow-f336896d50c3b9c1d218187f",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 508,
        "first_frame": 466,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49186,
        "responder_port": 389,
        "initiator_bytes": 3354,
        "last_seen_epoch": "1561247201.266688",
        "responder_bytes": 812,
        "first_seen_epoch": "1561247201.233561"
      },
      {
        "bytes": 990,
        "stream": 43,
        "flow_id": "flow-3ef6e896965047c551df75ea",
        "packets": 8,
        "transport": "tcp",
        "last_frame": 482,
        "first_frame": 475,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49187,
        "responder_port": 88,
        "initiator_bytes": 472,
        "last_seen_epoch": "1561247201.243152",
        "responder_bytes": 518,
        "first_seen_epoch": "1561247201.242155"
      },
      {
        "bytes": 2507,
        "stream": 44,
        "flow_id": "flow-f2c46b6f8fb2c0b1b9b45c59",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 492,
        "first_frame": 483,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49188,
        "responder_port": 88,
        "initiator_bytes": 606,
        "last_seen_epoch": "1561247201.260494",
        "responder_bytes": 1901,
        "first_seen_epoch": "1561247201.258988"
      },
      {
        "bytes": 3811,
        "stream": 45,
        "flow_id": "flow-8212a3573e26c7148a295998",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 504,
        "first_frame": 493,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49189,
        "responder_port": 88,
        "initiator_bytes": 1923,
        "last_seen_epoch": "1561247201.262704",
        "responder_bytes": 1888,
        "first_seen_epoch": "1561247201.261391"
      },
      {
        "bytes": 85,
        "stream": 46,
        "flow_id": "flow-5616403354bb42b9ed5a4dbc",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 511,
        "first_frame": 511,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.109",
        "initiator_port": 443,
        "responder_port": 49216,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247204.640775",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247204.640775"
      },
      {
        "bytes": 85,
        "stream": 47,
        "flow_id": "flow-a07911e5472dc8112ebb9c85",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 512,
        "first_frame": 512,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.109",
        "initiator_port": 443,
        "responder_port": 49215,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247204.749336",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247204.749336"
      },
      {
        "bytes": 85,
        "stream": 48,
        "flow_id": "flow-151b07b89f367acfffd20de1",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 513,
        "first_frame": 513,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.109",
        "initiator_port": 443,
        "responder_port": 49219,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247205.424685",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247205.424685"
      },
      {
        "bytes": 85,
        "stream": 49,
        "flow_id": "flow-7b645de40a362ee5a587c4d9",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 514,
        "first_frame": 514,
        "initiator_ip": "31.13.65.7",
        "responder_ip": "10.0.76.109",
        "initiator_port": 443,
        "responder_port": 49220,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247205.4247",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247205.4247"
      },
      {
        "bytes": 85,
        "stream": 50,
        "flow_id": "flow-29c86452d8e6dc9a80c84e2e",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 515,
        "first_frame": 515,
        "initiator_ip": "31.13.65.36",
        "responder_ip": "10.0.76.109",
        "initiator_port": 443,
        "responder_port": 49221,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247205.643103",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247205.643103"
      },
      {
        "bytes": 85,
        "stream": 51,
        "flow_id": "flow-54d87316ff84d960a785dda2",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 516,
        "first_frame": 516,
        "initiator_ip": "31.13.65.36",
        "responder_ip": "10.0.76.109",
        "initiator_port": 443,
        "responder_port": 49222,
        "initiator_bytes": 85,
        "last_seen_epoch": "1561247205.666326",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247205.666326"
      },
      {
        "bytes": 604,
        "stream": 52,
        "flow_id": "flow-b3308868f70e0aead287310d",
        "packets": 11,
        "transport": "tcp",
        "last_frame": 769,
        "first_frame": 517,
        "initiator_ip": "10.0.76.6",
        "responder_ip": "10.0.76.193",
        "initiator_port": 445,
        "responder_port": 49270,
        "initiator_bytes": 604,
        "last_seen_epoch": "1561247225.74616",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247205.685602"
      },
      {
        "bytes": 150,
        "stream": 32,
        "flow_id": "flow-ae601e4a25dc917a158147da",
        "packets": 2,
        "transport": "udp",
        "last_frame": 551,
        "first_frame": 549,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "224.0.0.252",
        "initiator_port": 50143,
        "responder_port": 5355,
        "initiator_bytes": 150,
        "last_seen_epoch": "1561247224.591823",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247224.490383"
      },
      {
        "bytes": 2424,
        "stream": 33,
        "flow_id": "flow-bd4ef95c3ba363793ddb38c0",
        "packets": 24,
        "transport": "udp",
        "last_frame": 5205,
        "first_frame": 552,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.255",
        "initiator_port": 137,
        "responder_port": 137,
        "initiator_bytes": 2424,
        "last_seen_epoch": "1561247309.150698",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247225.057759"
      },
      {
        "bytes": 254,
        "stream": 34,
        "flow_id": "flow-996727c2822896178ada4b29",
        "packets": 2,
        "transport": "udp",
        "last_frame": 555,
        "first_frame": 554,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 55150,
        "responder_port": 53,
        "initiator_bytes": 95,
        "last_seen_epoch": "1561247225.092523",
        "responder_bytes": 159,
        "first_seen_epoch": "1561247225.091502"
      },
      {
        "bytes": 316,
        "stream": 35,
        "flow_id": "flow-5be6b29c4c3ac2f7fcbff553",
        "packets": 2,
        "transport": "udp",
        "last_frame": 557,
        "first_frame": 556,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 57301,
        "responder_port": 53,
        "initiator_bytes": 126,
        "last_seen_epoch": "1561247225.100838",
        "responder_bytes": 190,
        "first_seen_epoch": "1561247225.100538"
      },
      {
        "bytes": 192,
        "stream": 36,
        "flow_id": "flow-a0232ca4fb9eef55eeefd277",
        "packets": 2,
        "transport": "udp",
        "last_frame": 559,
        "first_frame": 558,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 50880,
        "responder_port": 53,
        "initiator_bytes": 88,
        "last_seen_epoch": "1561247225.116693",
        "responder_bytes": 104,
        "first_seen_epoch": "1561247225.116361"
      },
      {
        "bytes": 489,
        "stream": 37,
        "flow_id": "flow-cb65997e452f22f39d8c0fc7",
        "packets": 2,
        "transport": "udp",
        "last_frame": 561,
        "first_frame": 560,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 50882,
        "responder_port": 389,
        "initiator_bytes": 257,
        "last_seen_epoch": "1561247225.134382",
        "responder_bytes": 232,
        "first_seen_epoch": "1561247225.134061"
      },
      {
        "bytes": 445,
        "stream": 38,
        "flow_id": "flow-233ac1116266bfc417d68903",
        "packets": 2,
        "transport": "udp",
        "last_frame": 563,
        "first_frame": 562,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 50884,
        "responder_port": 389,
        "initiator_bytes": 213,
        "last_seen_epoch": "1561247225.149882",
        "responder_bytes": 232,
        "first_seen_epoch": "1561247225.149562"
      },
      {
        "bytes": 1878,
        "stream": 53,
        "flow_id": "flow-9d16fb474f6ec207785f3ec8",
        "packets": 15,
        "transport": "tcp",
        "last_frame": 1223,
        "first_frame": 564,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49155,
        "responder_port": 135,
        "initiator_bytes": 994,
        "last_seen_epoch": "1561247253.464579",
        "responder_bytes": 884,
        "first_seen_epoch": "1561247225.235503"
      },
      {
        "bytes": 4496,
        "stream": 54,
        "flow_id": "flow-edc57b92ef0b0c4b2acdcd3c",
        "packets": 20,
        "transport": "tcp",
        "last_frame": 1221,
        "first_frame": 571,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49156,
        "responder_port": 49158,
        "initiator_bytes": 2614,
        "last_seen_epoch": "1561247253.463872",
        "responder_bytes": 1882,
        "first_seen_epoch": "1561247225.238544"
      },
      {
        "bytes": 9055,
        "stream": 55,
        "flow_id": "flow-a2e3f060b19a598123681c5b",
        "packets": 29,
        "transport": "tcp",
        "last_frame": 767,
        "first_frame": 586,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49157,
        "responder_port": 389,
        "initiator_bytes": 4390,
        "last_seen_epoch": "1561247225.640938",
        "responder_bytes": 4665,
        "first_seen_epoch": "1561247225.250851"
      },
      {
        "bytes": 990,
        "stream": 56,
        "flow_id": "flow-2e339160c7ea4a88feacea72",
        "packets": 8,
        "transport": "tcp",
        "last_frame": 600,
        "first_frame": 593,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49158,
        "responder_port": 88,
        "initiator_bytes": 472,
        "last_seen_epoch": "1561247225.273763",
        "responder_bytes": 518,
        "first_seen_epoch": "1561247225.272273"
      },
      {
        "bytes": 2507,
        "stream": 57,
        "flow_id": "flow-bd2bd76a75d4db74462acd0a",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 610,
        "first_frame": 601,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49159,
        "responder_port": 88,
        "initiator_bytes": 606,
        "last_seen_epoch": "1561247225.297836",
        "responder_bytes": 1901,
        "first_seen_epoch": "1561247225.295896"
      },
      {
        "bytes": 3928,
        "stream": 58,
        "flow_id": "flow-924f7aef6b725c084a63599f",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 622,
        "first_frame": 611,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49160,
        "responder_port": 88,
        "initiator_bytes": 1975,
        "last_seen_epoch": "1561247225.309761",
        "responder_bytes": 1953,
        "first_seen_epoch": "1561247225.30062"
      },
      {
        "bytes": 326,
        "stream": 39,
        "flow_id": "flow-b9821608a292bc4b4b6fc524",
        "packets": 2,
        "transport": "udp",
        "last_frame": 632,
        "first_frame": 631,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 50325,
        "responder_port": 53,
        "initiator_bytes": 131,
        "last_seen_epoch": "1561247225.319824",
        "responder_bytes": 195,
        "first_seen_epoch": "1561247225.31942"
      },
      {
        "bytes": 428,
        "stream": 40,
        "flow_id": "flow-42fd295b6bffd4abbefde2f7",
        "packets": 2,
        "transport": "udp",
        "last_frame": 634,
        "first_frame": 633,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 50326,
        "responder_port": 389,
        "initiator_bytes": 192,
        "last_seen_epoch": "1561247225.323328",
        "responder_bytes": 236,
        "first_seen_epoch": "1561247225.323028"
      },
      {
        "bytes": 6843,
        "stream": 59,
        "flow_id": "flow-0a38e45427f79d15a4ab0b96",
        "packets": 25,
        "transport": "tcp",
        "last_frame": 1191,
        "first_frame": 635,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49161,
        "responder_port": 445,
        "initiator_bytes": 4867,
        "last_seen_epoch": "1561247241.91958",
        "responder_bytes": 1976,
        "first_seen_epoch": "1561247225.34867"
      },
      {
        "bytes": 990,
        "stream": 60,
        "flow_id": "flow-5621b220fed6c19c27b85f47",
        "packets": 8,
        "transport": "tcp",
        "last_frame": 649,
        "first_frame": 642,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49162,
        "responder_port": 88,
        "initiator_bytes": 472,
        "last_seen_epoch": "1561247225.351939",
        "responder_bytes": 518,
        "first_seen_epoch": "1561247225.350932"
      },
      {
        "bytes": 2507,
        "stream": 61,
        "flow_id": "flow-5a4851109403c7c08df28093",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 659,
        "first_frame": 650,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49163,
        "responder_port": 88,
        "initiator_bytes": 606,
        "last_seen_epoch": "1561247225.370483",
        "responder_bytes": 1901,
        "first_seen_epoch": "1561247225.368701"
      },
      {
        "bytes": 3928,
        "stream": 62,
        "flow_id": "flow-fbabbc7cd77dd394afaf9125",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 671,
        "first_frame": 660,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49164,
        "responder_port": 88,
        "initiator_bytes": 1975,
        "last_seen_epoch": "1561247225.374907",
        "responder_bytes": 1953,
        "first_seen_epoch": "1561247225.371833"
      },
      {
        "bytes": 3631,
        "stream": 63,
        "flow_id": "flow-437aba17bec366168ecc46ed",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 683,
        "first_frame": 672,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49165,
        "responder_port": 88,
        "initiator_bytes": 1809,
        "last_seen_epoch": "1561247225.376799",
        "responder_bytes": 1822,
        "first_seen_epoch": "1561247225.375004"
      },
      {
        "bytes": 348,
        "stream": 64,
        "flow_id": "flow-25d2220f6bd06e3797575c59",
        "packets": 6,
        "transport": "tcp",
        "last_frame": 699,
        "first_frame": 693,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49166,
        "responder_port": 389,
        "initiator_bytes": 174,
        "last_seen_epoch": "1561247225.427904",
        "responder_bytes": 174,
        "first_seen_epoch": "1561247225.41976"
      },
      {
        "bytes": 326,
        "stream": 41,
        "flow_id": "flow-272876f07744214e25e124c8",
        "packets": 2,
        "transport": "udp",
        "last_frame": 702,
        "first_frame": 701,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59464,
        "responder_port": 53,
        "initiator_bytes": 131,
        "last_seen_epoch": "1561247225.429056",
        "responder_bytes": 195,
        "first_seen_epoch": "1561247225.428713"
      },
      {
        "bytes": 428,
        "stream": 42,
        "flow_id": "flow-ab9d5d8f230001fccc51f40a",
        "packets": 2,
        "transport": "udp",
        "last_frame": 704,
        "first_frame": 703,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59465,
        "responder_port": 389,
        "initiator_bytes": 192,
        "last_seen_epoch": "1561247225.431102",
        "responder_bytes": 236,
        "first_seen_epoch": "1561247225.430756"
      },
      {
        "bytes": 296,
        "stream": 43,
        "flow_id": "flow-a16fd82ab40eaef819e0f129",
        "packets": 2,
        "transport": "udp",
        "last_frame": 707,
        "first_frame": 706,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 56904,
        "responder_port": 53,
        "initiator_bytes": 116,
        "last_seen_epoch": "1561247225.506478",
        "responder_bytes": 180,
        "first_seen_epoch": "1561247225.50621"
      },
      {
        "bytes": 446,
        "stream": 44,
        "flow_id": "flow-b5ad4225714fad9fc37d7fc4",
        "packets": 2,
        "transport": "udp",
        "last_frame": 709,
        "first_frame": 708,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 56905,
        "responder_port": 389,
        "initiator_bytes": 214,
        "last_seen_epoch": "1561247225.507519",
        "responder_bytes": 232,
        "first_seen_epoch": "1561247225.507288"
      },
      {
        "bytes": 348,
        "stream": 65,
        "flow_id": "flow-0d3216d5d72114017d8c0600",
        "packets": 6,
        "transport": "tcp",
        "last_frame": 715,
        "first_frame": 710,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49167,
        "responder_port": 389,
        "initiator_bytes": 174,
        "last_seen_epoch": "1561247225.533328",
        "responder_bytes": 174,
        "first_seen_epoch": "1561247225.532072"
      },
      {
        "bytes": 445,
        "stream": 45,
        "flow_id": "flow-3f5ab7ac1a45db06b204dc26",
        "packets": 2,
        "transport": "udp",
        "last_frame": 719,
        "first_frame": 718,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 56906,
        "responder_port": 389,
        "initiator_bytes": 213,
        "last_seen_epoch": "1561247225.534995",
        "responder_bytes": 232,
        "first_seen_epoch": "1561247225.534735"
      },
      {
        "bytes": 5431,
        "stream": 66,
        "flow_id": "flow-f8036be11b8f6bb321449b53",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 745,
        "first_frame": 721,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49168,
        "responder_port": 389,
        "initiator_bytes": 2551,
        "last_seen_epoch": "1561247225.619841",
        "responder_bytes": 2880,
        "first_seen_epoch": "1561247225.612224"
      },
      {
        "bytes": 3955,
        "stream": 67,
        "flow_id": "flow-ac3bb5d5df1ae36a36551173",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 739,
        "first_frame": 728,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49169,
        "responder_port": 88,
        "initiator_bytes": 1991,
        "last_seen_epoch": "1561247225.617345",
        "responder_bytes": 1964,
        "first_seen_epoch": "1561247225.615606"
      },
      {
        "bytes": 348,
        "stream": 68,
        "flow_id": "flow-a5ac44f32ca8d72cb9b5edcb",
        "packets": 6,
        "transport": "tcp",
        "last_frame": 752,
        "first_frame": 746,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49170,
        "responder_port": 389,
        "initiator_bytes": 174,
        "last_seen_epoch": "1561247225.633039",
        "responder_bytes": 174,
        "first_seen_epoch": "1561247225.631984"
      },
      {
        "bytes": 348,
        "stream": 69,
        "flow_id": "flow-32e2036ce237f2e60fbdce07",
        "packets": 6,
        "transport": "tcp",
        "last_frame": 760,
        "first_frame": 754,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49171,
        "responder_port": 389,
        "initiator_bytes": 174,
        "last_seen_epoch": "1561247225.636492",
        "responder_bytes": 174,
        "first_seen_epoch": "1561247225.635365"
      },
      {
        "bytes": 10781,
        "stream": 70,
        "flow_id": "flow-1a9e0b190a86d8a0f6e3c576",
        "packets": 37,
        "transport": "tcp",
        "last_frame": 5917,
        "first_frame": 777,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49173,
        "responder_port": 49155,
        "initiator_bytes": 6997,
        "last_seen_epoch": "1561247313.456866",
        "responder_bytes": 3784,
        "first_seen_epoch": "1561247225.989885"
      },
      {
        "bytes": 3955,
        "stream": 71,
        "flow_id": "flow-f2037fcf9dd8c9371fcca8a0",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 791,
        "first_frame": 780,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49174,
        "responder_port": 88,
        "initiator_bytes": 1991,
        "last_seen_epoch": "1561247225.992631",
        "responder_bytes": 1964,
        "first_seen_epoch": "1561247225.990899"
      },
      {
        "bytes": 335,
        "stream": 46,
        "flow_id": "flow-44461ace3a5b1a867f256b47",
        "packets": 2,
        "transport": "udp",
        "last_frame": 810,
        "first_frame": 809,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 63725,
        "responder_port": 53,
        "initiator_bytes": 130,
        "last_seen_epoch": "1561247226.539295",
        "responder_bytes": 205,
        "first_seen_epoch": "1561247226.538965"
      },
      {
        "bytes": 273,
        "stream": 47,
        "flow_id": "flow-6317e7af71863a49d648aa92",
        "packets": 2,
        "transport": "udp",
        "last_frame": 812,
        "first_frame": 811,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 51173,
        "responder_port": 53,
        "initiator_bytes": 99,
        "last_seen_epoch": "1561247226.53988",
        "responder_bytes": 174,
        "first_seen_epoch": "1561247226.539716"
      },
      {
        "bytes": 8044,
        "stream": 72,
        "flow_id": "flow-6840ba090216cf7556c71e17",
        "packets": 18,
        "transport": "tcp",
        "last_frame": 927,
        "first_frame": 813,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49175,
        "responder_port": 389,
        "initiator_bytes": 3344,
        "last_seen_epoch": "1561247226.974238",
        "responder_bytes": 4700,
        "first_seen_epoch": "1561247226.541318"
      },
      {
        "bytes": 3873,
        "stream": 73,
        "flow_id": "flow-387c06c1bc69908c54990be3",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 835,
        "first_frame": 824,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49176,
        "responder_port": 88,
        "initiator_bytes": 1957,
        "last_seen_epoch": "1561247226.554843",
        "responder_bytes": 1916,
        "first_seen_epoch": "1561247226.55328"
      },
      {
        "bytes": 3381,
        "stream": 74,
        "flow_id": "flow-45e8676476c2a4555a553aa7",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 922,
        "first_frame": 838,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49177,
        "responder_port": 389,
        "initiator_bytes": 2529,
        "last_seen_epoch": "1561247226.578307",
        "responder_bytes": 852,
        "first_seen_epoch": "1561247226.559977"
      },
      {
        "bytes": 3655,
        "stream": 75,
        "flow_id": "flow-da8d7b8eb194770206402467",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 864,
        "first_frame": 853,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49178,
        "responder_port": 88,
        "initiator_bytes": 1815,
        "last_seen_epoch": "1561247226.567617",
        "responder_bytes": 1840,
        "first_seen_epoch": "1561247226.566"
      },
      {
        "bytes": 3319,
        "stream": 76,
        "flow_id": "flow-fc24e739cc58a860ef59dbc0",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 878,
        "first_frame": 865,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49179,
        "responder_port": 88,
        "initiator_bytes": 2895,
        "last_seen_epoch": "1561247226.569056",
        "responder_bytes": 424,
        "first_seen_epoch": "1561247226.567829"
      },
      {
        "bytes": 8697,
        "stream": 77,
        "flow_id": "flow-8a01f890fcec30b44a29c452",
        "packets": 34,
        "transport": "tcp",
        "last_frame": 3197,
        "first_frame": 872,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49180,
        "responder_port": 445,
        "initiator_bytes": 5893,
        "last_seen_epoch": "1561247265.912077",
        "responder_bytes": 2804,
        "first_seen_epoch": "1561247226.568689"
      },
      {
        "bytes": 3928,
        "stream": 78,
        "flow_id": "flow-30055d72b81b7702562ae626",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 891,
        "first_frame": 880,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49181,
        "responder_port": 88,
        "initiator_bytes": 1975,
        "last_seen_epoch": "1561247226.571277",
        "responder_bytes": 1953,
        "first_seen_epoch": "1561247226.569892"
      },
      {
        "bytes": 3631,
        "stream": 79,
        "flow_id": "flow-85ab7318968f5bfe53e8fffd",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 903,
        "first_frame": 892,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49182,
        "responder_port": 88,
        "initiator_bytes": 1809,
        "last_seen_epoch": "1561247226.572219",
        "responder_bytes": 1822,
        "first_seen_epoch": "1561247226.571368"
      },
      {
        "bytes": 150,
        "stream": 48,
        "flow_id": "flow-dcf3f1a63d2ce84b1f4d9b70",
        "packets": 2,
        "transport": "udp",
        "last_frame": 939,
        "first_frame": 933,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "224.0.0.252",
        "initiator_port": 65523,
        "responder_port": 5355,
        "initiator_bytes": 150,
        "last_seen_epoch": "1561247227.646379",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247227.554237"
      },
      {
        "bytes": 684,
        "stream": 49,
        "flow_id": "flow-e653aebf95e75d9f11e6ccfb",
        "packets": 2,
        "transport": "udp",
        "last_frame": 4887,
        "first_frame": 934,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "255.255.255.255",
        "initiator_port": 68,
        "responder_port": 67,
        "initiator_bytes": 684,
        "last_seen_epoch": "1561247302.516656",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247227.558291"
      },
      {
        "bytes": 684,
        "stream": 50,
        "flow_id": "flow-b38c7b42360d273f9fbf700a",
        "packets": 2,
        "transport": "udp",
        "last_frame": 4888,
        "first_frame": 935,
        "initiator_ip": "10.0.76.6",
        "responder_ip": "10.0.76.109",
        "initiator_port": 67,
        "responder_port": 68,
        "initiator_bytes": 684,
        "last_seen_epoch": "1561247302.516962",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247227.558583"
      },
      {
        "bytes": 233,
        "stream": 51,
        "flow_id": "flow-c4f95d839eed8c212d805f2b",
        "packets": 2,
        "transport": "udp",
        "last_frame": 937,
        "first_frame": 936,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 55051,
        "responder_port": 53,
        "initiator_bytes": 79,
        "last_seen_epoch": "1561247227.565241",
        "responder_bytes": 154,
        "first_seen_epoch": "1561247227.565048"
      },
      {
        "bytes": 128,
        "stream": 52,
        "flow_id": "flow-ff9944e9aaa950c96243d910",
        "packets": 2,
        "transport": "udp",
        "last_frame": 940,
        "first_frame": 938,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "224.0.0.252",
        "initiator_port": 64444,
        "responder_port": 5355,
        "initiator_bytes": 128,
        "last_seen_epoch": "1561247227.676289",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247227.576247"
      },
      {
        "bytes": 237,
        "stream": 53,
        "flow_id": "flow-01b51365a5f9f9fab93bd055",
        "packets": 2,
        "transport": "udp",
        "last_frame": 946,
        "first_frame": 945,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 61334,
        "responder_port": 53,
        "initiator_bytes": 81,
        "last_seen_epoch": "1561247228.852537",
        "responder_bytes": 156,
        "first_seen_epoch": "1561247228.852283"
      },
      {
        "bytes": 192,
        "stream": 54,
        "flow_id": "flow-72ce3377c30dbc8283d123d0",
        "packets": 2,
        "transport": "udp",
        "last_frame": 948,
        "first_frame": 947,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 63173,
        "responder_port": 53,
        "initiator_bytes": 88,
        "last_seen_epoch": "1561247228.853164",
        "responder_bytes": 104,
        "first_seen_epoch": "1561247228.852987"
      },
      {
        "bytes": 231,
        "stream": 55,
        "flow_id": "flow-d9051611eff1990cdb4e66ee",
        "packets": 2,
        "transport": "udp",
        "last_frame": 950,
        "first_frame": 949,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 62122,
        "responder_port": 53,
        "initiator_bytes": 78,
        "last_seen_epoch": "1561247229.00356",
        "responder_bytes": 153,
        "first_seen_epoch": "1561247229.003302"
      },
      {
        "bytes": 258,
        "stream": 56,
        "flow_id": "flow-10315f12b14900a649cd6068",
        "packets": 2,
        "transport": "udp",
        "last_frame": 953,
        "first_frame": 952,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 52364,
        "responder_port": 53,
        "initiator_bytes": 76,
        "last_seen_epoch": "1561247230.169089",
        "responder_bytes": 182,
        "first_seen_epoch": "1561247230.144568"
      },
      {
        "bytes": 258,
        "stream": 57,
        "flow_id": "flow-5eed5ae28518fb09377d33c1",
        "packets": 2,
        "transport": "udp",
        "last_frame": 955,
        "first_frame": 954,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 50027,
        "responder_port": 53,
        "initiator_bytes": 76,
        "last_seen_epoch": "1561247230.171042",
        "responder_bytes": 182,
        "first_seen_epoch": "1561247230.17074"
      },
      {
        "bytes": 832,
        "stream": 80,
        "flow_id": "flow-ad8ca1dab816d32574e8ca81",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 965,
        "first_frame": 956,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "23.63.249.144",
        "initiator_port": 49183,
        "responder_port": 80,
        "initiator_bytes": 379,
        "last_seen_epoch": "1561247230.202477",
        "responder_bytes": 453,
        "first_seen_epoch": "1561247230.174944"
      },
      {
        "bytes": 220,
        "stream": 58,
        "flow_id": "flow-a34ab6585c922991555c866c",
        "packets": 2,
        "transport": "udp",
        "last_frame": 967,
        "first_frame": 966,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 123,
        "responder_port": 123,
        "initiator_bytes": 110,
        "last_seen_epoch": "1561247230.360907",
        "responder_bytes": 110,
        "first_seen_epoch": "1561247230.359255"
      },
      {
        "bytes": 257,
        "stream": 59,
        "flow_id": "flow-570bf6b065e4505616e43c10",
        "packets": 2,
        "transport": "udp",
        "last_frame": 974,
        "first_frame": 973,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 57604,
        "responder_port": 53,
        "initiator_bytes": 90,
        "last_seen_epoch": "1561247232.56008",
        "responder_bytes": 167,
        "first_seen_epoch": "1561247232.559801"
      },
      {
        "bytes": 312,
        "stream": 60,
        "flow_id": "flow-c2a94622dac82e73e449c296",
        "packets": 2,
        "transport": "udp",
        "last_frame": 976,
        "first_frame": 975,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 56860,
        "responder_port": 53,
        "initiator_bytes": 156,
        "last_seen_epoch": "1561247232.561538",
        "responder_bytes": 156,
        "first_seen_epoch": "1561247232.560966"
      },
      {
        "bytes": 7174,
        "stream": 81,
        "flow_id": "flow-e0ee6438c1ba14b184974b0f",
        "packets": 21,
        "transport": "tcp",
        "last_frame": 1040,
        "first_frame": 977,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49185,
        "responder_port": 389,
        "initiator_bytes": 3405,
        "last_seen_epoch": "1561247235.840283",
        "responder_bytes": 3769,
        "first_seen_epoch": "1561247235.78701"
      },
      {
        "bytes": 4166,
        "stream": 82,
        "flow_id": "flow-737199e74ca0716b54841f93",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 1038,
        "first_frame": 996,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49186,
        "responder_port": 389,
        "initiator_bytes": 3354,
        "last_seen_epoch": "1561247235.839689",
        "responder_bytes": 812,
        "first_seen_epoch": "1561247235.804775"
      },
      {
        "bytes": 990,
        "stream": 83,
        "flow_id": "flow-c226493f26d168abbd7e8010",
        "packets": 8,
        "transport": "tcp",
        "last_frame": 1012,
        "first_frame": 1005,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49187,
        "responder_port": 88,
        "initiator_bytes": 472,
        "last_seen_epoch": "1561247235.814764",
        "responder_bytes": 518,
        "first_seen_epoch": "1561247235.813689"
      },
      {
        "bytes": 2507,
        "stream": 84,
        "flow_id": "flow-7bf297de20e495b6d512852e",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 1022,
        "first_frame": 1013,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49188,
        "responder_port": 88,
        "initiator_bytes": 606,
        "last_seen_epoch": "1561247235.831372",
        "responder_bytes": 1901,
        "first_seen_epoch": "1561247235.83001"
      },
      {
        "bytes": 3811,
        "stream": 85,
        "flow_id": "flow-8ebca36693c84d877a6a881d",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1034,
        "first_frame": 1023,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49189,
        "responder_port": 88,
        "initiator_bytes": 1923,
        "last_seen_epoch": "1561247235.835315",
        "responder_bytes": 1888,
        "first_seen_epoch": "1561247235.833731"
      },
      {
        "bytes": 931,
        "stream": 86,
        "flow_id": "flow-e2897924281af27f0c3ce021",
        "packets": 8,
        "transport": "tcp",
        "last_frame": 1048,
        "first_frame": 1041,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49190,
        "responder_port": 88,
        "initiator_bytes": 463,
        "last_seen_epoch": "1561247238.239112",
        "responder_bytes": 468,
        "first_seen_epoch": "1561247238.237015"
      },
      {
        "bytes": 2501,
        "stream": 87,
        "flow_id": "flow-2f7ff368957f3939fcb0de57",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 1058,
        "first_frame": 1049,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49191,
        "responder_port": 88,
        "initiator_bytes": 597,
        "last_seen_epoch": "1561247238.252557",
        "responder_bytes": 1904,
        "first_seen_epoch": "1561247238.249938"
      },
      {
        "bytes": 3716,
        "stream": 88,
        "flow_id": "flow-8871f676edc7338b7c495b42",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1070,
        "first_frame": 1059,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49192,
        "responder_port": 88,
        "initiator_bytes": 1842,
        "last_seen_epoch": "1561247238.25451",
        "responder_bytes": 1874,
        "first_seen_epoch": "1561247238.252653"
      },
      {
        "bytes": 1280,
        "stream": 89,
        "flow_id": "flow-0e25c26d11f492a01e9e85d7",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1197,
        "first_frame": 1071,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49193,
        "responder_port": 135,
        "initiator_bytes": 718,
        "last_seen_epoch": "1561247248.717739",
        "responder_bytes": 562,
        "first_seen_epoch": "1561247238.400409"
      },
      {
        "bytes": 3999,
        "stream": 90,
        "flow_id": "flow-30d99016114f0b27d8d1e1cf",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1089,
        "first_frame": 1078,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49194,
        "responder_port": 88,
        "initiator_bytes": 2013,
        "last_seen_epoch": "1561247238.404347",
        "responder_bytes": 1986,
        "first_seen_epoch": "1561247238.402701"
      },
      {
        "bytes": 5228,
        "stream": 91,
        "flow_id": "flow-ae05307fe607eb2de6224167",
        "packets": 15,
        "transport": "tcp",
        "last_frame": 1185,
        "first_frame": 1106,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49195,
        "responder_port": 389,
        "initiator_bytes": 2970,
        "last_seen_epoch": "1561247239.478216",
        "responder_bytes": 2258,
        "first_seen_epoch": "1561247238.93615"
      },
      {
        "bytes": 3972,
        "stream": 92,
        "flow_id": "flow-358c8d0e0b45619126c53d9c",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1120,
        "first_frame": 1109,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49196,
        "responder_port": 88,
        "initiator_bytes": 1997,
        "last_seen_epoch": "1561247238.938911",
        "responder_bytes": 1975,
        "first_seen_epoch": "1561247238.937476"
      },
      {
        "bytes": 3427,
        "stream": 93,
        "flow_id": "flow-8168dda9796cd0c9a782331e",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 1180,
        "first_frame": 1127,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49197,
        "responder_port": 389,
        "initiator_bytes": 2575,
        "last_seen_epoch": "1561247238.956214",
        "responder_bytes": 852,
        "first_seen_epoch": "1561247238.943925"
      },
      {
        "bytes": 6925,
        "stream": 94,
        "flow_id": "flow-713885068cf843cefeea74d2",
        "packets": 24,
        "transport": "tcp",
        "last_frame": 3693,
        "first_frame": 1140,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49198,
        "responder_port": 445,
        "initiator_bytes": 5067,
        "last_seen_epoch": "1561247273.118132",
        "responder_bytes": 1858,
        "first_seen_epoch": "1561247238.949553"
      },
      {
        "bytes": 3972,
        "stream": 95,
        "flow_id": "flow-2f9ed8fe10e9c634d56f476c",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1155,
        "first_frame": 1144,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49199,
        "responder_port": 88,
        "initiator_bytes": 1997,
        "last_seen_epoch": "1561247238.952154",
        "responder_bytes": 1975,
        "first_seen_epoch": "1561247238.950813"
      },
      {
        "bytes": 3675,
        "stream": 96,
        "flow_id": "flow-2f5f66d2b2e3a77d1e84ea49",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1167,
        "first_frame": 1156,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49200,
        "responder_port": 88,
        "initiator_bytes": 1831,
        "last_seen_epoch": "1561247238.95311",
        "responder_bytes": 1844,
        "first_seen_epoch": "1561247238.95222"
      },
      {
        "bytes": 54,
        "stream": 97,
        "flow_id": "flow-f8ece64d1bc19aea54f812b8",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1198,
        "first_frame": 1198,
        "initiator_ip": "172.217.164.74",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49213,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247248.84761",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247248.84761"
      },
      {
        "bytes": 54,
        "stream": 98,
        "flow_id": "flow-aa0ee72b0d8f4a301453d491",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1199,
        "first_frame": 1199,
        "initiator_ip": "172.217.164.74",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49212,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247248.882624",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247248.882624"
      },
      {
        "bytes": 54,
        "stream": 99,
        "flow_id": "flow-c2a5fb30fb2a8ec5be472f99",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1200,
        "first_frame": 1200,
        "initiator_ip": "74.125.138.97",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49211,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247249.452518",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247249.452518"
      },
      {
        "bytes": 54,
        "stream": 100,
        "flow_id": "flow-ea66f620db152287f7e8d7bb",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1201,
        "first_frame": 1201,
        "initiator_ip": "74.125.138.97",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49210,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247249.455782",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247249.455782"
      },
      {
        "bytes": 54,
        "stream": 101,
        "flow_id": "flow-cab3870ac81c8979d1ce5a14",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1202,
        "first_frame": 1202,
        "initiator_ip": "172.217.164.66",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49218,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247250.209685",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247250.209685"
      },
      {
        "bytes": 54,
        "stream": 102,
        "flow_id": "flow-0941eca2386a3a0c80baa56a",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1203,
        "first_frame": 1203,
        "initiator_ip": "172.217.164.66",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49219,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247250.240027",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247250.240027"
      },
      {
        "bytes": 54,
        "stream": 103,
        "flow_id": "flow-13f0249bef1efb10a5c01d30",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1204,
        "first_frame": 1204,
        "initiator_ip": "64.233.185.101",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49225,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247250.753254",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247250.753254"
      },
      {
        "bytes": 54,
        "stream": 104,
        "flow_id": "flow-12613625cbed4a96b036d9e5",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1205,
        "first_frame": 1205,
        "initiator_ip": "64.233.185.101",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49224,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247250.821442",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247250.821442"
      },
      {
        "bytes": 54,
        "stream": 105,
        "flow_id": "flow-1c6fa9aa7c5290a7ad513c16",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1206,
        "first_frame": 1206,
        "initiator_ip": "173.194.219.94",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49223,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247250.8215",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247250.8215"
      },
      {
        "bytes": 54,
        "stream": 106,
        "flow_id": "flow-667036df5cc55829c92f67cd",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1207,
        "first_frame": 1207,
        "initiator_ip": "64.233.185.102",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49220,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247250.854511",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247250.854511"
      },
      {
        "bytes": 54,
        "stream": 107,
        "flow_id": "flow-cb4cb97485e4f1d37550af8f",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1208,
        "first_frame": 1208,
        "initiator_ip": "64.233.185.102",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49221,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247250.861503",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247250.861503"
      },
      {
        "bytes": 54,
        "stream": 108,
        "flow_id": "flow-60ff3de2f6ecc5156166ccef",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1209,
        "first_frame": 1209,
        "initiator_ip": "173.194.219.154",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49235,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247252.470336",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247252.470336"
      },
      {
        "bytes": 54,
        "stream": 109,
        "flow_id": "flow-f0789578af30611ee1940bd4",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1210,
        "first_frame": 1210,
        "initiator_ip": "173.194.219.154",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49234,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247252.526333",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247252.526333"
      },
      {
        "bytes": 54,
        "stream": 110,
        "flow_id": "flow-faea524f4fc762cb5c79aca0",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1211,
        "first_frame": 1211,
        "initiator_ip": "172.217.12.110",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49240,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247252.849886",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247252.849886"
      },
      {
        "bytes": 54,
        "stream": 111,
        "flow_id": "flow-c535f049aaf26bf8688d1396",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1212,
        "first_frame": 1212,
        "initiator_ip": "64.233.185.101",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49236,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247252.909391",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247252.909391"
      },
      {
        "bytes": 54,
        "stream": 112,
        "flow_id": "flow-dc73e8bd0855c36bc020c61f",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1213,
        "first_frame": 1213,
        "initiator_ip": "172.217.12.110",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49239,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247252.92832",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247252.92832"
      },
      {
        "bytes": 54,
        "stream": 113,
        "flow_id": "flow-ad2610483adda3d4c966f49f",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1214,
        "first_frame": 1214,
        "initiator_ip": "74.125.136.95",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49238,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247253.024289",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247253.024289"
      },
      {
        "bytes": 54,
        "stream": 114,
        "flow_id": "flow-532478f9e2ef58441a7bfe8a",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1215,
        "first_frame": 1215,
        "initiator_ip": "74.125.136.95",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49241,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247253.024329",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247253.024329"
      },
      {
        "bytes": 921,
        "stream": 115,
        "flow_id": "flow-61df7b2796a2ede9d17f8c86",
        "packets": 8,
        "transport": "tcp",
        "last_frame": 1233,
        "first_frame": 1226,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49190,
        "responder_port": 88,
        "initiator_bytes": 460,
        "last_seen_epoch": "1561247254.087927",
        "responder_bytes": 461,
        "first_seen_epoch": "1561247254.086792"
      },
      {
        "bytes": 2465,
        "stream": 116,
        "flow_id": "flow-00709c79b59db534ec45966d",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 1243,
        "first_frame": 1234,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49191,
        "responder_port": 88,
        "initiator_bytes": 594,
        "last_seen_epoch": "1561247254.108107",
        "responder_bytes": 1871,
        "first_seen_epoch": "1561247254.106569"
      },
      {
        "bytes": 3656,
        "stream": 117,
        "flow_id": "flow-f65e3e9a91573b636c4d1981",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1255,
        "first_frame": 1244,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49192,
        "responder_port": 88,
        "initiator_bytes": 1812,
        "last_seen_epoch": "1561247254.109715",
        "responder_bytes": 1844,
        "first_seen_epoch": "1561247254.108198"
      },
      {
        "bytes": 1280,
        "stream": 118,
        "flow_id": "flow-dda370ad3d837f8588fd292f",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 3740,
        "first_frame": 1257,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49193,
        "responder_port": 135,
        "initiator_bytes": 718,
        "last_seen_epoch": "1561247283.458316",
        "responder_bytes": 562,
        "first_seen_epoch": "1561247254.196088"
      },
      {
        "bytes": 3939,
        "stream": 119,
        "flow_id": "flow-ea52dee8807da4ba856388b0",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1275,
        "first_frame": 1264,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49194,
        "responder_port": 88,
        "initiator_bytes": 1983,
        "last_seen_epoch": "1561247254.205724",
        "responder_bytes": 1956,
        "first_seen_epoch": "1561247254.198473"
      },
      {
        "bytes": 335,
        "stream": 61,
        "flow_id": "flow-8a515a805c1e3e088cdc526b",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1293,
        "first_frame": 1292,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 65124,
        "responder_port": 53,
        "initiator_bytes": 130,
        "last_seen_epoch": "1561247254.745861",
        "responder_bytes": 205,
        "first_seen_epoch": "1561247254.745502"
      },
      {
        "bytes": 273,
        "stream": 62,
        "flow_id": "flow-1bbec75eb7df57a91f2ca719",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1295,
        "first_frame": 1294,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59842,
        "responder_port": 53,
        "initiator_bytes": 99,
        "last_seen_epoch": "1561247254.74648",
        "responder_bytes": 174,
        "first_seen_epoch": "1561247254.746303"
      },
      {
        "bytes": 5144,
        "stream": 120,
        "flow_id": "flow-e091c80e7dbd95777c0a0797",
        "packets": 14,
        "transport": "tcp",
        "last_frame": 1376,
        "first_frame": 1296,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49195,
        "responder_port": 389,
        "initiator_bytes": 2886,
        "last_seen_epoch": "1561247255.290342",
        "responder_bytes": 2258,
        "first_seen_epoch": "1561247254.748203"
      },
      {
        "bytes": 3912,
        "stream": 121,
        "flow_id": "flow-08c23d15fa60fcb0aac437be",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1310,
        "first_frame": 1299,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49196,
        "responder_port": 88,
        "initiator_bytes": 1967,
        "last_seen_epoch": "1561247254.752753",
        "responder_bytes": 1945,
        "first_seen_epoch": "1561247254.750718"
      },
      {
        "bytes": 3397,
        "stream": 122,
        "flow_id": "flow-2d4743007a10aa1326f18037",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 1371,
        "first_frame": 1317,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49197,
        "responder_port": 389,
        "initiator_bytes": 2545,
        "last_seen_epoch": "1561247254.77106",
        "responder_bytes": 852,
        "first_seen_epoch": "1561247254.758115"
      },
      {
        "bytes": 6918,
        "stream": 123,
        "flow_id": "flow-07135c071c5b8481d7880288",
        "packets": 25,
        "transport": "tcp",
        "last_frame": 3889,
        "first_frame": 1330,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49198,
        "responder_port": 445,
        "initiator_bytes": 5060,
        "last_seen_epoch": "1561247289.916843",
        "responder_bytes": 1858,
        "first_seen_epoch": "1561247254.764737"
      },
      {
        "bytes": 3912,
        "stream": 124,
        "flow_id": "flow-7b640e4de16d5ae76c046c6c",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1346,
        "first_frame": 1335,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49199,
        "responder_port": 88,
        "initiator_bytes": 1967,
        "last_seen_epoch": "1561247254.767121",
        "responder_bytes": 1945,
        "first_seen_epoch": "1561247254.765845"
      },
      {
        "bytes": 3615,
        "stream": 125,
        "flow_id": "flow-465f26cf7a8cf639e5ef7603",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1358,
        "first_frame": 1347,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49200,
        "responder_port": 88,
        "initiator_bytes": 1801,
        "last_seen_epoch": "1561247254.767982",
        "responder_bytes": 1814,
        "first_seen_epoch": "1561247254.767221"
      },
      {
        "bytes": 54,
        "stream": 126,
        "flow_id": "flow-e40fd2ae002d4710b1b9f2df",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1374,
        "first_frame": 1374,
        "initiator_ip": "173.194.219.94",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49222,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247255.194635",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247255.194635"
      },
      {
        "bytes": 168,
        "stream": 63,
        "flow_id": "flow-2bcf6c311fa7c2488c68f700",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1378,
        "first_frame": 1377,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 54293,
        "responder_port": 53,
        "initiator_bytes": 76,
        "last_seen_epoch": "1561247255.327697",
        "responder_bytes": 92,
        "first_seen_epoch": "1561247255.291829"
      },
      {
        "bytes": 180,
        "stream": 64,
        "flow_id": "flow-c17482d5e68753531fd31b0c",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1380,
        "first_frame": 1379,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 56953,
        "responder_port": 53,
        "initiator_bytes": 76,
        "last_seen_epoch": "1561247255.328332",
        "responder_bytes": 104,
        "first_seen_epoch": "1561247255.328144"
      },
      {
        "bytes": 54,
        "stream": 127,
        "flow_id": "flow-97e58cb3de4f48aa319865ab",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1381,
        "first_frame": 1381,
        "initiator_ip": "74.125.136.106",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49209,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247256.199452",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247256.199452"
      },
      {
        "bytes": 54,
        "stream": 128,
        "flow_id": "flow-6e8266c6e878c4a4c409af37",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1382,
        "first_frame": 1382,
        "initiator_ip": "74.125.136.106",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49237,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247256.771363",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247256.771363"
      },
      {
        "bytes": 54,
        "stream": 129,
        "flow_id": "flow-0c49c579c6f56b3f67743c24",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1383,
        "first_frame": 1383,
        "initiator_ip": "172.217.0.67",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49261,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247256.8016",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247256.8016"
      },
      {
        "bytes": 54,
        "stream": 130,
        "flow_id": "flow-a08c9a900c65a5bce492203a",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1384,
        "first_frame": 1384,
        "initiator_ip": "64.233.185.94",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49259,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247256.801617",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247256.801617"
      },
      {
        "bytes": 54,
        "stream": 131,
        "flow_id": "flow-5728b4f306882635f2e59bef",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1385,
        "first_frame": 1385,
        "initiator_ip": "74.125.136.106",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49233,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247256.801625",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247256.801625"
      },
      {
        "bytes": 54,
        "stream": 132,
        "flow_id": "flow-573bb0d391501dd65650e77d",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1386,
        "first_frame": 1386,
        "initiator_ip": "64.233.185.94",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49258,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247256.944056",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247256.944056"
      },
      {
        "bytes": 54,
        "stream": 133,
        "flow_id": "flow-e70c9c0ad2afc1587cef8411",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1387,
        "first_frame": 1387,
        "initiator_ip": "172.217.0.67",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49260,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247256.944076",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247256.944076"
      },
      {
        "bytes": 54,
        "stream": 134,
        "flow_id": "flow-e6512ddd5b2108e120220a20",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1388,
        "first_frame": 1388,
        "initiator_ip": "74.125.136.106",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49208,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247257.016835",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247257.016835"
      },
      {
        "bytes": 54,
        "stream": 135,
        "flow_id": "flow-08e59345196e92b77b2ef8cf",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1389,
        "first_frame": 1389,
        "initiator_ip": "64.233.185.94",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49257,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247257.016879",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247257.016879"
      },
      {
        "bytes": 54,
        "stream": 136,
        "flow_id": "flow-9ed78713b3fa4b8f80533c8a",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1390,
        "first_frame": 1390,
        "initiator_ip": "74.125.21.95",
        "responder_ip": "10.0.76.109",
        "initiator_port": 443,
        "responder_port": 49212,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247257.641446",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247257.641446"
      },
      {
        "bytes": 54,
        "stream": 137,
        "flow_id": "flow-62e9cce526b38ea03707b9f7",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 1391,
        "first_frame": 1391,
        "initiator_ip": "74.125.21.95",
        "responder_ip": "10.0.76.109",
        "initiator_port": 443,
        "responder_port": 49213,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247257.961687",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247257.961687"
      },
      {
        "bytes": 162,
        "stream": 65,
        "flow_id": "flow-f9820f7a30878fb915934b1c",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1393,
        "first_frame": 1392,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 58606,
        "responder_port": 53,
        "initiator_bytes": 73,
        "last_seen_epoch": "1561247260.170954",
        "responder_bytes": 89,
        "first_seen_epoch": "1561247260.170668"
      },
      {
        "bytes": 29999,
        "stream": 138,
        "flow_id": "flow-8c0f898b1b638eb17f1a395e",
        "packets": 54,
        "transport": "tcp",
        "last_frame": 6170,
        "first_frame": 1397,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49201,
        "responder_port": 80,
        "initiator_bytes": 2177,
        "last_seen_epoch": "1561247380.619079",
        "responder_bytes": 27822,
        "first_seen_epoch": "1561247260.747036"
      },
      {
        "bytes": 174,
        "stream": 139,
        "flow_id": "flow-e8b91774e8b50e673330c2a1",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 1400,
        "first_frame": 1398,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49202,
        "responder_port": 80,
        "initiator_bytes": 120,
        "last_seen_epoch": "1561247260.747855",
        "responder_bytes": 54,
        "first_seen_epoch": "1561247260.747719"
      },
      {
        "bytes": 256,
        "stream": 66,
        "flow_id": "flow-29d1ba9c2b2881c87a4acbef",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1454,
        "first_frame": 1453,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 65529,
        "responder_port": 53,
        "initiator_bytes": 79,
        "last_seen_epoch": "1561247261.347284",
        "responder_bytes": 177,
        "first_seen_epoch": "1561247261.331542"
      },
      {
        "bytes": 38007,
        "stream": 140,
        "flow_id": "flow-0f431d405ef0d3259a6a0e3c",
        "packets": 59,
        "transport": "tcp",
        "last_frame": 6252,
        "first_frame": 1455,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "172.217.164.74",
        "initiator_port": 49203,
        "responder_port": 80,
        "initiator_bytes": 1995,
        "last_seen_epoch": "1561247380.640407",
        "responder_bytes": 36012,
        "first_seen_epoch": "1561247261.348656"
      },
      {
        "bytes": 394,
        "stream": 141,
        "flow_id": "flow-0c35e7c80569685965287fac",
        "packets": 7,
        "transport": "tcp",
        "last_frame": 6251,
        "first_frame": 1456,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "172.217.164.74",
        "initiator_port": 49204,
        "responder_port": 80,
        "initiator_bytes": 228,
        "last_seen_epoch": "1561247380.640338",
        "responder_bytes": 166,
        "first_seen_epoch": "1561247261.348868"
      },
      {
        "bytes": 244,
        "stream": 67,
        "flow_id": "flow-4f98e2b7c1d203966bba9ae6",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1485,
        "first_frame": 1464,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59012,
        "responder_port": 53,
        "initiator_bytes": 74,
        "last_seen_epoch": "1561247261.392793",
        "responder_bytes": 170,
        "first_seen_epoch": "1561247261.365825"
      },
      {
        "bytes": 17468,
        "stream": 142,
        "flow_id": "flow-5261514bfa25b49fffa0db9d",
        "packets": 36,
        "transport": "tcp",
        "last_frame": 6235,
        "first_frame": 1486,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "64.233.185.103",
        "initiator_port": 49205,
        "responder_port": 443,
        "initiator_bytes": 2422,
        "last_seen_epoch": "1561247380.630352",
        "responder_bytes": 15046,
        "first_seen_epoch": "1561247261.393496"
      },
      {
        "bytes": 125619,
        "stream": 143,
        "flow_id": "flow-15020c819e6b3a9cd50c3d6f",
        "packets": 157,
        "transport": "tcp",
        "last_frame": 6248,
        "first_frame": 1487,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "64.233.185.103",
        "initiator_port": 49206,
        "responder_port": 443,
        "initiator_bytes": 9639,
        "last_seen_epoch": "1561247380.633115",
        "responder_bytes": 115980,
        "first_seen_epoch": "1561247261.394389"
      },
      {
        "bytes": 180,
        "stream": 68,
        "flow_id": "flow-c81207e84d417509c6137dbd",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1511,
        "first_frame": 1510,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 57482,
        "responder_port": 53,
        "initiator_bytes": 82,
        "last_seen_epoch": "1561247261.417763",
        "responder_bytes": 98,
        "first_seen_epoch": "1561247261.417408"
      },
      {
        "bytes": 4766,
        "stream": 144,
        "flow_id": "flow-03c232a488ec374f40caf77b",
        "packets": 20,
        "transport": "tcp",
        "last_frame": 6158,
        "first_frame": 1512,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49207,
        "responder_port": 443,
        "initiator_bytes": 936,
        "last_seen_epoch": "1561247380.617803",
        "responder_bytes": 3830,
        "first_seen_epoch": "1561247261.418703"
      },
      {
        "bytes": 60096,
        "stream": 145,
        "flow_id": "flow-dd04cd4ada1cb680aeb763ca",
        "packets": 94,
        "transport": "tcp",
        "last_frame": 6155,
        "first_frame": 1513,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49208,
        "responder_port": 443,
        "initiator_bytes": 3333,
        "last_seen_epoch": "1561247380.617488",
        "responder_bytes": 56763,
        "first_seen_epoch": "1561247261.418791"
      },
      {
        "bytes": 228,
        "stream": 69,
        "flow_id": "flow-1dd9d5ae1ed554b61275c61a",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1578,
        "first_frame": 1569,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 52947,
        "responder_port": 53,
        "initiator_bytes": 84,
        "last_seen_epoch": "1561247261.621737",
        "responder_bytes": 144,
        "first_seen_epoch": "1561247261.588306"
      },
      {
        "bytes": 4338,
        "stream": 146,
        "flow_id": "flow-32a3a1f7ee8112a58661c777",
        "packets": 18,
        "transport": "tcp",
        "last_frame": 6247,
        "first_frame": 1579,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "173.194.219.97",
        "initiator_port": 49209,
        "responder_port": 443,
        "initiator_bytes": 814,
        "last_seen_epoch": "1561247380.633077",
        "responder_bytes": 3524,
        "first_seen_epoch": "1561247261.62259"
      },
      {
        "bytes": 27248,
        "stream": 147,
        "flow_id": "flow-457cd1e7d6f100fe03c7d889",
        "packets": 48,
        "transport": "tcp",
        "last_frame": 6237,
        "first_frame": 1580,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "173.194.219.97",
        "initiator_port": 49210,
        "responder_port": 443,
        "initiator_bytes": 1975,
        "last_seen_epoch": "1561247380.630459",
        "responder_bytes": 25273,
        "first_seen_epoch": "1561247261.623006"
      },
      {
        "bytes": 222,
        "stream": 70,
        "flow_id": "flow-4b5045f8447d2e0f7d5ca12b",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1711,
        "first_frame": 1691,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 51072,
        "responder_port": 53,
        "initiator_bytes": 84,
        "last_seen_epoch": "1561247261.87113",
        "responder_bytes": 138,
        "first_seen_epoch": "1561247261.849626"
      },
      {
        "bytes": 10957,
        "stream": 148,
        "flow_id": "flow-dd2ff3da2fc6d3a602deecbf",
        "packets": 21,
        "transport": "tcp",
        "last_frame": 6238,
        "first_frame": 1713,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "172.217.2.34",
        "initiator_port": 49211,
        "responder_port": 80,
        "initiator_bytes": 909,
        "last_seen_epoch": "1561247380.630497",
        "responder_bytes": 10048,
        "first_seen_epoch": "1561247261.871722"
      },
      {
        "bytes": 394,
        "stream": 149,
        "flow_id": "flow-d43d9ec506067a0f82ca24c3",
        "packets": 7,
        "transport": "tcp",
        "last_frame": 6239,
        "first_frame": 1714,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "172.217.2.34",
        "initiator_port": 49212,
        "responder_port": 80,
        "initiator_bytes": 228,
        "last_seen_epoch": "1561247380.630543",
        "responder_bytes": 166,
        "first_seen_epoch": "1561247261.87178"
      },
      {
        "bytes": 263,
        "stream": 71,
        "flow_id": "flow-a46ca1b947dd9a40fb320be5",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1738,
        "first_frame": 1737,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 63412,
        "responder_port": 53,
        "initiator_bytes": 87,
        "last_seen_epoch": "1561247262.208719",
        "responder_bytes": 176,
        "first_seen_epoch": "1561247262.191255"
      },
      {
        "bytes": 6932,
        "stream": 150,
        "flow_id": "flow-832703f376784d64bed3d923",
        "packets": 23,
        "transport": "tcp",
        "last_frame": 6240,
        "first_frame": 1739,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "173.194.219.156",
        "initiator_port": 49213,
        "responder_port": 443,
        "initiator_bytes": 1739,
        "last_seen_epoch": "1561247380.630583",
        "responder_bytes": 5193,
        "first_seen_epoch": "1561247262.210029"
      },
      {
        "bytes": 3860,
        "stream": 151,
        "flow_id": "flow-92b8e579f87ac93eac517737",
        "packets": 17,
        "transport": "tcp",
        "last_frame": 6245,
        "first_frame": 1740,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "173.194.219.156",
        "initiator_port": 49214,
        "responder_port": 443,
        "initiator_bytes": 793,
        "last_seen_epoch": "1561247380.632976",
        "responder_bytes": 3067,
        "first_seen_epoch": "1561247262.210646"
      },
      {
        "bytes": 308,
        "stream": 72,
        "flow_id": "flow-631f17a3b9381a68b064a722",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1776,
        "first_frame": 1773,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 52930,
        "responder_port": 53,
        "initiator_bytes": 84,
        "last_seen_epoch": "1561247262.316189",
        "responder_bytes": 224,
        "first_seen_epoch": "1561247262.297156"
      },
      {
        "bytes": 21335,
        "stream": 152,
        "flow_id": "flow-901cfefd664ff4e2b951e547",
        "packets": 39,
        "transport": "tcp",
        "last_frame": 6220,
        "first_frame": 1777,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.138.138",
        "initiator_port": 49215,
        "responder_port": 80,
        "initiator_bytes": 2337,
        "last_seen_epoch": "1561247380.62661",
        "responder_bytes": 18998,
        "first_seen_epoch": "1561247262.317018"
      },
      {
        "bytes": 1914,
        "stream": 153,
        "flow_id": "flow-a1bca921f327eed96ba0cf16",
        "packets": 11,
        "transport": "tcp",
        "last_frame": 6236,
        "first_frame": 1778,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.138.138",
        "initiator_port": 49216,
        "responder_port": 80,
        "initiator_bytes": 1253,
        "last_seen_epoch": "1561247380.63042",
        "responder_bytes": 661,
        "first_seen_epoch": "1561247262.317272"
      },
      {
        "bytes": 208,
        "stream": 73,
        "flow_id": "flow-c5e801db0b2f12cdf4156976",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1820,
        "first_frame": 1819,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 62596,
        "responder_port": 53,
        "initiator_bytes": 80,
        "last_seen_epoch": "1561247262.69576",
        "responder_bytes": 128,
        "first_seen_epoch": "1561247262.674584"
      },
      {
        "bytes": 93253,
        "stream": 154,
        "flow_id": "flow-1e453b05549e87b08af61922",
        "packets": 109,
        "transport": "tcp",
        "last_frame": 6222,
        "first_frame": 1821,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49217,
        "responder_port": 443,
        "initiator_bytes": 3419,
        "last_seen_epoch": "1561247380.626694",
        "responder_bytes": 89834,
        "first_seen_epoch": "1561247262.696504"
      },
      {
        "bytes": 69304,
        "stream": 155,
        "flow_id": "flow-125d29c7acec88772327bfda",
        "packets": 102,
        "transport": "tcp",
        "last_frame": 6223,
        "first_frame": 1822,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49218,
        "responder_port": 443,
        "initiator_bytes": 3298,
        "last_seen_epoch": "1561247380.626733",
        "responder_bytes": 66006,
        "first_seen_epoch": "1561247262.696756"
      },
      {
        "bytes": 244,
        "stream": 74,
        "flow_id": "flow-e4df948485d0dad995c55c47",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1848,
        "first_frame": 1823,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 55252,
        "responder_port": 53,
        "initiator_bytes": 74,
        "last_seen_epoch": "1561247262.72983",
        "responder_bytes": 170,
        "first_seen_epoch": "1561247262.703159"
      },
      {
        "bytes": 3639,
        "stream": 156,
        "flow_id": "flow-81ee4a40217c00dcc7579414",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 6234,
        "first_frame": 1824,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49219,
        "responder_port": 80,
        "initiator_bytes": 729,
        "last_seen_epoch": "1561247380.630282",
        "responder_bytes": 2910,
        "first_seen_epoch": "1561247262.705024"
      },
      {
        "bytes": 335,
        "stream": 75,
        "flow_id": "flow-c0eeba608f261206788f1cf8",
        "packets": 2,
        "transport": "udp",
        "last_frame": 1855,
        "first_frame": 1829,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 56202,
        "responder_port": 53,
        "initiator_bytes": 80,
        "last_seen_epoch": "1561247262.734217",
        "responder_bytes": 255,
        "first_seen_epoch": "1561247262.710024"
      },
      {
        "bytes": 4742,
        "stream": 157,
        "flow_id": "flow-34a3a209f746e4c65b4d859b",
        "packets": 17,
        "transport": "tcp",
        "last_frame": 6231,
        "first_frame": 1856,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.136.102",
        "initiator_port": 49220,
        "responder_port": 443,
        "initiator_bytes": 726,
        "last_seen_epoch": "1561247380.630172",
        "responder_bytes": 4016,
        "first_seen_epoch": "1561247262.734489"
      },
      {
        "bytes": 10739,
        "stream": 158,
        "flow_id": "flow-35dfcad816d5ddd9dce05960",
        "packets": 29,
        "transport": "tcp",
        "last_frame": 6218,
        "first_frame": 1857,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.136.102",
        "initiator_port": 49221,
        "responder_port": 443,
        "initiator_bytes": 1497,
        "last_seen_epoch": "1561247380.626521",
        "responder_bytes": 9242,
        "first_seen_epoch": "1561247262.734768"
      },
      {
        "bytes": 124116,
        "stream": 159,
        "flow_id": "flow-bb131311c503c756a7f23942",
        "packets": 139,
        "transport": "tcp",
        "last_frame": 6213,
        "first_frame": 1858,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "72.21.91.66",
        "initiator_port": 49222,
        "responder_port": 443,
        "initiator_bytes": 3946,
        "last_seen_epoch": "1561247380.626387",
        "responder_bytes": 120170,
        "first_seen_epoch": "1561247262.736339"
      },
      {
        "bytes": 50044,
        "stream": 160,
        "flow_id": "flow-e28ec3bd4fd19456037890f0",
        "packets": 77,
        "transport": "tcp",
        "last_frame": 6208,
        "first_frame": 1859,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "72.21.91.66",
        "initiator_port": 49223,
        "responder_port": 443,
        "initiator_bytes": 3174,
        "last_seen_epoch": "1561247380.626301",
        "responder_bytes": 46870,
        "first_seen_epoch": "1561247262.737648"
      },
      {
        "bytes": 1131,
        "stream": 161,
        "flow_id": "flow-92ea3d9b68b2fb9e51c8e30c",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 6221,
        "first_frame": 1883,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49224,
        "responder_port": 443,
        "initiator_bytes": 635,
        "last_seen_epoch": "1561247380.626652",
        "responder_bytes": 496,
        "first_seen_epoch": "1561247262.74852"
      },
      {
        "bytes": 12590,
        "stream": 162,
        "flow_id": "flow-156f5412f8059e156cb41938",
        "packets": 34,
        "transport": "tcp",
        "last_frame": 2409,
        "first_frame": 1963,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49225,
        "responder_port": 443,
        "initiator_bytes": 2110,
        "last_seen_epoch": "1561247263.436181",
        "responder_bytes": 10480,
        "first_seen_epoch": "1561247262.832637"
      },
      {
        "bytes": 166,
        "stream": 76,
        "flow_id": "flow-9a109e7c37ef675e75ea3158",
        "packets": 2,
        "transport": "udp",
        "last_frame": 2105,
        "first_frame": 2056,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59371,
        "responder_port": 53,
        "initiator_bytes": 75,
        "last_seen_epoch": "1561247263.069502",
        "responder_bytes": 91,
        "first_seen_epoch": "1561247262.918987"
      },
      {
        "bytes": 106814,
        "stream": 163,
        "flow_id": "flow-ca056ce0035a88eb0ba02127",
        "packets": 110,
        "transport": "tcp",
        "last_frame": 2632,
        "first_frame": 2108,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "64.233.185.94",
        "initiator_port": 49226,
        "responder_port": 443,
        "initiator_bytes": 2662,
        "last_seen_epoch": "1561247263.71087",
        "responder_bytes": 104152,
        "first_seen_epoch": "1561247263.070505"
      },
      {
        "bytes": 103815,
        "stream": 164,
        "flow_id": "flow-2fa372587842e7473685cc28",
        "packets": 116,
        "transport": "tcp",
        "last_frame": 2552,
        "first_frame": 2109,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "64.233.185.94",
        "initiator_port": 49227,
        "responder_port": 443,
        "initiator_bytes": 3073,
        "last_seen_epoch": "1561247263.677435",
        "responder_bytes": 100742,
        "first_seen_epoch": "1561247263.070579"
      },
      {
        "bytes": 33167,
        "stream": 165,
        "flow_id": "flow-57fc027a566f9fb183e573a5",
        "packets": 52,
        "transport": "tcp",
        "last_frame": 6246,
        "first_frame": 2323,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "64.233.185.103",
        "initiator_port": 49228,
        "responder_port": 443,
        "initiator_bytes": 3230,
        "last_seen_epoch": "1561247380.633034",
        "responder_bytes": 29937,
        "first_seen_epoch": "1561247263.264367"
      },
      {
        "bytes": 213,
        "stream": 77,
        "flow_id": "flow-7fa88a524443dee1bf76fb9d",
        "packets": 2,
        "transport": "udp",
        "last_frame": 2369,
        "first_frame": 2368,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 51681,
        "responder_port": 53,
        "initiator_bytes": 81,
        "last_seen_epoch": "1561247263.378913",
        "responder_bytes": 132,
        "first_seen_epoch": "1561247263.37866"
      },
      {
        "bytes": 174,
        "stream": 166,
        "flow_id": "flow-20e2cad81858d6e7ad58e541",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 2373,
        "first_frame": 2370,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49229,
        "responder_port": 443,
        "initiator_bytes": 120,
        "last_seen_epoch": "1561247263.379813",
        "responder_bytes": 54,
        "first_seen_epoch": "1561247263.379458"
      },
      {
        "bytes": 18636,
        "stream": 167,
        "flow_id": "flow-349b58d96ff4a47b71a2b31e",
        "packets": 41,
        "transport": "tcp",
        "last_frame": 6224,
        "first_frame": 2372,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49230,
        "responder_port": 443,
        "initiator_bytes": 1829,
        "last_seen_epoch": "1561247380.626771",
        "responder_bytes": 16807,
        "first_seen_epoch": "1561247263.379747"
      },
      {
        "bytes": 380,
        "stream": 78,
        "flow_id": "flow-cf89ba4ebf74fed5995b03c5",
        "packets": 5,
        "transport": "udp",
        "last_frame": 3208,
        "first_frame": 2473,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49722,
        "responder_port": 53,
        "initiator_bytes": 304,
        "last_seen_epoch": "1561247270.164049",
        "responder_bytes": 76,
        "first_seen_epoch": "1561247263.513314"
      },
      {
        "bytes": 394,
        "stream": 168,
        "flow_id": "flow-d2013693a05068807acb7511",
        "packets": 7,
        "transport": "tcp",
        "last_frame": 6172,
        "first_frame": 2637,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49202,
        "responder_port": 80,
        "initiator_bytes": 228,
        "last_seen_epoch": "1561247380.619243",
        "responder_bytes": 166,
        "first_seen_epoch": "1561247263.750902"
      },
      {
        "bytes": 64919,
        "stream": 169,
        "flow_id": "flow-c0db7e7df60af64b1e5d05f9",
        "packets": 89,
        "transport": "tcp",
        "last_frame": 6219,
        "first_frame": 2640,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.136.102",
        "initiator_port": 49231,
        "responder_port": 80,
        "initiator_bytes": 2839,
        "last_seen_epoch": "1561247380.626564",
        "responder_bytes": 62080,
        "first_seen_epoch": "1561247263.793663"
      },
      {
        "bytes": 254,
        "stream": 79,
        "flow_id": "flow-90a8a6e9e1ab31ec5c0f5627",
        "packets": 2,
        "transport": "udp",
        "last_frame": 2642,
        "first_frame": 2641,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 50233,
        "responder_port": 53,
        "initiator_bytes": 78,
        "last_seen_epoch": "1561247263.800132",
        "responder_bytes": 176,
        "first_seen_epoch": "1561247263.799834"
      },
      {
        "bytes": 5729,
        "stream": 170,
        "flow_id": "flow-f577534fa93a438cbbc90d57",
        "packets": 22,
        "transport": "tcp",
        "last_frame": 6203,
        "first_frame": 2643,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "172.217.0.74",
        "initiator_port": 49232,
        "responder_port": 443,
        "initiator_bytes": 1275,
        "last_seen_epoch": "1561247380.624361",
        "responder_bytes": 4454,
        "first_seen_epoch": "1561247263.803014"
      },
      {
        "bytes": 5023,
        "stream": 171,
        "flow_id": "flow-cca8059b0f8963a02c41e9f4",
        "packets": 19,
        "transport": "tcp",
        "last_frame": 6200,
        "first_frame": 2644,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "172.217.0.74",
        "initiator_port": 49233,
        "responder_port": 443,
        "initiator_bytes": 838,
        "last_seen_epoch": "1561247380.624105",
        "responder_bytes": 4185,
        "first_seen_epoch": "1561247263.803674"
      },
      {
        "bytes": 278,
        "stream": 80,
        "flow_id": "flow-70d0f3f473f6ecdaf6a77126",
        "packets": 2,
        "transport": "udp",
        "last_frame": 2747,
        "first_frame": 2692,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59397,
        "responder_port": 53,
        "initiator_bytes": 79,
        "last_seen_epoch": "1561247263.907326",
        "responder_bytes": 199,
        "first_seen_epoch": "1561247263.85676"
      },
      {
        "bytes": 1259,
        "stream": 172,
        "flow_id": "flow-2af9ca55b0a7466158111df1",
        "packets": 11,
        "transport": "tcp",
        "last_frame": 6202,
        "first_frame": 2751,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.136.101",
        "initiator_port": 49234,
        "responder_port": 80,
        "initiator_bytes": 902,
        "last_seen_epoch": "1561247380.624242",
        "responder_bytes": 357,
        "first_seen_epoch": "1561247263.910532"
      },
      {
        "bytes": 394,
        "stream": 173,
        "flow_id": "flow-3d8eaa53176906bc88f13511",
        "packets": 7,
        "transport": "tcp",
        "last_frame": 6190,
        "first_frame": 2753,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.136.101",
        "initiator_port": 49235,
        "responder_port": 80,
        "initiator_bytes": 228,
        "last_seen_epoch": "1561247380.621248",
        "responder_bytes": 166,
        "first_seen_epoch": "1561247263.910966"
      },
      {
        "bytes": 206,
        "stream": 81,
        "flow_id": "flow-dc5d9de9012b218397f95a94",
        "packets": 2,
        "transport": "udp",
        "last_frame": 2829,
        "first_frame": 2828,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 55510,
        "responder_port": 53,
        "initiator_bytes": 77,
        "last_seen_epoch": "1561247264.072915",
        "responder_bytes": 129,
        "first_seen_epoch": "1561247264.057758"
      },
      {
        "bytes": 28106,
        "stream": 174,
        "flow_id": "flow-69ea01e741a436fc9f38bc17",
        "packets": 44,
        "transport": "tcp",
        "last_frame": 6204,
        "first_frame": 2830,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "216.58.193.163",
        "initiator_port": 49236,
        "responder_port": 443,
        "initiator_bytes": 1853,
        "last_seen_epoch": "1561247380.624478",
        "responder_bytes": 26253,
        "first_seen_epoch": "1561247264.073453"
      },
      {
        "bytes": 28194,
        "stream": 175,
        "flow_id": "flow-34208c2ffb7ab77af5fe605a",
        "packets": 49,
        "transport": "tcp",
        "last_frame": 6201,
        "first_frame": 2831,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "216.58.193.163",
        "initiator_port": 49237,
        "responder_port": 443,
        "initiator_bytes": 2119,
        "last_seen_epoch": "1561247380.62417",
        "responder_bytes": 26075,
        "first_seen_epoch": "1561247264.073639"
      },
      {
        "bytes": 27984,
        "stream": 176,
        "flow_id": "flow-b299a4a44f4145e5df7d3d2e",
        "packets": 44,
        "transport": "tcp",
        "last_frame": 6192,
        "first_frame": 2832,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "216.58.193.163",
        "initiator_port": 49238,
        "responder_port": 443,
        "initiator_bytes": 1853,
        "last_seen_epoch": "1561247380.621346",
        "responder_bytes": 26131,
        "first_seen_epoch": "1561247264.073838"
      },
      {
        "bytes": 230,
        "stream": 82,
        "flow_id": "flow-93effa85527f7a90ae96bee3",
        "packets": 2,
        "transport": "udp",
        "last_frame": 2895,
        "first_frame": 2894,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 63464,
        "responder_port": 53,
        "initiator_bytes": 83,
        "last_seen_epoch": "1561247264.15814",
        "responder_bytes": 147,
        "first_seen_epoch": "1561247264.157893"
      },
      {
        "bytes": 8628,
        "stream": 177,
        "flow_id": "flow-8abd3cf22f62653ccac59cbf",
        "packets": 27,
        "transport": "tcp",
        "last_frame": 6193,
        "first_frame": 2896,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "104.244.42.8",
        "initiator_port": 49239,
        "responder_port": 443,
        "initiator_bytes": 2549,
        "last_seen_epoch": "1561247380.621388",
        "responder_bytes": 6079,
        "first_seen_epoch": "1561247264.158519"
      },
      {
        "bytes": 5256,
        "stream": 178,
        "flow_id": "flow-67ff10824a2bf6286d26459e",
        "packets": 22,
        "transport": "tcp",
        "last_frame": 6100,
        "first_frame": 2897,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "104.244.42.8",
        "initiator_port": 49240,
        "responder_port": 443,
        "initiator_bytes": 991,
        "last_seen_epoch": "1561247380.609449",
        "responder_bytes": 4265,
        "first_seen_epoch": "1561247264.158714"
      },
      {
        "bytes": 220,
        "stream": 83,
        "flow_id": "flow-01f19e875b2c729a0755d63c",
        "packets": 2,
        "transport": "udp",
        "last_frame": 2998,
        "first_frame": 2991,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 64129,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247264.383975",
        "responder_bytes": 148,
        "first_seen_epoch": "1561247264.369133"
      },
      {
        "bytes": 265,
        "stream": 84,
        "flow_id": "flow-c15e750aada82698860469a0",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3039,
        "first_frame": 2992,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 51764,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247264.439764",
        "responder_bytes": 193,
        "first_seen_epoch": "1561247264.37299"
      },
      {
        "bytes": 276,
        "stream": 85,
        "flow_id": "flow-e36457f77e13db91fa271fe0",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3036,
        "first_frame": 2993,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 52928,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247264.439549",
        "responder_bytes": 204,
        "first_seen_epoch": "1561247264.374122"
      },
      {
        "bytes": 231,
        "stream": 86,
        "flow_id": "flow-d63d5bb4cce8d32a5fb48bc0",
        "packets": 2,
        "transport": "udp",
        "last_frame": 2997,
        "first_frame": 2994,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 65149,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247264.383906",
        "responder_bytes": 159,
        "first_seen_epoch": "1561247264.375828"
      },
      {
        "bytes": 276,
        "stream": 87,
        "flow_id": "flow-ecc0751cba0c44751fc70e8e",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3037,
        "first_frame": 2995,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 55257,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247264.439629",
        "responder_bytes": 204,
        "first_seen_epoch": "1561247264.376745"
      },
      {
        "bytes": 276,
        "stream": 88,
        "flow_id": "flow-15d85c86affdd61a1aff7cde",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3038,
        "first_frame": 2996,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 58743,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247264.439693",
        "responder_bytes": 204,
        "first_seen_epoch": "1561247264.377965"
      },
      {
        "bytes": 166,
        "stream": 89,
        "flow_id": "flow-40024e200af7aab323d61276",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3099,
        "first_frame": 3092,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49967,
        "responder_port": 53,
        "initiator_bytes": 75,
        "last_seen_epoch": "1561247264.566187",
        "responder_bytes": 91,
        "first_seen_epoch": "1561247264.551377"
      },
      {
        "bytes": 4851,
        "stream": 179,
        "flow_id": "flow-2e9a7bb3cac013a2d473b6b3",
        "packets": 19,
        "transport": "tcp",
        "last_frame": 6191,
        "first_frame": 3101,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "172.217.2.35",
        "initiator_port": 49241,
        "responder_port": 443,
        "initiator_bytes": 835,
        "last_seen_epoch": "1561247380.621298",
        "responder_bytes": 4016,
        "first_seen_epoch": "1561247264.567434"
      },
      {
        "bytes": 5999,
        "stream": 180,
        "flow_id": "flow-f902018e232970ac17998665",
        "packets": 23,
        "transport": "tcp",
        "last_frame": 6181,
        "first_frame": 3103,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "172.217.2.35",
        "initiator_port": 49242,
        "responder_port": 443,
        "initiator_bytes": 1364,
        "last_seen_epoch": "1561247380.619753",
        "responder_bytes": 4635,
        "first_seen_epoch": "1561247264.567698"
      },
      {
        "bytes": 250,
        "stream": 90,
        "flow_id": "flow-13ddfc65b16afe07ae25466d",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3137,
        "first_frame": 3136,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 51580,
        "responder_port": 53,
        "initiator_bytes": 81,
        "last_seen_epoch": "1561247264.725563",
        "responder_bytes": 169,
        "first_seen_epoch": "1561247264.705292"
      },
      {
        "bytes": 3854,
        "stream": 181,
        "flow_id": "flow-f89b08df974a97d065d466b6",
        "packets": 17,
        "transport": "tcp",
        "last_frame": 6194,
        "first_frame": 3138,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "64.233.185.155",
        "initiator_port": 49243,
        "responder_port": 443,
        "initiator_bytes": 787,
        "last_seen_epoch": "1561247380.621425",
        "responder_bytes": 3067,
        "first_seen_epoch": "1561247264.726161"
      },
      {
        "bytes": 5268,
        "stream": 182,
        "flow_id": "flow-abbd5fe6ee35528a6c5d3b78",
        "packets": 21,
        "transport": "tcp",
        "last_frame": 6182,
        "first_frame": 3139,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "64.233.185.155",
        "initiator_port": 49244,
        "responder_port": 443,
        "initiator_bytes": 1312,
        "last_seen_epoch": "1561247380.619879",
        "responder_bytes": 3956,
        "first_seen_epoch": "1561247264.726362"
      },
      {
        "bytes": 265,
        "stream": 91,
        "flow_id": "flow-945277c6a54eb5262b84d1d7",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3181,
        "first_frame": 3180,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 53715,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247265.473452",
        "responder_bytes": 193,
        "first_seen_epoch": "1561247265.431804"
      },
      {
        "bytes": 1258,
        "stream": 183,
        "flow_id": "flow-d0a8b2e796e82407edf779b9",
        "packets": 8,
        "transport": "tcp",
        "last_frame": 6055,
        "first_frame": 3182,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "13.107.21.200",
        "initiator_port": 49246,
        "responder_port": 80,
        "initiator_bytes": 456,
        "last_seen_epoch": "1561247332.679737",
        "responder_bytes": 802,
        "first_seen_epoch": "1561247265.476066"
      },
      {
        "bytes": 340,
        "stream": 184,
        "flow_id": "flow-57d8341e86d4d483c148ebaf",
        "packets": 6,
        "transport": "tcp",
        "last_frame": 6261,
        "first_frame": 3183,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "13.107.21.200",
        "initiator_port": 49245,
        "responder_port": 80,
        "initiator_bytes": 174,
        "last_seen_epoch": "1561247385.428514",
        "responder_bytes": 166,
        "first_seen_epoch": "1561247265.476334"
      },
      {
        "bytes": 1132,
        "stream": 185,
        "flow_id": "flow-12f4f2b69ee307f5397f1a9a",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 6217,
        "first_frame": 3198,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49229,
        "responder_port": 443,
        "initiator_bytes": 636,
        "last_seen_epoch": "1561247380.626479",
        "responder_bytes": 496,
        "first_seen_epoch": "1561247266.385604"
      },
      {
        "bytes": 197,
        "stream": 92,
        "flow_id": "flow-9340f39307e28dc13c5d4099",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3210,
        "first_frame": 3209,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 61611,
        "responder_port": 53,
        "initiator_bytes": 76,
        "last_seen_epoch": "1561247270.199357",
        "responder_bytes": 121,
        "first_seen_epoch": "1561247270.166321"
      },
      {
        "bytes": 7541,
        "stream": 186,
        "flow_id": "flow-8e23fd6eeb468df48a24dcdb",
        "packets": 26,
        "transport": "tcp",
        "last_frame": 6051,
        "first_frame": 3211,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.36",
        "initiator_port": 49247,
        "responder_port": 443,
        "initiator_bytes": 2303,
        "last_seen_epoch": "1561247331.908282",
        "responder_bytes": 5238,
        "first_seen_epoch": "1561247270.200166"
      },
      {
        "bytes": 22657,
        "stream": 187,
        "flow_id": "flow-209aae7637a681e1326f0659",
        "packets": 43,
        "transport": "tcp",
        "last_frame": 6049,
        "first_frame": 3212,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.36",
        "initiator_port": 49248,
        "responder_port": 443,
        "initiator_bytes": 2208,
        "last_seen_epoch": "1561247331.908105",
        "responder_bytes": 20449,
        "first_seen_epoch": "1561247270.200303"
      },
      {
        "bytes": 24544,
        "stream": 188,
        "flow_id": "flow-776c9f00b9f29fee7e323914",
        "packets": 44,
        "transport": "tcp",
        "last_frame": 6048,
        "first_frame": 3213,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.36",
        "initiator_port": 49249,
        "responder_port": 443,
        "initiator_bytes": 2122,
        "last_seen_epoch": "1561247331.907995",
        "responder_bytes": 22422,
        "first_seen_epoch": "1561247270.200524"
      },
      {
        "bytes": 174,
        "stream": 189,
        "flow_id": "flow-5e66a0f03cfc23545d386d06",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 3217,
        "first_frame": 3214,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.36",
        "initiator_port": 49250,
        "responder_port": 443,
        "initiator_bytes": 120,
        "last_seen_epoch": "1561247270.201455",
        "responder_bytes": 54,
        "first_seen_epoch": "1561247270.200634"
      },
      {
        "bytes": 8065,
        "stream": 190,
        "flow_id": "flow-4d9f6f1bb0dba57d032fdb7e",
        "packets": 26,
        "transport": "tcp",
        "last_frame": 6052,
        "first_frame": 3215,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.36",
        "initiator_port": 49251,
        "responder_port": 443,
        "initiator_bytes": 3894,
        "last_seen_epoch": "1561247331.908381",
        "responder_bytes": 4171,
        "first_seen_epoch": "1561247270.200866"
      },
      {
        "bytes": 197,
        "stream": 93,
        "flow_id": "flow-d8c1ba8e99253cc0efac397c",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3309,
        "first_frame": 3308,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49191,
        "responder_port": 53,
        "initiator_bytes": 79,
        "last_seen_epoch": "1561247270.428911",
        "responder_bytes": 118,
        "first_seen_epoch": "1561247270.428637"
      },
      {
        "bytes": 174,
        "stream": 191,
        "flow_id": "flow-74eded8b4b36e50c8bd304a3",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 3314,
        "first_frame": 3312,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49252,
        "responder_port": 443,
        "initiator_bytes": 120,
        "last_seen_epoch": "1561247270.429549",
        "responder_bytes": 54,
        "first_seen_epoch": "1561247270.429327"
      },
      {
        "bytes": 174,
        "stream": 192,
        "flow_id": "flow-d3ad221c55998ef1eb389d81",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 3317,
        "first_frame": 3315,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49253,
        "responder_port": 443,
        "initiator_bytes": 120,
        "last_seen_epoch": "1561247270.429817",
        "responder_bytes": 54,
        "first_seen_epoch": "1561247270.429652"
      },
      {
        "bytes": 174,
        "stream": 193,
        "flow_id": "flow-e3ea24b6bf68f2a61de2677f",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 3333,
        "first_frame": 3331,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49254,
        "responder_port": 443,
        "initiator_bytes": 120,
        "last_seen_epoch": "1561247270.444124",
        "responder_bytes": 54,
        "first_seen_epoch": "1561247270.443922"
      },
      {
        "bytes": 317024,
        "stream": 194,
        "flow_id": "flow-9f41fcf68a1f06bb136f1bc2",
        "packets": 345,
        "transport": "tcp",
        "last_frame": 6184,
        "first_frame": 3340,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49255,
        "responder_port": 443,
        "initiator_bytes": 10122,
        "last_seen_epoch": "1561247380.620067",
        "responder_bytes": 306902,
        "first_seen_epoch": "1561247270.455127"
      },
      {
        "bytes": 5199,
        "stream": 195,
        "flow_id": "flow-e62f736a506c55caacbd647e",
        "packets": 21,
        "transport": "tcp",
        "last_frame": 7005,
        "first_frame": 3694,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.36",
        "initiator_port": 49250,
        "responder_port": 443,
        "initiator_bytes": 3542,
        "last_seen_epoch": "1561247393.66481",
        "responder_bytes": 1657,
        "first_seen_epoch": "1561247273.208693"
      },
      {
        "bytes": 1130,
        "stream": 196,
        "flow_id": "flow-15423c890101808c50bd52d8",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 6183,
        "first_frame": 3703,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49254,
        "responder_port": 443,
        "initiator_bytes": 634,
        "last_seen_epoch": "1561247380.619982",
        "responder_bytes": 496,
        "first_seen_epoch": "1561247273.442606"
      },
      {
        "bytes": 1130,
        "stream": 197,
        "flow_id": "flow-1f69611406af18d43db3794e",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 6180,
        "first_frame": 3704,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49253,
        "responder_port": 443,
        "initiator_bytes": 634,
        "last_seen_epoch": "1561247380.619615",
        "responder_bytes": 496,
        "first_seen_epoch": "1561247273.442714"
      },
      {
        "bytes": 1130,
        "stream": 198,
        "flow_id": "flow-72a372640cb9fe8a06d2ee9e",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 6176,
        "first_frame": 3705,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49252,
        "responder_port": 443,
        "initiator_bytes": 634,
        "last_seen_epoch": "1561247380.619465",
        "responder_bytes": 496,
        "first_seen_epoch": "1561247273.442785"
      },
      {
        "bytes": 172,
        "stream": 94,
        "flow_id": "flow-6c55d77f60e77d7bd3fa282c",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3742,
        "first_frame": 3741,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49857,
        "responder_port": 53,
        "initiator_bytes": 78,
        "last_seen_epoch": "1561247283.743525",
        "responder_bytes": 94,
        "first_seen_epoch": "1561247283.724891"
      },
      {
        "bytes": 1942,
        "stream": 199,
        "flow_id": "flow-8e780ba9a735188f434294c7",
        "packets": 8,
        "transport": "tcp",
        "last_frame": 6009,
        "first_frame": 3744,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "91.235.129.60",
        "initiator_port": 49201,
        "responder_port": 80,
        "initiator_bytes": 543,
        "last_seen_epoch": "1561247322.571972",
        "responder_bytes": 1399,
        "first_seen_epoch": "1561247284.508474"
      },
      {
        "bytes": 232,
        "stream": 200,
        "flow_id": "flow-13391aa9f4dd66bce99127d8",
        "packets": 4,
        "transport": "tcp",
        "last_frame": 6007,
        "first_frame": 3745,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "91.235.129.60",
        "initiator_port": 49202,
        "responder_port": 80,
        "initiator_bytes": 174,
        "last_seen_epoch": "1561247322.571516",
        "responder_bytes": 58,
        "first_seen_epoch": "1561247284.508664"
      },
      {
        "bytes": 12051,
        "stream": 201,
        "flow_id": "flow-c883c7df6ff8f3bd4720ea82",
        "packets": 24,
        "transport": "tcp",
        "last_frame": 6010,
        "first_frame": 3754,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "37.46.135.170",
        "initiator_port": 49203,
        "responder_port": 80,
        "initiator_bytes": 1840,
        "last_seen_epoch": "1561247322.572136",
        "responder_bytes": 10211,
        "first_seen_epoch": "1561247284.940238"
      },
      {
        "bytes": 54935,
        "stream": 202,
        "flow_id": "flow-340c8d83768c52121ce8a305",
        "packets": 69,
        "transport": "tcp",
        "last_frame": 6008,
        "first_frame": 3755,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "37.46.135.170",
        "initiator_port": 49204,
        "responder_port": 80,
        "initiator_bytes": 2386,
        "last_seen_epoch": "1561247322.571728",
        "responder_bytes": 52549,
        "first_seen_epoch": "1561247284.940415"
      },
      {
        "bytes": 1280,
        "stream": 203,
        "flow_id": "flow-8941e11978d580aabdefbca9",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 4414,
        "first_frame": 3764,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49256,
        "responder_port": 135,
        "initiator_bytes": 718,
        "last_seen_epoch": "1561247296.188683",
        "responder_bytes": 562,
        "first_seen_epoch": "1561247286.183321"
      },
      {
        "bytes": 1468,
        "stream": 204,
        "flow_id": "flow-c382b73a697617193358d5ad",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 4412,
        "first_frame": 3771,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49257,
        "responder_port": 49155,
        "initiator_bytes": 874,
        "last_seen_epoch": "1561247296.188575",
        "responder_bytes": 594,
        "first_seen_epoch": "1561247286.185107"
      },
      {
        "bytes": 220,
        "stream": 95,
        "flow_id": "flow-c6034944e1db43539231c17e",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3859,
        "first_frame": 3858,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 51234,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247287.951071",
        "responder_bytes": 148,
        "first_seen_epoch": "1561247287.950762"
      },
      {
        "bytes": 265,
        "stream": 96,
        "flow_id": "flow-466a7d271f670b7093769d27",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3868,
        "first_frame": 3860,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 57195,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247288.316915",
        "responder_bytes": 193,
        "first_seen_epoch": "1561247287.954342"
      },
      {
        "bytes": 276,
        "stream": 97,
        "flow_id": "flow-4bc73dc7e5a6914e236d2e4d",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3865,
        "first_frame": 3861,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 51756,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247288.316485",
        "responder_bytes": 204,
        "first_seen_epoch": "1561247287.954812"
      },
      {
        "bytes": 276,
        "stream": 98,
        "flow_id": "flow-137b4e5a54a180a1bf715d75",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3866,
        "first_frame": 3862,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 50499,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247288.316682",
        "responder_bytes": 204,
        "first_seen_epoch": "1561247287.956352"
      },
      {
        "bytes": 276,
        "stream": 99,
        "flow_id": "flow-dc1b6c5b1d55875a99a407f6",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3867,
        "first_frame": 3863,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49448,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247288.316802",
        "responder_bytes": 204,
        "first_seen_epoch": "1561247287.957364"
      },
      {
        "bytes": 265,
        "stream": 100,
        "flow_id": "flow-1168df9ea4fa55f186f886f6",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3874,
        "first_frame": 3871,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 51826,
        "responder_port": 53,
        "initiator_bytes": 72,
        "last_seen_epoch": "1561247289.399319",
        "responder_bytes": 193,
        "first_seen_epoch": "1561247289.19896"
      },
      {
        "bytes": 1258,
        "stream": 205,
        "flow_id": "flow-dad3c6f9d99c370c1a380a30",
        "packets": 8,
        "transport": "tcp",
        "last_frame": 6061,
        "first_frame": 3875,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "13.107.21.200",
        "initiator_port": 49205,
        "responder_port": 80,
        "initiator_bytes": 510,
        "last_seen_epoch": "1561247337.70572",
        "responder_bytes": 748,
        "first_seen_epoch": "1561247289.400828"
      },
      {
        "bytes": 232,
        "stream": 206,
        "flow_id": "flow-806f7fe6cbb39c58656880b7",
        "packets": 4,
        "transport": "tcp",
        "last_frame": 6062,
        "first_frame": 3876,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "13.107.21.200",
        "initiator_port": 49206,
        "responder_port": 80,
        "initiator_bytes": 174,
        "last_seen_epoch": "1561247337.705872",
        "responder_bytes": 58,
        "first_seen_epoch": "1561247289.400903"
      },
      {
        "bytes": 610299,
        "stream": 207,
        "flow_id": "flow-4296aa8a5281a03a8aebc9d1",
        "packets": 467,
        "transport": "tcp",
        "last_frame": 6011,
        "first_frame": 3890,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "37.46.135.170",
        "initiator_port": 49207,
        "responder_port": 80,
        "initiator_bytes": 3937,
        "last_seen_epoch": "1561247322.572976",
        "responder_bytes": 606362,
        "first_seen_epoch": "1561247289.967732"
      },
      {
        "bytes": 246,
        "stream": 101,
        "flow_id": "flow-4341a742e1fad808d1997386",
        "packets": 2,
        "transport": "udp",
        "last_frame": 3896,
        "first_frame": 3895,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59774,
        "responder_port": 53,
        "initiator_bytes": 82,
        "last_seen_epoch": "1561247290.404107",
        "responder_bytes": 164,
        "first_seen_epoch": "1561247290.403822"
      },
      {
        "bytes": 9831,
        "stream": 208,
        "flow_id": "flow-d070f197f71e46f58d4307fb",
        "packets": 28,
        "transport": "tcp",
        "last_frame": 6260,
        "first_frame": 3897,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "72.21.81.200",
        "initiator_port": 49258,
        "responder_port": 443,
        "initiator_bytes": 1503,
        "last_seen_epoch": "1561247385.426711",
        "responder_bytes": 8328,
        "first_seen_epoch": "1561247290.404627"
      },
      {
        "bytes": 8789,
        "stream": 209,
        "flow_id": "flow-aa98b15107617ca8af69635b",
        "packets": 24,
        "transport": "tcp",
        "last_frame": 6256,
        "first_frame": 3898,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "72.21.81.200",
        "initiator_port": 49259,
        "responder_port": 443,
        "initiator_bytes": 990,
        "last_seen_epoch": "1561247385.416076",
        "responder_bytes": 7799,
        "first_seen_epoch": "1561247290.404711"
      },
      {
        "bytes": 611862,
        "stream": 210,
        "flow_id": "flow-663acb8efa75561b3676c32c",
        "packets": 471,
        "transport": "tcp",
        "last_frame": 4884,
        "first_frame": 4406,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "37.46.135.170",
        "initiator_port": 49208,
        "responder_port": 80,
        "initiator_bytes": 4034,
        "last_seen_epoch": "1561247301.113007",
        "responder_bytes": 607828,
        "first_seen_epoch": "1561247296.086931"
      },
      {
        "bytes": 168,
        "stream": 102,
        "flow_id": "flow-07e2a7b4ec16a86c6d050d08",
        "packets": 2,
        "transport": "udp",
        "last_frame": 4889,
        "first_frame": 4886,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 62271,
        "responder_port": 53,
        "initiator_bytes": 76,
        "last_seen_epoch": "1561247302.953345",
        "responder_bytes": 92,
        "first_seen_epoch": "1561247302.513902"
      },
      {
        "bytes": 1300,
        "stream": 211,
        "flow_id": "flow-b260f9141a83f59db3c5f954",
        "packets": 11,
        "transport": "tcp",
        "last_frame": 4901,
        "first_frame": 4890,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "8.209.83.76",
        "initiator_port": 49209,
        "responder_port": 80,
        "initiator_bytes": 476,
        "last_seen_epoch": "1561247303.513003",
        "responder_bytes": 824,
        "first_seen_epoch": "1561247302.959767"
      },
      {
        "bytes": 1300,
        "stream": 212,
        "flow_id": "flow-b85e39ac9a03e0db90c0cc39",
        "packets": 11,
        "transport": "tcp",
        "last_frame": 4914,
        "first_frame": 4904,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "8.209.83.76",
        "initiator_port": 49210,
        "responder_port": 80,
        "initiator_bytes": 476,
        "last_seen_epoch": "1561247308.243255",
        "responder_bytes": 824,
        "first_seen_epoch": "1561247307.629166"
      },
      {
        "bytes": 374083,
        "stream": 213,
        "flow_id": "flow-29ad147cfe4e70b1aeb66ca1",
        "packets": 497,
        "transport": "tcp",
        "last_frame": 5903,
        "first_frame": 4916,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "8.209.83.76",
        "initiator_port": 49211,
        "responder_port": 80,
        "initiator_bytes": 360249,
        "last_seen_epoch": "1561247311.159172",
        "responder_bytes": 13834,
        "first_seen_epoch": "1561247308.514434"
      },
      {
        "bytes": 374720,
        "stream": 214,
        "flow_id": "flow-d26a428865eb77dde5bd0790",
        "packets": 496,
        "transport": "tcp",
        "last_frame": 5913,
        "first_frame": 5269,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "8.209.83.76",
        "initiator_port": 49212,
        "responder_port": 80,
        "initiator_bytes": 360994,
        "last_seen_epoch": "1561247311.901045",
        "responder_bytes": 13726,
        "first_seen_epoch": "1561247309.32203"
      },
      {
        "bytes": 1050,
        "stream": 103,
        "flow_id": "flow-9e1b4f42ebec1602bbdc1eae",
        "packets": 6,
        "transport": "udp",
        "last_frame": 6004,
        "first_frame": 5905,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "239.255.255.250",
        "initiator_port": 59776,
        "responder_port": 1900,
        "initiator_bytes": 1050,
        "last_seen_epoch": "1561247317.564933",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247311.213862"
      },
      {
        "bytes": 246,
        "stream": 104,
        "flow_id": "flow-52d0f659569218c643b16ae3",
        "packets": 2,
        "transport": "udp",
        "last_frame": 5919,
        "first_frame": 5918,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 53059,
        "responder_port": 53,
        "initiator_bytes": 82,
        "last_seen_epoch": "1561247314.083666",
        "responder_bytes": 164,
        "first_seen_epoch": "1561247314.083341"
      },
      {
        "bytes": 8573,
        "stream": 215,
        "flow_id": "flow-19dc7bd7e43a61e341ec4fd2",
        "packets": 20,
        "transport": "tcp",
        "last_frame": 6063,
        "first_frame": 5920,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "72.21.81.200",
        "initiator_port": 49213,
        "responder_port": 443,
        "initiator_bytes": 882,
        "last_seen_epoch": "1561247337.70601",
        "responder_bytes": 7691,
        "first_seen_epoch": "1561247314.084225"
      },
      {
        "bytes": 45037,
        "stream": 216,
        "flow_id": "flow-11e4a9512b3291610a3c7dd7",
        "packets": 63,
        "transport": "tcp",
        "last_frame": 6064,
        "first_frame": 5921,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "72.21.81.200",
        "initiator_port": 49214,
        "responder_port": 443,
        "initiator_bytes": 2179,
        "last_seen_epoch": "1561247337.706165",
        "responder_bytes": 42858,
        "first_seen_epoch": "1561247314.084399"
      },
      {
        "bytes": 1280,
        "stream": 217,
        "flow_id": "flow-82252886ec63977a5af92e59",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 6077,
        "first_frame": 6012,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49215,
        "responder_port": 135,
        "initiator_bytes": 718,
        "last_seen_epoch": "1561247343.457764",
        "responder_bytes": 562,
        "first_seen_epoch": "1561247322.970441"
      },
      {
        "bytes": 1468,
        "stream": 218,
        "flow_id": "flow-1febf990b1c097f99bfbd355",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 6075,
        "first_frame": 6019,
        "initiator_ip": "10.0.76.109",
        "responder_ip": "10.0.76.6",
        "initiator_port": 49216,
        "responder_port": 49155,
        "initiator_bytes": 874,
        "last_seen_epoch": "1561247343.457642",
        "responder_bytes": 594,
        "first_seen_epoch": "1561247322.972144"
      },
      {
        "bytes": 54,
        "stream": 219,
        "flow_id": "flow-edb51fd7b912f16f444258cb",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 6030,
        "first_frame": 6030,
        "initiator_ip": "35.226.156.55",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49215,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247325.412623",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247325.412623"
      },
      {
        "bytes": 54,
        "stream": 220,
        "flow_id": "flow-613436496c162a5066976be1",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 6056,
        "first_frame": 6056,
        "initiator_ip": "185.254.190.200",
        "responder_ip": "10.0.76.109",
        "initiator_port": 80,
        "responder_port": 49202,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247332.777711",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247332.777711"
      },
      {
        "bytes": 54,
        "stream": 221,
        "flow_id": "flow-223711f731004cd82a05c65f",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 6065,
        "first_frame": 6065,
        "initiator_ip": "35.226.156.55",
        "responder_ip": "10.0.76.193",
        "initiator_port": 443,
        "responder_port": 49214,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247340.884241",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247340.884241"
      },
      {
        "bytes": 54,
        "stream": 222,
        "flow_id": "flow-bb555d9f7430c441382bfbbc",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 6066,
        "first_frame": 6066,
        "initiator_ip": "35.226.156.55",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49205,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247340.908297",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247340.908297"
      },
      {
        "bytes": 54,
        "stream": 223,
        "flow_id": "flow-84a2cf452bdea26c2cad9fcb",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 6067,
        "first_frame": 6067,
        "initiator_ip": "35.226.156.55",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49206,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247340.908319",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247340.908319"
      },
      {
        "bytes": 54,
        "stream": 224,
        "flow_id": "flow-bde270f2f838ce710b04ce42",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 6068,
        "first_frame": 6068,
        "initiator_ip": "35.226.156.55",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49203,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247341.266549",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247341.266549"
      },
      {
        "bytes": 54,
        "stream": 225,
        "flow_id": "flow-2f4634c23bb1636a6138b388",
        "packets": 1,
        "transport": "tcp",
        "last_frame": 6069,
        "first_frame": 6069,
        "initiator_ip": "35.226.156.55",
        "responder_ip": "10.0.76.193",
        "initiator_port": 80,
        "responder_port": 49204,
        "initiator_bytes": 54,
        "last_seen_epoch": "1561247341.266599",
        "responder_bytes": 0,
        "first_seen_epoch": "1561247341.266599"
      },
      {
        "bytes": 22058,
        "stream": 226,
        "flow_id": "flow-496bca2de0b2c81e7f7ff100",
        "packets": 34,
        "transport": "tcp",
        "last_frame": 6991,
        "first_frame": 6262,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49260,
        "responder_port": 80,
        "initiator_bytes": 3842,
        "last_seen_epoch": "1561247393.643731",
        "responder_bytes": 18216,
        "first_seen_epoch": "1561247390.317744"
      },
      {
        "bytes": 65413,
        "stream": 227,
        "flow_id": "flow-1f1ff7ac55e8f5904e58869c",
        "packets": 90,
        "transport": "tcp",
        "last_frame": 6992,
        "first_frame": 6263,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49261,
        "responder_port": 80,
        "initiator_bytes": 5693,
        "last_seen_epoch": "1561247393.643782",
        "responder_bytes": 59720,
        "first_seen_epoch": "1561247390.317954"
      },
      {
        "bytes": 24755,
        "stream": 228,
        "flow_id": "flow-a73f41eb8be750aad48669c8",
        "packets": 39,
        "transport": "tcp",
        "last_frame": 7049,
        "first_frame": 6288,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49262,
        "responder_port": 80,
        "initiator_bytes": 4732,
        "last_seen_epoch": "1561247393.929204",
        "responder_bytes": 20023,
        "first_seen_epoch": "1561247391.281137"
      },
      {
        "bytes": 897,
        "stream": 229,
        "flow_id": "flow-8595fa1864d67a9fa6e954c8",
        "packets": 9,
        "transport": "tcp",
        "last_frame": 6338,
        "first_frame": 6319,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "173.194.219.156",
        "initiator_port": 49263,
        "responder_port": 443,
        "initiator_bytes": 534,
        "last_seen_epoch": "1561247391.548814",
        "responder_bytes": 363,
        "first_seen_epoch": "1561247391.519333"
      },
      {
        "bytes": 3982,
        "stream": 230,
        "flow_id": "flow-26b1d23a5d67547c81826bc6",
        "packets": 14,
        "transport": "tcp",
        "last_frame": 6364,
        "first_frame": 6320,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "173.194.219.156",
        "initiator_port": 49264,
        "responder_port": 443,
        "initiator_bytes": 1481,
        "last_seen_epoch": "1561247391.997261",
        "responder_bytes": 2501,
        "first_seen_epoch": "1561247391.519583"
      },
      {
        "bytes": 1618,
        "stream": 231,
        "flow_id": "flow-656c840ef200ed9768093231",
        "packets": 7,
        "transport": "tcp",
        "last_frame": 6395,
        "first_frame": 6339,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.138.138",
        "initiator_port": 49265,
        "responder_port": 80,
        "initiator_bytes": 1065,
        "last_seen_epoch": "1561247392.019458",
        "responder_bytes": 553,
        "first_seen_epoch": "1561247391.606523"
      },
      {
        "bytes": 1610,
        "stream": 232,
        "flow_id": "flow-986f3e4952d7165c380edf14",
        "packets": 7,
        "transport": "tcp",
        "last_frame": 6391,
        "first_frame": 6340,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.138.138",
        "initiator_port": 49266,
        "responder_port": 80,
        "initiator_bytes": 1057,
        "last_seen_epoch": "1561247392.017573",
        "responder_bytes": 553,
        "first_seen_epoch": "1561247391.607028"
      },
      {
        "bytes": 17865,
        "stream": 233,
        "flow_id": "flow-622121bb957f75412c20e3c3",
        "packets": 30,
        "transport": "tcp",
        "last_frame": 6990,
        "first_frame": 6342,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49267,
        "responder_port": 443,
        "initiator_bytes": 1791,
        "last_seen_epoch": "1561247393.643664",
        "responder_bytes": 16074,
        "first_seen_epoch": "1561247391.618705"
      },
      {
        "bytes": 64848,
        "stream": 234,
        "flow_id": "flow-ee1deb3f9e484e7c62a22955",
        "packets": 63,
        "transport": "tcp",
        "last_frame": 6994,
        "first_frame": 6345,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49268,
        "responder_port": 80,
        "initiator_bytes": 2540,
        "last_seen_epoch": "1561247393.643944",
        "responder_bytes": 62308,
        "first_seen_epoch": "1561247391.619793"
      },
      {
        "bytes": 18307,
        "stream": 235,
        "flow_id": "flow-167204e90e008a8d245edab8",
        "packets": 32,
        "transport": "tcp",
        "last_frame": 6976,
        "first_frame": 6346,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49269,
        "responder_port": 443,
        "initiator_bytes": 1920,
        "last_seen_epoch": "1561247393.627714",
        "responder_bytes": 16387,
        "first_seen_epoch": "1561247391.620197"
      },
      {
        "bytes": 267,
        "stream": 105,
        "flow_id": "flow-06ccf4db3e6722467e6090fd",
        "packets": 2,
        "transport": "udp",
        "last_frame": 6509,
        "first_frame": 6347,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 55748,
        "responder_port": 53,
        "initiator_bytes": 80,
        "last_seen_epoch": "1561247392.082847",
        "responder_bytes": 187,
        "first_seen_epoch": "1561247391.622604"
      },
      {
        "bytes": 2142,
        "stream": 236,
        "flow_id": "flow-d96fd965a977320d8fb0e8f0",
        "packets": 7,
        "transport": "tcp",
        "last_frame": 6589,
        "first_frame": 6348,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49270,
        "responder_port": 80,
        "initiator_bytes": 565,
        "last_seen_epoch": "1561247392.522976",
        "responder_bytes": 1577,
        "first_seen_epoch": "1561247391.624107"
      },
      {
        "bytes": 2319,
        "stream": 237,
        "flow_id": "flow-ee726372a5438142b765669a",
        "packets": 8,
        "transport": "tcp",
        "last_frame": 6590,
        "first_frame": 6349,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49271,
        "responder_port": 80,
        "initiator_bytes": 572,
        "last_seen_epoch": "1561247392.52309",
        "responder_bytes": 1747,
        "first_seen_epoch": "1561247391.625771"
      },
      {
        "bytes": 212,
        "stream": 106,
        "flow_id": "flow-cd111481466ffbedfcf0fcf6",
        "packets": 2,
        "transport": "udp",
        "last_frame": 6390,
        "first_frame": 6350,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "10.0.76.6",
        "initiator_port": 59919,
        "responder_port": 53,
        "initiator_bytes": 80,
        "last_seen_epoch": "1561247392.017533",
        "responder_bytes": 132,
        "first_seen_epoch": "1561247391.626791"
      },
      {
        "bytes": 2424,
        "stream": 238,
        "flow_id": "flow-8efc612aba2ea90b8c4a93d8",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 6682,
        "first_frame": 6351,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49272,
        "responder_port": 443,
        "initiator_bytes": 1066,
        "last_seen_epoch": "1561247392.611648",
        "responder_bytes": 1358,
        "first_seen_epoch": "1561247391.628526"
      },
      {
        "bytes": 22014,
        "stream": 239,
        "flow_id": "flow-7f6502ec7471d64de7dc44e7",
        "packets": 32,
        "transport": "tcp",
        "last_frame": 6803,
        "first_frame": 6352,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49273,
        "responder_port": 443,
        "initiator_bytes": 1390,
        "last_seen_epoch": "1561247393.118129",
        "responder_bytes": 20624,
        "first_seen_epoch": "1561247391.630744"
      },
      {
        "bytes": 2712,
        "stream": 240,
        "flow_id": "flow-3505c6ff6a2230f51b2ae4bd",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 6592,
        "first_frame": 6371,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "64.233.185.103",
        "initiator_port": 49274,
        "responder_port": 443,
        "initiator_bytes": 1637,
        "last_seen_epoch": "1561247392.523202",
        "responder_bytes": 1075,
        "first_seen_epoch": "1561247392.000532"
      },
      {
        "bytes": 992,
        "stream": 241,
        "flow_id": "flow-11f6e2b4d291f9720051ed29",
        "packets": 11,
        "transport": "tcp",
        "last_frame": 7099,
        "first_frame": 6372,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "64.233.185.103",
        "initiator_port": 49275,
        "responder_port": 443,
        "initiator_bytes": 575,
        "last_seen_epoch": "1561247402.128098",
        "responder_bytes": 417,
        "first_seen_epoch": "1561247392.000682"
      },
      {
        "bytes": 4808,
        "stream": 242,
        "flow_id": "flow-edf21422893c0eed54d51afb",
        "packets": 15,
        "transport": "tcp",
        "last_frame": 6593,
        "first_frame": 6392,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "64.233.185.95",
        "initiator_port": 49276,
        "responder_port": 443,
        "initiator_bytes": 732,
        "last_seen_epoch": "1561247392.523236",
        "responder_bytes": 4076,
        "first_seen_epoch": "1561247392.018763"
      },
      {
        "bytes": 6849,
        "stream": 243,
        "flow_id": "flow-9f6981daa5ae4567ebb023cc",
        "packets": 18,
        "transport": "tcp",
        "last_frame": 6632,
        "first_frame": 6393,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "64.233.185.95",
        "initiator_port": 49277,
        "responder_port": 443,
        "initiator_bytes": 1253,
        "last_seen_epoch": "1561247392.549513",
        "responder_bytes": 5596,
        "first_seen_epoch": "1561247392.019118"
      },
      {
        "bytes": 884,
        "stream": 244,
        "flow_id": "flow-c2a1575bc551019dd89a48c1",
        "packets": 9,
        "transport": "tcp",
        "last_frame": 6609,
        "first_frame": 6412,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.136.102",
        "initiator_port": 49278,
        "responder_port": 443,
        "initiator_bytes": 521,
        "last_seen_epoch": "1561247392.529287",
        "responder_bytes": 363,
        "first_seen_epoch": "1561247392.030816"
      },
      {
        "bytes": 6457,
        "stream": 245,
        "flow_id": "flow-e28243c087747bc30f5a4b72",
        "packets": 16,
        "transport": "tcp",
        "last_frame": 6777,
        "first_frame": 6415,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.136.102",
        "initiator_port": 49279,
        "responder_port": 443,
        "initiator_bytes": 1204,
        "last_seen_epoch": "1561247393.068668",
        "responder_bytes": 5253,
        "first_seen_epoch": "1561247392.03112"
      },
      {
        "bytes": 63946,
        "stream": 246,
        "flow_id": "flow-0e32a895acfd42479de21e56",
        "packets": 73,
        "transport": "tcp",
        "last_frame": 7076,
        "first_frame": 6510,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "54.192.207.126",
        "initiator_port": 49280,
        "responder_port": 443,
        "initiator_bytes": 2568,
        "last_seen_epoch": "1561247393.930179",
        "responder_bytes": 61378,
        "first_seen_epoch": "1561247392.083499"
      },
      {
        "bytes": 61559,
        "stream": 247,
        "flow_id": "flow-b2985ce0e744349d9b727808",
        "packets": 68,
        "transport": "tcp",
        "last_frame": 7088,
        "first_frame": 6511,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "54.192.207.126",
        "initiator_port": 49281,
        "responder_port": 443,
        "initiator_bytes": 2406,
        "last_seen_epoch": "1561247393.982329",
        "responder_bytes": 59153,
        "first_seen_epoch": "1561247392.083573"
      },
      {
        "bytes": 8655,
        "stream": 248,
        "flow_id": "flow-34829bd8d3dabbc304f54155",
        "packets": 21,
        "transport": "tcp",
        "last_frame": 7102,
        "first_frame": 6512,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "54.192.207.126",
        "initiator_port": 49282,
        "responder_port": 443,
        "initiator_bytes": 880,
        "last_seen_epoch": "1561247422.558431",
        "responder_bytes": 7775,
        "first_seen_epoch": "1561247392.083683"
      },
      {
        "bytes": 8763,
        "stream": 249,
        "flow_id": "flow-481e22b4e3de14d72038c01f",
        "packets": 23,
        "transport": "tcp",
        "last_frame": 7103,
        "first_frame": 6513,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "54.192.207.126",
        "initiator_port": 49283,
        "responder_port": 443,
        "initiator_bytes": 934,
        "last_seen_epoch": "1561247422.558507",
        "responder_bytes": 7829,
        "first_seen_epoch": "1561247392.083941"
      },
      {
        "bytes": 884,
        "stream": 250,
        "flow_id": "flow-0ac685e9f5f57700daff49d4",
        "packets": 9,
        "transport": "tcp",
        "last_frame": 6679,
        "first_frame": 6550,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49284,
        "responder_port": 443,
        "initiator_bytes": 527,
        "last_seen_epoch": "1561247392.608048",
        "responder_bytes": 357,
        "first_seen_epoch": "1561247392.128491"
      },
      {
        "bytes": 87917,
        "stream": 251,
        "flow_id": "flow-dbd572906303e105f3414d3f",
        "packets": 99,
        "transport": "tcp",
        "last_frame": 6984,
        "first_frame": 6551,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.7",
        "initiator_port": 49285,
        "responder_port": 443,
        "initiator_bytes": 3127,
        "last_seen_epoch": "1561247393.643473",
        "responder_bytes": 84790,
        "first_seen_epoch": "1561247392.128781"
      },
      {
        "bytes": 888,
        "stream": 252,
        "flow_id": "flow-220677eea02c09eb428c6da2",
        "packets": 9,
        "transport": "tcp",
        "last_frame": 6970,
        "first_frame": 6856,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "172.217.0.74",
        "initiator_port": 49286,
        "responder_port": 443,
        "initiator_bytes": 525,
        "last_seen_epoch": "1561247393.616696",
        "responder_bytes": 363,
        "first_seen_epoch": "1561247393.43383"
      },
      {
        "bytes": 1621,
        "stream": 253,
        "flow_id": "flow-ba5994467a1f549a70bac711",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 7015,
        "first_frame": 6857,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "172.217.0.74",
        "initiator_port": 49287,
        "responder_port": 443,
        "initiator_bytes": 987,
        "last_seen_epoch": "1561247393.674188",
        "responder_bytes": 634,
        "first_seen_epoch": "1561247393.434079"
      },
      {
        "bytes": 992,
        "stream": 254,
        "flow_id": "flow-2e76d6de7298fa65d9b81a16",
        "packets": 7,
        "transport": "tcp",
        "last_frame": 6972,
        "first_frame": 6858,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.136.101",
        "initiator_port": 49288,
        "responder_port": 80,
        "initiator_bytes": 743,
        "last_seen_epoch": "1561247393.617358",
        "responder_bytes": 249,
        "first_seen_epoch": "1561247393.463749"
      },
      {
        "bytes": 178,
        "stream": 255,
        "flow_id": "flow-e0628994c2f559a5ab1d4c6d",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 6940,
        "first_frame": 6859,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "74.125.136.101",
        "initiator_port": 49289,
        "responder_port": 80,
        "initiator_bytes": 120,
        "last_seen_epoch": "1561247393.604496",
        "responder_bytes": 58,
        "first_seen_epoch": "1561247393.463974"
      },
      {
        "bytes": 1947,
        "stream": 256,
        "flow_id": "flow-9e9a8b963e5213dc52a3613b",
        "packets": 7,
        "transport": "tcp",
        "last_frame": 7027,
        "first_frame": 6868,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49290,
        "responder_port": 80,
        "initiator_bytes": 1047,
        "last_seen_epoch": "1561247393.684873",
        "responder_bytes": 900,
        "first_seen_epoch": "1561247393.48036"
      },
      {
        "bytes": 1920,
        "stream": 257,
        "flow_id": "flow-a874d32d4c94467b3823ad1d",
        "packets": 7,
        "transport": "tcp",
        "last_frame": 7029,
        "first_frame": 6869,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "35.226.156.55",
        "initiator_port": 49291,
        "responder_port": 80,
        "initiator_bytes": 1038,
        "last_seen_epoch": "1561247393.686411",
        "responder_bytes": 882,
        "first_seen_epoch": "1561247393.480493"
      },
      {
        "bytes": 880,
        "stream": 258,
        "flow_id": "flow-8b48fd92b914e377db331777",
        "packets": 9,
        "transport": "tcp",
        "last_frame": 7025,
        "first_frame": 7002,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.36",
        "initiator_port": 49292,
        "responder_port": 443,
        "initiator_bytes": 523,
        "last_seen_epoch": "1561247393.678297",
        "responder_bytes": 357,
        "first_seen_epoch": "1561247393.654794"
      },
      {
        "bytes": 4664,
        "stream": 259,
        "flow_id": "flow-27689a1208af1982cf77fc60",
        "packets": 19,
        "transport": "tcp",
        "last_frame": 7097,
        "first_frame": 7003,
        "initiator_ip": "10.0.76.193",
        "responder_ip": "31.13.65.36",
        "initiator_port": 49293,
        "responder_port": 443,
        "initiator_bytes": 2897,
        "last_seen_epoch": "1561247395.335609",
        "responder_bytes": 1767,
        "first_seen_epoch": "1561247393.654906"
      }
    ],
    "events": {
      "dns": [
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.dc._msdcs.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-aa921f5236d135ed7dd2e445",
          "src_port": 55941,
          "tcp_stream": null,
          "udp_stream": 1,
          "frame_number": 3,
          "timestamp_epoch": "1561247190.413389000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "_ldap._tcp.dc._msdcs.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 55941,
          "event_id": "evt-26a8581cfd3362d802f40016",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 1,
          "frame_number": 4,
          "timestamp_epoch": "1561247190.414558000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "phenomenoc-dc.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-83d6e1095ddcf5f650f2ac4e",
          "src_port": 59782,
          "tcp_stream": null,
          "udp_stream": 2,
          "frame_number": 5,
          "timestamp_epoch": "1561247190.433077000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "phenomenoc-dc.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 59782,
          "event_id": "evt-da7d8fabff3e65f8ee1e2fe9",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 2,
          "frame_number": 6,
          "timestamp_epoch": "1561247190.433338000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-1e795b92918e46d72060f4cc",
          "src_port": 59596,
          "tcp_stream": null,
          "udp_stream": 3,
          "frame_number": 7,
          "timestamp_epoch": "1561247190.436474000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 59596,
          "event_id": "evt-fd822371160e95cad23b61a4",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 3,
          "frame_number": 8,
          "timestamp_epoch": "1561247190.436697000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-c8eb28a58cd42799dac167c9",
          "src_port": 56960,
          "tcp_stream": null,
          "udp_stream": 6,
          "frame_number": 34,
          "timestamp_epoch": "1561247190.633595000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 56960,
          "event_id": "evt-9fbfcadbc50e726ae6ed3357",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 6,
          "frame_number": 36,
          "timestamp_epoch": "1561247190.633924000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-abc9422045188c9d5f1d3858",
          "src_port": 61179,
          "tcp_stream": null,
          "udp_stream": 8,
          "frame_number": 124,
          "timestamp_epoch": "1561247190.691217000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 61179,
          "event_id": "evt-6ae9118fedfd9bd33f9072bc",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 8,
          "frame_number": 125,
          "timestamp_epoch": "1561247190.691526000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-a5712336c1251302f4689055",
          "src_port": 59769,
          "tcp_stream": null,
          "udp_stream": 10,
          "frame_number": 180,
          "timestamp_epoch": "1561247190.801087000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 59769,
          "event_id": "evt-aed1b12c38e93818b9c31a92",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 10,
          "frame_number": 181,
          "timestamp_epoch": "1561247190.801337000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "wpad.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-7dd743c913296c367057e134",
          "src_port": 64280,
          "tcp_stream": null,
          "udp_stream": 15,
          "frame_number": 230,
          "timestamp_epoch": "1561247192.798982000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.qry.name": "wpad.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 64280,
          "event_id": "evt-1b2db0f0a555c4b32b8dc6e1",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 15,
          "frame_number": 231,
          "timestamp_epoch": "1561247192.799167000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-b6770a81441cc1b332efcf44",
          "src_port": 57110,
          "tcp_stream": null,
          "udp_stream": 17,
          "frame_number": 239,
          "timestamp_epoch": "1561247193.918939000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 57110,
          "event_id": "evt-2fd2d9525866f74e302e3031",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 17,
          "frame_number": 240,
          "timestamp_epoch": "1561247193.919255000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "isatap.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-76d6646c88d1aa5ed1df85cd",
          "src_port": 57517,
          "tcp_stream": null,
          "udp_stream": 18,
          "frame_number": 242,
          "timestamp_epoch": "1561247193.927451000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.qry.name": "isatap.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 57517,
          "event_id": "evt-0c7068f580669a92e88fb550",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 18,
          "frame_number": 244,
          "timestamp_epoch": "1561247193.927737000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "wpad.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-f53bde8b2e65a9d85060f13f",
          "src_port": 51790,
          "tcp_stream": null,
          "udp_stream": 20,
          "frame_number": 251,
          "timestamp_epoch": "1561247195.371302000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.qry.name": "wpad.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 51790,
          "event_id": "evt-a19f1bc4a4df0bd82b2308df",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 20,
          "frame_number": 253,
          "timestamp_epoch": "1561247195.371564000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "wpad.localdomain",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-d02ce7172e355cdf79199490",
          "src_port": 59754,
          "tcp_stream": null,
          "udp_stream": 21,
          "frame_number": 255,
          "timestamp_epoch": "1561247195.371989000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-a4aa00b083aaaae651954b58",
          "src_port": 55747,
          "tcp_stream": null,
          "udp_stream": 22,
          "frame_number": 256,
          "timestamp_epoch": "1561247195.372409000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 55747,
          "event_id": "evt-861b6aff006242ad4a13e3f7",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 22,
          "frame_number": 257,
          "timestamp_epoch": "1561247195.372677000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.qry.name": "wpad.localdomain",
            "dns.qry.type": "1",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 59754,
          "event_id": "evt-66c821717f969f495de04eea",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 21,
          "frame_number": 287,
          "timestamp_epoch": "1561247195.395072000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "isatap.localdomain",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-c3a1ba27eef8fa7a115e0b68",
          "src_port": 59351,
          "tcp_stream": null,
          "udp_stream": 25,
          "frame_number": 291,
          "timestamp_epoch": "1561247195.455927000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.qry.name": "isatap.localdomain",
            "dns.qry.type": "1",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 59351,
          "event_id": "evt-57a613449b15a66abd5a7b6d",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 25,
          "frame_number": 292,
          "timestamp_epoch": "1561247195.456212000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-a745300d666db79dba175783",
          "src_port": 60603,
          "tcp_stream": null,
          "udp_stream": 26,
          "frame_number": 300,
          "timestamp_epoch": "1561247195.958611000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 60603,
          "event_id": "evt-fe5408e4dc66bb93e60185cd",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 26,
          "frame_number": 301,
          "timestamp_epoch": "1561247195.958970000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-2ff2f8d24a03fb72a2504b48",
          "src_port": 63739,
          "tcp_stream": null,
          "udp_stream": 27,
          "frame_number": 302,
          "timestamp_epoch": "1561247195.959568000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 63739,
          "event_id": "evt-59e6f7cd798ebc81f4e06ee3",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 27,
          "frame_number": 303,
          "timestamp_epoch": "1561247195.959850000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "Bristol-c71f-PC.phenomenoc.com",
            "dns.qry.type": "6",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-a872629f1658986fdd88a69a",
          "src_port": 54745,
          "tcp_stream": null,
          "udp_stream": 28,
          "frame_number": 420,
          "timestamp_epoch": "1561247197.797419000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "Bristol-c71f-PC.phenomenoc.com",
            "dns.qry.type": "6",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 54745,
          "event_id": "evt-6f1a19dadf5a80b7e31daa6e",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 28,
          "frame_number": 421,
          "timestamp_epoch": "1561247197.797726000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.a": "10.0.76.193",
            "dns.qry.name": "phenomenoc.com",
            "dns.qry.type": "6",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-e40eb49b190ed7efd4016291",
          "src_port": 64657,
          "tcp_stream": null,
          "udp_stream": 29,
          "frame_number": 422,
          "timestamp_epoch": "1561247197.798498000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "10.0.76.193",
            "dns.qry.name": "phenomenoc.com",
            "dns.qry.type": "6",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 64657,
          "event_id": "evt-f0a66ebaa35254e5251fb689",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 29,
          "frame_number": 423,
          "timestamp_epoch": "1561247197.799092000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.msftncsi.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-0c911a9280c3a7a401fa59ec",
          "src_port": 52027,
          "tcp_stream": null,
          "udp_stream": 30,
          "frame_number": 424,
          "timestamp_epoch": "1561247198.002372000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "23.63.249.186,23.63.249.194",
            "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net",
            "dns.qry.name": "www.msftncsi.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 52027,
          "event_id": "evt-f90b4d406e4388dda2532a76",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 30,
          "frame_number": 425,
          "timestamp_epoch": "1561247198.020798000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.msftncsi.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-89bf965545d22686fe0d943c",
          "src_port": 61007,
          "tcp_stream": null,
          "udp_stream": 31,
          "frame_number": 426,
          "timestamp_epoch": "1561247198.022340000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "23.63.249.194,23.63.249.186",
            "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net",
            "dns.qry.name": "www.msftncsi.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 61007,
          "event_id": "evt-cc690936e3fc31836bc782bd",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 31,
          "frame_number": 427,
          "timestamp_epoch": "1561247198.022718000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.dc._msdcs.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-7fa19250b2cc4a78b9fadbd1",
          "src_port": 55150,
          "tcp_stream": null,
          "udp_stream": 34,
          "frame_number": 554,
          "timestamp_epoch": "1561247225.091502000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "_ldap._tcp.dc._msdcs.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 55150,
          "event_id": "evt-c43479f92de7aeb881b03562",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 34,
          "frame_number": 555,
          "timestamp_epoch": "1561247225.092523000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-70a2161bcd00c2ea4687c340",
          "src_port": 57301,
          "tcp_stream": null,
          "udp_stream": 35,
          "frame_number": 556,
          "timestamp_epoch": "1561247225.100538000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 57301,
          "event_id": "evt-c7ce33855e1539be6f7c38fd",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 35,
          "frame_number": 557,
          "timestamp_epoch": "1561247225.100838000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "phenomenoc-dc.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-d68fa5f64f3f8756f5e713c0",
          "src_port": 50880,
          "tcp_stream": null,
          "udp_stream": 36,
          "frame_number": 558,
          "timestamp_epoch": "1561247225.116361000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "phenomenoc-dc.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 50880,
          "event_id": "evt-7b83ea459c5c0ae0958dc0d1",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 36,
          "frame_number": 559,
          "timestamp_epoch": "1561247225.116693000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-6af85f593e18ff24bbe0bca3",
          "src_port": 50325,
          "tcp_stream": null,
          "udp_stream": 39,
          "frame_number": 631,
          "timestamp_epoch": "1561247225.319420000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 50325,
          "event_id": "evt-3b1f2a37fbac6133f96b39a2",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 39,
          "frame_number": 632,
          "timestamp_epoch": "1561247225.319824000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-3ce4422a6b96d1a35f6020f4",
          "src_port": 59464,
          "tcp_stream": null,
          "udp_stream": 41,
          "frame_number": 701,
          "timestamp_epoch": "1561247225.428713000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 59464,
          "event_id": "evt-f8f0d343e47e3f954c22e651",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 41,
          "frame_number": 702,
          "timestamp_epoch": "1561247225.429056000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-c22aca4ea6520aaf193e9c4c",
          "src_port": 56904,
          "tcp_stream": null,
          "udp_stream": 43,
          "frame_number": 706,
          "timestamp_epoch": "1561247225.506210000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 56904,
          "event_id": "evt-662b9aef24a85d371634055a",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 43,
          "frame_number": 707,
          "timestamp_epoch": "1561247225.506478000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-a10964fac4ebd99cb840a12b",
          "src_port": 63725,
          "tcp_stream": null,
          "udp_stream": 46,
          "frame_number": 809,
          "timestamp_epoch": "1561247226.538965000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 63725,
          "event_id": "evt-a5a6e4651e3b25976d32b9a9",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 46,
          "frame_number": 810,
          "timestamp_epoch": "1561247226.539295000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-627098b3ab7063b81cd347bd",
          "src_port": 51173,
          "tcp_stream": null,
          "udp_stream": 47,
          "frame_number": 811,
          "timestamp_epoch": "1561247226.539716000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 51173,
          "event_id": "evt-ef7b54d56c361611795bcad2",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 47,
          "frame_number": 812,
          "timestamp_epoch": "1561247226.539880000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "wpad.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-4788d3dfe17b947de1045046",
          "src_port": 55051,
          "tcp_stream": null,
          "udp_stream": 51,
          "frame_number": 936,
          "timestamp_epoch": "1561247227.565048000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.qry.name": "wpad.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 55051,
          "event_id": "evt-6c5811dfa53f7c1c8f8a783f",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 51,
          "frame_number": 937,
          "timestamp_epoch": "1561247227.565241000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "isatap.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-5934c903550726347fe74b47",
          "src_port": 61334,
          "tcp_stream": null,
          "udp_stream": 53,
          "frame_number": 945,
          "timestamp_epoch": "1561247228.852283000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.qry.name": "isatap.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 61334,
          "event_id": "evt-715b9009680c3761c6de602c",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 53,
          "frame_number": 946,
          "timestamp_epoch": "1561247228.852537000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-25fc46b7a69fd5dcf237c0c5",
          "src_port": 63173,
          "tcp_stream": null,
          "udp_stream": 54,
          "frame_number": 947,
          "timestamp_epoch": "1561247228.852987000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 63173,
          "event_id": "evt-a3cd6009e2dd6f49928fb34e",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 54,
          "frame_number": 948,
          "timestamp_epoch": "1561247228.853164000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "isatap.localdomain",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-4e2a6049221076460317c48e",
          "src_port": 62122,
          "tcp_stream": null,
          "udp_stream": 55,
          "frame_number": 949,
          "timestamp_epoch": "1561247229.003302000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.qry.name": "isatap.localdomain",
            "dns.qry.type": "1",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 62122,
          "event_id": "evt-e50d2449dda56ec46fbf2f7d",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 55,
          "frame_number": 950,
          "timestamp_epoch": "1561247229.003560000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.msftncsi.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-f98bad84b9a47ffdcd5d51af",
          "src_port": 52364,
          "tcp_stream": null,
          "udp_stream": 56,
          "frame_number": 952,
          "timestamp_epoch": "1561247230.144568000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "23.63.249.144,23.63.249.194",
            "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net",
            "dns.qry.name": "www.msftncsi.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 52364,
          "event_id": "evt-6ef3cbc8519f11edf8c06b33",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 56,
          "frame_number": 953,
          "timestamp_epoch": "1561247230.169089000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.msftncsi.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-6343c5973ee078e9aa7b7f6d",
          "src_port": 50027,
          "tcp_stream": null,
          "udp_stream": 57,
          "frame_number": 954,
          "timestamp_epoch": "1561247230.170740000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "23.63.249.194,23.63.249.144",
            "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net",
            "dns.qry.name": "www.msftncsi.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 50027,
          "event_id": "evt-3dea0514a4ebaa66ce1fae2e",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 57,
          "frame_number": 955,
          "timestamp_epoch": "1561247230.171042000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "Bangkok-8ac2-PC.phenomenoc.com",
            "dns.qry.type": "6",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-5b1dd91b6ebcb266aedeaac2",
          "src_port": 57604,
          "tcp_stream": null,
          "udp_stream": 59,
          "frame_number": 973,
          "timestamp_epoch": "1561247232.559801000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "10.0.76.6",
            "dns.qry.name": "Bangkok-8ac2-PC.phenomenoc.com",
            "dns.qry.type": "6",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 57604,
          "event_id": "evt-ecb351623f0d66fe63aa7401",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 59,
          "frame_number": 974,
          "timestamp_epoch": "1561247232.560080000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.a": "10.0.76.109",
            "dns.qry.name": "phenomenoc.com",
            "dns.qry.type": "6",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-c7933776c0915984a95ef7f8",
          "src_port": 56860,
          "tcp_stream": null,
          "udp_stream": 60,
          "frame_number": 975,
          "timestamp_epoch": "1561247232.560966000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "10.0.76.109",
            "dns.qry.name": "phenomenoc.com",
            "dns.qry.type": "6",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 56860,
          "event_id": "evt-2b57b1d901cbed93b92a2afe",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 60,
          "frame_number": 976,
          "timestamp_epoch": "1561247232.561538000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-93dee0fa875a9982a90d2885",
          "src_port": 65124,
          "tcp_stream": null,
          "udp_stream": 61,
          "frame_number": 1292,
          "timestamp_epoch": "1561247254.745502000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 65124,
          "event_id": "evt-9e0f2f777cf9a6d7cfdb2160",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 61,
          "frame_number": 1293,
          "timestamp_epoch": "1561247254.745861000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-dab9dda9c2937c3902398406",
          "src_port": 59842,
          "tcp_stream": null,
          "udp_stream": 62,
          "frame_number": 1294,
          "timestamp_epoch": "1561247254.746303000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.qry.name": "_ldap._tcp.Phenomenoc-DC.phenomenoc.com",
            "dns.qry.type": "33",
            "dns.flags.rcode": "3",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 59842,
          "event_id": "evt-3a8438240799a1c1688e1402",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 62,
          "frame_number": 1295,
          "timestamp_epoch": "1561247254.746480000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "dns.msftncsi.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-0a563b919db08ee9acf79983",
          "src_port": 54293,
          "tcp_stream": null,
          "udp_stream": 63,
          "frame_number": 1377,
          "timestamp_epoch": "1561247255.291829000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "131.107.255.255",
            "dns.qry.name": "dns.msftncsi.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 54293,
          "event_id": "evt-f8ebdc9778f6347865fb02fc",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 63,
          "frame_number": 1378,
          "timestamp_epoch": "1561247255.327697000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "dns.msftncsi.com",
            "dns.qry.type": "28",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-8762b8ab61e4b0b6d4201479",
          "src_port": 56953,
          "tcp_stream": null,
          "udp_stream": 64,
          "frame_number": 1379,
          "timestamp_epoch": "1561247255.328144000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.aaaa": "fd3e:4f5a:5b81::1",
            "dns.qry.name": "dns.msftncsi.com",
            "dns.qry.type": "28",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 56953,
          "event_id": "evt-00c2ac3020cb752ea99d1d2c",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 64,
          "frame_number": 1380,
          "timestamp_epoch": "1561247255.328332000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "beef2live.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-3b755f3cf9d0ffc76486a363",
          "src_port": 58606,
          "tcp_stream": null,
          "udp_stream": 65,
          "frame_number": 1392,
          "timestamp_epoch": "1561247260.170668000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "35.226.156.55",
            "dns.qry.name": "beef2live.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 58606,
          "event_id": "evt-6ebba1a5608750a15965a7f3",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 65,
          "frame_number": 1393,
          "timestamp_epoch": "1561247260.170954000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "ajax.googleapis.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-979298a5bafdd3b2fadcc62a",
          "src_port": 65529,
          "tcp_stream": null,
          "udp_stream": 66,
          "frame_number": 1453,
          "timestamp_epoch": "1561247261.331542000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "172.217.164.74,172.217.0.74,74.125.21.95,64.233.185.95",
            "dns.cname": "googleapis.l.google.com",
            "dns.qry.name": "ajax.googleapis.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 65529,
          "event_id": "evt-882c34382792cd751d2fa347",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 66,
          "frame_number": 1454,
          "timestamp_epoch": "1561247261.347284000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.google.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-0dd77b1a80dc506ea8235ec1",
          "src_port": 59012,
          "tcp_stream": null,
          "udp_stream": 67,
          "frame_number": 1464,
          "timestamp_epoch": "1561247261.365825000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "64.233.185.103,64.233.185.147,64.233.185.105,64.233.185.106,64.233.185.104,64.233.185.99",
            "dns.qry.name": "www.google.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 59012,
          "event_id": "evt-897e3818272cf2e731338beb",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 67,
          "frame_number": 1485,
          "timestamp_epoch": "1561247261.392793000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "portal.farmcentric.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-26822d766043d23eacdd90b2",
          "src_port": 57482,
          "tcp_stream": null,
          "udp_stream": 68,
          "frame_number": 1510,
          "timestamp_epoch": "1561247261.417408000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "35.226.156.55",
            "dns.qry.name": "portal.farmcentric.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 57482,
          "event_id": "evt-336f04dd34037e92e041a394",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 68,
          "frame_number": 1511,
          "timestamp_epoch": "1561247261.417763000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.googletagmanager.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-e7dfe8cde2a9a56d4ef640bf",
          "src_port": 52947,
          "tcp_stream": null,
          "udp_stream": 69,
          "frame_number": 1569,
          "timestamp_epoch": "1561247261.588306000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "173.194.219.97",
            "dns.cname": "www-googletagmanager.l.google.com",
            "dns.qry.name": "www.googletagmanager.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 52947,
          "event_id": "evt-449e64f0a79b3e5cf552f4e6",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 69,
          "frame_number": 1578,
          "timestamp_epoch": "1561247261.621737000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.googleadservices.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-79d44e5035fcf25a56628c77",
          "src_port": 51072,
          "tcp_stream": null,
          "udp_stream": 70,
          "frame_number": 1691,
          "timestamp_epoch": "1561247261.849626000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "172.217.2.34",
            "dns.cname": "pagead.l.doubleclick.net",
            "dns.qry.name": "www.googleadservices.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 51072,
          "event_id": "evt-589470b9b7d035742181445a",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 70,
          "frame_number": 1711,
          "timestamp_epoch": "1561247261.871130000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "googleads.g.doubleclick.net",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-84d4f13454cd76db8609107b",
          "src_port": 63412,
          "tcp_stream": null,
          "udp_stream": 71,
          "frame_number": 1737,
          "timestamp_epoch": "1561247262.191255000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "173.194.219.156,173.194.219.154,173.194.219.155,173.194.219.157",
            "dns.cname": "pagead46.l.doubleclick.net",
            "dns.qry.name": "googleads.g.doubleclick.net",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 63412,
          "event_id": "evt-0f9395298b5e502d18cb434c",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 71,
          "frame_number": 1738,
          "timestamp_epoch": "1561247262.208719000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.google-analytics.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-102f3abafe5fa6baa1ca5832",
          "src_port": 52930,
          "tcp_stream": null,
          "udp_stream": 72,
          "frame_number": 1773,
          "timestamp_epoch": "1561247262.297156000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "74.125.138.138,74.125.138.102,74.125.138.100,74.125.138.101,74.125.138.113,74.125.138.139",
            "dns.cname": "www-google-analytics.l.google.com",
            "dns.qry.name": "www.google-analytics.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 52930,
          "event_id": "evt-fd56d0f9baf3b92ef3d912cf",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 72,
          "frame_number": 1776,
          "timestamp_epoch": "1561247262.316189000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "connect.facebook.net",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-7b7d2c026ef56d5495127851",
          "src_port": 62596,
          "tcp_stream": null,
          "udp_stream": 73,
          "frame_number": 1819,
          "timestamp_epoch": "1561247262.674584000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "31.13.65.7",
            "dns.cname": "scontent.xx.fbcdn.net",
            "dns.qry.name": "connect.facebook.net",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 62596,
          "event_id": "evt-8ede6d4ecf53dd22bc690abd",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 73,
          "frame_number": 1820,
          "timestamp_epoch": "1561247262.695760000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "cse.google.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-71548b43dc7b62f265eb63e7",
          "src_port": 55252,
          "tcp_stream": null,
          "udp_stream": 74,
          "frame_number": 1823,
          "timestamp_epoch": "1561247262.703159000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "platform.twitter.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-bc43072177343751c3dc5e10",
          "src_port": 56202,
          "tcp_stream": null,
          "udp_stream": 75,
          "frame_number": 1829,
          "timestamp_epoch": "1561247262.710024000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "74.125.136.102,74.125.136.113,74.125.136.101,74.125.136.100,74.125.136.138,74.125.136.139",
            "dns.qry.name": "cse.google.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 55252,
          "event_id": "evt-da2b8b5b4cd4f8d06083f756",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 74,
          "frame_number": 1848,
          "timestamp_epoch": "1561247262.729830000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "72.21.91.66",
            "dns.cname": "cs472.wac.edgecastcdn.net,cs1-apr-8315.wac.edgecastcdn.net,wac.apr-8315.edgecastdns.net,cs1-lb-as.8315.ecdns.net,cs41.wac.edgecastcdn.net",
            "dns.qry.name": "platform.twitter.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 56202,
          "event_id": "evt-815c028c11f62ed4b86152d1",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 75,
          "frame_number": 1855,
          "timestamp_epoch": "1561247262.734217000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.gstatic.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-4f8de912f094720682c51061",
          "src_port": 59371,
          "tcp_stream": null,
          "udp_stream": 76,
          "frame_number": 2056,
          "timestamp_epoch": "1561247262.918987000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "64.233.185.94",
            "dns.qry.name": "www.gstatic.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 59371,
          "event_id": "evt-d854973060810788c42dd913",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 76,
          "frame_number": 2105,
          "timestamp_epoch": "1561247263.069502000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "staticxx.facebook.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-f6e0aed3e234b156ceaa38d1",
          "src_port": 51681,
          "tcp_stream": null,
          "udp_stream": 77,
          "frame_number": 2368,
          "timestamp_epoch": "1561247263.378660000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "31.13.65.7",
            "dns.cname": "scontent.xx.fbcdn.net",
            "dns.qry.name": "staticxx.facebook.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 51681,
          "event_id": "evt-80391b84943bb3ca1afc7faa",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 77,
          "frame_number": 2369,
          "timestamp_epoch": "1561247263.378913000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.facebook.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-4f06e244e36e55cd1c38a20c",
          "src_port": 49722,
          "tcp_stream": null,
          "udp_stream": 78,
          "frame_number": 2473,
          "timestamp_epoch": "1561247263.513314000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.googleapis.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-5bc7c019217b06730916177c",
          "src_port": 50233,
          "tcp_stream": null,
          "udp_stream": 79,
          "frame_number": 2641,
          "timestamp_epoch": "1561247263.799834000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "172.217.0.74,74.125.21.95,64.233.185.95,172.217.164.74",
            "dns.cname": "googleapis.l.google.com",
            "dns.qry.name": "www.googleapis.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 50233,
          "event_id": "evt-81ce84adb3b824f7205293b3",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 79,
          "frame_number": 2642,
          "timestamp_epoch": "1561247263.800132000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "clients1.google.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-f3b57716cfa812bc65ff8ca7",
          "src_port": 59397,
          "tcp_stream": null,
          "udp_stream": 80,
          "frame_number": 2692,
          "timestamp_epoch": "1561247263.856760000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "74.125.136.101,74.125.136.100,74.125.136.138,74.125.136.102,74.125.136.139,74.125.136.113",
            "dns.cname": "clients.l.google.com",
            "dns.qry.name": "clients1.google.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 59397,
          "event_id": "evt-bd1b976e509f450ebcd8dfce",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 80,
          "frame_number": 2747,
          "timestamp_epoch": "1561247263.907326000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "fonts.gstatic.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-5792f9aab12ae826997acacf",
          "src_port": 55510,
          "tcp_stream": null,
          "udp_stream": 81,
          "frame_number": 2828,
          "timestamp_epoch": "1561247264.057758000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "216.58.193.163",
            "dns.cname": "gstaticadssl.l.google.com",
            "dns.qry.name": "fonts.gstatic.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 55510,
          "event_id": "evt-ed2fe85c1fa592cbc4f1fb77",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 81,
          "frame_number": 2829,
          "timestamp_epoch": "1561247264.072915000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "syndication.twitter.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-a536057d8e6a0057b25af333",
          "src_port": 63464,
          "tcp_stream": null,
          "udp_stream": 82,
          "frame_number": 2894,
          "timestamp_epoch": "1561247264.157893000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "104.244.42.8,104.244.42.72,104.244.42.136,104.244.42.200",
            "dns.qry.name": "syndication.twitter.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 63464,
          "event_id": "evt-b4fb6b20bf119befb8e29dcd",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 82,
          "frame_number": 2895,
          "timestamp_epoch": "1561247264.158140000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "api.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-c6dfe8acf6a4550605f9d938",
          "src_port": 64129,
          "tcp_stream": null,
          "udp_stream": 83,
          "frame_number": 2991,
          "timestamp_epoch": "1561247264.369133000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-1f1467b5f6b69bc8c71361c6",
          "src_port": 51764,
          "tcp_stream": null,
          "udp_stream": 84,
          "frame_number": 2992,
          "timestamp_epoch": "1561247264.372990000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-3871cdf095163cbeead2c1b4",
          "src_port": 52928,
          "tcp_stream": null,
          "udp_stream": 85,
          "frame_number": 2993,
          "timestamp_epoch": "1561247264.374122000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "api.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-1398221bfad6156c90bfc7b2",
          "src_port": 65149,
          "tcp_stream": null,
          "udp_stream": 86,
          "frame_number": 2994,
          "timestamp_epoch": "1561247264.375828000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-4c3a1d3a0308fb58ebb85dd8",
          "src_port": 55257,
          "tcp_stream": null,
          "udp_stream": 87,
          "frame_number": 2995,
          "timestamp_epoch": "1561247264.376745000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-5e7dc4aaa4cb32ee77dd212d",
          "src_port": 58743,
          "tcp_stream": null,
          "udp_stream": 88,
          "frame_number": 2996,
          "timestamp_epoch": "1561247264.377965000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "13.107.5.80",
            "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net",
            "dns.qry.name": "api.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 65149,
          "event_id": "evt-f358de269e3d42c09039393a",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 86,
          "frame_number": 2997,
          "timestamp_epoch": "1561247264.383906000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "13.107.5.80",
            "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net",
            "dns.qry.name": "api.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 64129,
          "event_id": "evt-c8271917c2e8b1da2041bd91",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 83,
          "frame_number": 2998,
          "timestamp_epoch": "1561247264.383975000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "204.79.197.200,13.107.21.200",
            "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net",
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 52928,
          "event_id": "evt-3240ecd799aa9767733245e7",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 85,
          "frame_number": 3036,
          "timestamp_epoch": "1561247264.439549000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "204.79.197.200,13.107.21.200",
            "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net",
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 55257,
          "event_id": "evt-fb85675ffb636f7f33ec5f68",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 87,
          "frame_number": 3037,
          "timestamp_epoch": "1561247264.439629000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "204.79.197.200,13.107.21.200",
            "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net",
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 58743,
          "event_id": "evt-74a18f07fd598d69a277f135",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 88,
          "frame_number": 3038,
          "timestamp_epoch": "1561247264.439693000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "204.79.197.200,13.107.21.200",
            "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net",
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 51764,
          "event_id": "evt-4052d67f721de08fe367ffb3",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 84,
          "frame_number": 3039,
          "timestamp_epoch": "1561247264.439764000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.facebook.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-1d819408fba9c94c09626c83",
          "src_port": 49722,
          "tcp_stream": null,
          "udp_stream": 78,
          "frame_number": 3065,
          "timestamp_epoch": "1561247264.503993000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "ssl.gstatic.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-4c67e4ef8bc91bed9c8a662d",
          "src_port": 49967,
          "tcp_stream": null,
          "udp_stream": 89,
          "frame_number": 3092,
          "timestamp_epoch": "1561247264.551377000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "172.217.2.35",
            "dns.qry.name": "ssl.gstatic.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 49967,
          "event_id": "evt-3e4cf28c82e6b5878cd29b22",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 89,
          "frame_number": 3099,
          "timestamp_epoch": "1561247264.566187000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "bid.g.doubleclick.net",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-32d5cb4e25bdb11a156822ed",
          "src_port": 51580,
          "tcp_stream": null,
          "udp_stream": 90,
          "frame_number": 3136,
          "timestamp_epoch": "1561247264.705292000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "64.233.185.155,64.233.185.157,64.233.185.154,64.233.185.156",
            "dns.cname": "ads-bid.l.doubleclick.net",
            "dns.qry.name": "bid.g.doubleclick.net",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 51580,
          "event_id": "evt-32f8a0cb1c28f3b3c64984c5",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 90,
          "frame_number": 3137,
          "timestamp_epoch": "1561247264.725563000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-863d4241937d525d00fb2e96",
          "src_port": 53715,
          "tcp_stream": null,
          "udp_stream": 91,
          "frame_number": 3180,
          "timestamp_epoch": "1561247265.431804000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "13.107.21.200,204.79.197.200",
            "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net",
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 53715,
          "event_id": "evt-6719a14ac8ee07116bcb15c8",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 91,
          "frame_number": 3181,
          "timestamp_epoch": "1561247265.473452000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.facebook.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-d4a5c49651b8f02698ffd3e7",
          "src_port": 49722,
          "tcp_stream": null,
          "udp_stream": 78,
          "frame_number": 3192,
          "timestamp_epoch": "1561247265.512123000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.facebook.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-c571b6c269b66bd9d766bfc9",
          "src_port": 49722,
          "tcp_stream": null,
          "udp_stream": 78,
          "frame_number": 3207,
          "timestamp_epoch": "1561247267.524486000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.qry.name": "www.facebook.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "2",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 49722,
          "event_id": "evt-d1d21f28fd849f3df16697cb",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 78,
          "frame_number": 3208,
          "timestamp_epoch": "1561247270.164049000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.facebook.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-e54846a9e5e7a705ca70aabb",
          "src_port": 61611,
          "tcp_stream": null,
          "udp_stream": 92,
          "frame_number": 3209,
          "timestamp_epoch": "1561247270.166321000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "31.13.65.36",
            "dns.cname": "star-mini.c10r.facebook.com",
            "dns.qry.name": "www.facebook.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 61611,
          "event_id": "evt-f1260b180d1bb84ed5e7c9ed",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 92,
          "frame_number": 3210,
          "timestamp_epoch": "1561247270.199357000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "static.xx.fbcdn.net",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-1a3c0c3a9dcf963f004543f3",
          "src_port": 49191,
          "tcp_stream": null,
          "udp_stream": 93,
          "frame_number": 3308,
          "timestamp_epoch": "1561247270.428637000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "31.13.65.7",
            "dns.cname": "scontent.xx.fbcdn.net",
            "dns.qry.name": "static.xx.fbcdn.net",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 49191,
          "event_id": "evt-8d9a9db6440767e9e20b9b56",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 93,
          "frame_number": 3309,
          "timestamp_epoch": "1561247270.428911000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "letsdoitquick.site",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-d36a6edfb5eadcf2741703f3",
          "src_port": 49857,
          "tcp_stream": null,
          "udp_stream": 94,
          "frame_number": 3741,
          "timestamp_epoch": "1561247283.724891000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "91.235.129.60",
            "dns.qry.name": "letsdoitquick.site",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 49857,
          "event_id": "evt-8eea8c172c8c1798ce1af5b8",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 94,
          "frame_number": 3742,
          "timestamp_epoch": "1561247283.743525000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "api.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-427a9631dbe8a6012543fb07",
          "src_port": 51234,
          "tcp_stream": null,
          "udp_stream": 95,
          "frame_number": 3858,
          "timestamp_epoch": "1561247287.950762000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "13.107.5.80",
            "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net",
            "dns.qry.name": "api.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 51234,
          "event_id": "evt-5f1913ac01b48f96f0843da5",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 95,
          "frame_number": 3859,
          "timestamp_epoch": "1561247287.951071000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-008734ada49a716bbae663b5",
          "src_port": 57195,
          "tcp_stream": null,
          "udp_stream": 96,
          "frame_number": 3860,
          "timestamp_epoch": "1561247287.954342000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-af29801a01079584aee587ca",
          "src_port": 51756,
          "tcp_stream": null,
          "udp_stream": 97,
          "frame_number": 3861,
          "timestamp_epoch": "1561247287.954812000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-5dac0869624e2608fb996bfe",
          "src_port": 50499,
          "tcp_stream": null,
          "udp_stream": 98,
          "frame_number": 3862,
          "timestamp_epoch": "1561247287.956352000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-ee89f9deead47d0a44326c42",
          "src_port": 49448,
          "tcp_stream": null,
          "udp_stream": 99,
          "frame_number": 3863,
          "timestamp_epoch": "1561247287.957364000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "204.79.197.200,13.107.21.200",
            "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net",
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 51756,
          "event_id": "evt-9d3fd270d32cf62c0e5a907d",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 97,
          "frame_number": 3865,
          "timestamp_epoch": "1561247288.316485000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "204.79.197.200,13.107.21.200",
            "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net",
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 50499,
          "event_id": "evt-4cb09a16814e80174a1378d5",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 98,
          "frame_number": 3866,
          "timestamp_epoch": "1561247288.316682000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "204.79.197.200,13.107.21.200",
            "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net",
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 49448,
          "event_id": "evt-4ea8b496e0d2a7166838faa8",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 99,
          "frame_number": 3867,
          "timestamp_epoch": "1561247288.316802000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "204.79.197.200,13.107.21.200",
            "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net",
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 57195,
          "event_id": "evt-7d7fbc309207c04bb5e7d425",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 96,
          "frame_number": 3868,
          "timestamp_epoch": "1561247288.316915000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-4f3917b75daa5b7b86f34779",
          "src_port": 51826,
          "tcp_stream": null,
          "udp_stream": 100,
          "frame_number": 3871,
          "timestamp_epoch": "1561247289.198960000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "13.107.21.200,204.79.197.200",
            "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net",
            "dns.qry.name": "www.bing.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 51826,
          "event_id": "evt-cef545d7fe77b586bc538ab7",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 100,
          "frame_number": 3874,
          "timestamp_epoch": "1561247289.399319000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "iecvlist.microsoft.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-3d21d522eb12e01fe34a51c1",
          "src_port": 59774,
          "tcp_stream": null,
          "udp_stream": 101,
          "frame_number": 3895,
          "timestamp_epoch": "1561247290.403822000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "72.21.81.200",
            "dns.cname": "ie9comview.vo.msecnd.net,cs9.wpc.v0cdn.net",
            "dns.qry.name": "iecvlist.microsoft.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 59774,
          "event_id": "evt-d6a4db301ece5ba419264a57",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 101,
          "frame_number": 3896,
          "timestamp_epoch": "1561247290.404107000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "fghjkmgru34.site",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-a09fe5525373c399ca098a89",
          "src_port": 62271,
          "tcp_stream": null,
          "udp_stream": 102,
          "frame_number": 4886,
          "timestamp_epoch": "1561247302.513902000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "8.209.83.76",
            "dns.qry.name": "fghjkmgru34.site",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 62271,
          "event_id": "evt-84b26c28b56569c88918b7ff",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 102,
          "frame_number": 4889,
          "timestamp_epoch": "1561247302.953345000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "iecvlist.microsoft.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 53,
          "event_id": "evt-b5180106456472f40a9f8d99",
          "src_port": 53059,
          "tcp_stream": null,
          "udp_stream": 104,
          "frame_number": 5918,
          "timestamp_epoch": "1561247314.083341000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.109",
          "fields": {
            "dns.a": "72.21.81.200",
            "dns.cname": "ie9comview.vo.msecnd.net,cs9.wpc.v0cdn.net",
            "dns.qry.name": "iecvlist.microsoft.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 53059,
          "event_id": "evt-b785b0502d38b4b44dca7cd3",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 104,
          "frame_number": 5919,
          "timestamp_epoch": "1561247314.083666000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "www.farmprogress.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-655fb9fff129dc83fea42819",
          "src_port": 55748,
          "tcp_stream": null,
          "udp_stream": 105,
          "frame_number": 6347,
          "timestamp_epoch": "1561247391.622604000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.6",
          "fields": {
            "dns.qry.name": "fonts.googleapis.com",
            "dns.qry.type": "1",
            "dns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 53,
          "event_id": "evt-ca9e103edab78b784029e84b",
          "src_port": 59919,
          "tcp_stream": null,
          "udp_stream": 106,
          "frame_number": 6350,
          "timestamp_epoch": "1561247391.626791000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "64.233.185.95",
            "dns.cname": "googleadapis.l.google.com",
            "dns.qry.name": "fonts.googleapis.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 59919,
          "event_id": "evt-46c738b642be9d473942518d",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 106,
          "frame_number": 6390,
          "timestamp_epoch": "1561247392.017533000"
        },
        {
          "kind": "dns",
          "dst_ip": "10.0.76.193",
          "fields": {
            "dns.a": "54.192.207.126,54.192.207.150,54.192.207.79,54.192.207.51",
            "dns.cname": "d3569ngd5kwbnf.cloudfront.net",
            "dns.qry.name": "www.farmprogress.com",
            "dns.qry.type": "1",
            "dns.flags.rcode": "0",
            "dns.flags.response": "True"
          },
          "src_ip": "10.0.76.6",
          "dst_port": 55748,
          "event_id": "evt-57d9792ef1b3460ff38d83ac",
          "src_port": 53,
          "tcp_stream": null,
          "udp_stream": 105,
          "frame_number": 6509,
          "timestamp_epoch": "1561247392.082847000"
        }
      ],
      "dhcp": [
        {
          "kind": "dhcp",
          "dst_ip": "255.255.255.255",
          "fields": {
            "eth.src": "00:1f:cf:61:19:64",
            "dhcp.ip.your": "0.0.0.0",
            "dhcp.hw.mac_addr": "00:1f:cf:61:19:64,00:1f:cf:61:19:64",
            "dhcp.option.dhcp": "8",
            "dhcp.option.hostname": "Bristol-c71f-PC"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-a9a513fcd7469b2ab36dc97e",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 13,
          "frame_number": 228,
          "timestamp_epoch": "1561247192.794459000"
        },
        {
          "kind": "dhcp",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.src": "00:26:b9:30:5c:aa",
            "dhcp.ip.your": "0.0.0.0",
            "dhcp.hw.mac_addr": "00:1f:cf:61:19:64",
            "dhcp.option.dhcp": "5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-64a8362b47c61617b5adb201",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 14,
          "frame_number": 229,
          "timestamp_epoch": "1561247192.794896000"
        },
        {
          "kind": "dhcp",
          "dst_ip": "255.255.255.255",
          "fields": {
            "eth.src": "78:2b:cb:d4:a5:fe",
            "dhcp.ip.your": "0.0.0.0",
            "dhcp.hw.mac_addr": "78:2b:cb:d4:a5:fe,78:2b:cb:d4:a5:fe",
            "dhcp.option.dhcp": "8",
            "dhcp.option.hostname": "Bangkok-8ac2-PC"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-74e0c32c1f1ab8683d456b58",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 49,
          "frame_number": 934,
          "timestamp_epoch": "1561247227.558291000"
        },
        {
          "kind": "dhcp",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.src": "00:26:b9:30:5c:aa",
            "dhcp.ip.your": "0.0.0.0",
            "dhcp.hw.mac_addr": "78:2b:cb:d4:a5:fe",
            "dhcp.option.dhcp": "5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-273d7fe5a907a4ab341013dc",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 50,
          "frame_number": 935,
          "timestamp_epoch": "1561247227.558583000"
        },
        {
          "kind": "dhcp",
          "dst_ip": "255.255.255.255",
          "fields": {
            "eth.src": "00:1f:cf:61:19:64",
            "dhcp.ip.your": "0.0.0.0",
            "dhcp.hw.mac_addr": "00:1f:cf:61:19:64,00:1f:cf:61:19:64",
            "dhcp.option.dhcp": "8",
            "dhcp.option.hostname": "Bristol-c71f-PC"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-c3159c20e1c14c23eca0f6c5",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 13,
          "frame_number": 1395,
          "timestamp_epoch": "1561247260.593550000"
        },
        {
          "kind": "dhcp",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.src": "00:26:b9:30:5c:aa",
            "dhcp.ip.your": "0.0.0.0",
            "dhcp.hw.mac_addr": "00:1f:cf:61:19:64",
            "dhcp.option.dhcp": "5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-aa6379376b851190293cb673",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 14,
          "frame_number": 1396,
          "timestamp_epoch": "1561247260.593853000"
        },
        {
          "kind": "dhcp",
          "dst_ip": "255.255.255.255",
          "fields": {
            "eth.src": "78:2b:cb:d4:a5:fe",
            "dhcp.ip.your": "0.0.0.0",
            "dhcp.hw.mac_addr": "78:2b:cb:d4:a5:fe,78:2b:cb:d4:a5:fe",
            "dhcp.option.dhcp": "8",
            "dhcp.option.hostname": "Bangkok-8ac2-PC"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-8bb12dde75f8c01ff1c3734c",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 49,
          "frame_number": 4887,
          "timestamp_epoch": "1561247302.516656000"
        },
        {
          "kind": "dhcp",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.src": "00:26:b9:30:5c:aa",
            "dhcp.ip.your": "0.0.0.0",
            "dhcp.hw.mac_addr": "78:2b:cb:d4:a5:fe",
            "dhcp.option.dhcp": "5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-cf157131772790dd7e0fba43",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 50,
          "frame_number": 4888,
          "timestamp_epoch": "1561247302.516962000"
        }
      ],
      "smtp": [],
      "identity": [
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "BRISTOL-C71F-PC<00>,BRISTOL-C71F-PC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-a4d22e831d4f150d5515b187",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 1,
          "timestamp_epoch": "1561247190.373494000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "PHENOMENOC<00>,PHENOMENOC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "True"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-271de539f14a9af923bad834",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 2,
          "timestamp_epoch": "1561247190.373818000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "bristol-c71f-pc$"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-0a274659f134e3bd71fd28e1",
          "src_port": null,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 58,
          "timestamp_epoch": "1561247190.654488000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "bristol-c71f-pc$"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-3982d1ab0708ff7d4efc6b03",
          "src_port": null,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 60,
          "timestamp_epoch": "1561247190.654791000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "30"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-7a95957c493f79264207b040",
          "src_port": null,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 61,
          "timestamp_epoch": "1561247190.655019000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "30"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-2aef870fa31a97061df6d3ea",
          "src_port": null,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 62,
          "timestamp_epoch": "1561247190.655337000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "bristol-c71f-pc$"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-b7a946427c6801bb6f1dba0a",
          "src_port": null,
          "tcp_stream": 6,
          "udp_stream": null,
          "frame_number": 72,
          "timestamp_epoch": "1561247190.679536000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "11",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-51de00f371bebeddc8de9604",
          "src_port": null,
          "tcp_stream": 6,
          "udp_stream": null,
          "frame_number": 74,
          "timestamp_epoch": "1561247190.680344000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-50fbdcc2db9dfa113c5d2850",
          "src_port": null,
          "tcp_stream": 7,
          "udp_stream": null,
          "frame_number": 83,
          "timestamp_epoch": "1561247190.683497000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-836c1582f7100b10fc377d32",
          "src_port": null,
          "tcp_stream": 7,
          "udp_stream": null,
          "frame_number": 86,
          "timestamp_epoch": "1561247190.684221000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "bristol-c71f-pc$"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-a5783f07f39a661b43206f7a",
          "src_port": null,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 94,
          "timestamp_epoch": "1561247190.684817000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-7d2918c43629b80b06b1f00f",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 96,
          "timestamp_epoch": "1561247190.684945000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "11",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-d6a472359b8bfc47a86fc339",
          "src_port": null,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 99,
          "timestamp_epoch": "1561247190.685721000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-79a0d423402ebcf346ec0480",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 100,
          "timestamp_epoch": "1561247190.686329000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-ce9ad6c3ee05c85628eb5c9c",
          "src_port": null,
          "tcp_stream": 9,
          "udp_stream": null,
          "frame_number": 113,
          "timestamp_epoch": "1561247190.689271000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-26585f5f7d81a840f9684d66",
          "src_port": null,
          "tcp_stream": 9,
          "udp_stream": null,
          "frame_number": 116,
          "timestamp_epoch": "1561247190.690029000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-3d8f609236f7d984642c9d0c",
          "src_port": null,
          "tcp_stream": 3,
          "udp_stream": null,
          "frame_number": 122,
          "timestamp_epoch": "1561247190.691003000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-5c0119b36541ab07c7821b64",
          "src_port": null,
          "tcp_stream": 3,
          "udp_stream": null,
          "frame_number": 126,
          "timestamp_epoch": "1561247190.691781000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-e39f0a5771805d3f5bf40b22",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 136,
          "timestamp_epoch": "1561247190.698177000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-b65f9e01065f715c797efee6",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 137,
          "timestamp_epoch": "1561247190.699419000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-a9a4bea7488496bddf88deb3",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 138,
          "timestamp_epoch": "1561247190.699645000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-ecfedecee07b4e9828eaf151",
          "src_port": null,
          "tcp_stream": 11,
          "udp_stream": null,
          "frame_number": 143,
          "timestamp_epoch": "1561247190.704509000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-035602b7d770c791d0bb041b",
          "src_port": null,
          "tcp_stream": 11,
          "udp_stream": null,
          "frame_number": 146,
          "timestamp_epoch": "1561247190.705390000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-5dece8c21f9a35aecce9c403",
          "src_port": null,
          "tcp_stream": 12,
          "udp_stream": null,
          "frame_number": 155,
          "timestamp_epoch": "1561247190.707576000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-22cb6ed617cbc191dc10a6fc",
          "src_port": null,
          "tcp_stream": 12,
          "udp_stream": null,
          "frame_number": 158,
          "timestamp_epoch": "1561247190.707948000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-866139fba123f18165dd3691",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 166,
          "timestamp_epoch": "1561247190.710424000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-7fa2abdf501461d67644b33e",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 167,
          "timestamp_epoch": "1561247190.711182000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-0af8c72b9207c6714cf87cc3",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 168,
          "timestamp_epoch": "1561247190.714628000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-58634f56231b95212d96436a",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 169,
          "timestamp_epoch": "1561247190.714815000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-a5ea387db77445e55ff04876",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 170,
          "timestamp_epoch": "1561247190.715767000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-bf30c3df0e9e27e34d4ec18a",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 171,
          "timestamp_epoch": "1561247190.715983000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "BRISTOL-C71F-PC<20>,BRISTOL-C71F-PC<20> (Server service)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-bb1304be0750ff4d5b944796",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 197,
          "timestamp_epoch": "1561247190.909525000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "BRISTOL-C71F-PC<00>,BRISTOL-C71F-PC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-0338fa378561f824fd2829c0",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 217,
          "timestamp_epoch": "1561247191.123489000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "PHENOMENOC<00>,PHENOMENOC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "True"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-206ab841df6406057cef0cb4",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 218,
          "timestamp_epoch": "1561247191.123628000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "BRISTOL-C71F-PC<20>,BRISTOL-C71F-PC<20> (Server service)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-b5f0478f9ec57488021743aa",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 219,
          "timestamp_epoch": "1561247191.661248000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "PHENOMENOC<00>,PHENOMENOC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "True"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-4f157491fff3e11f3f354ac2",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 220,
          "timestamp_epoch": "1561247191.880698000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "BRISTOL-C71F-PC<00>,BRISTOL-C71F-PC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-9e3b9399e25298e433618058",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 221,
          "timestamp_epoch": "1561247191.880883000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "BRISTOL-C71F-PC<20>,BRISTOL-C71F-PC<20> (Server service)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-7412babc15db68039fd516bf",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 222,
          "timestamp_epoch": "1561247192.410617000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "BRISTOL-C71F-PC<00>,BRISTOL-C71F-PC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-e9afd0f25052ef95649002cc",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 223,
          "timestamp_epoch": "1561247192.630737000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "PHENOMENOC<00>,PHENOMENOC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "True"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-e340db657b44b0b634311974",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 224,
          "timestamp_epoch": "1561247192.630916000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "00:1f:cf:61:19:64",
            "dns.qry.name": "Bristol-c71f-PC"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-f55923aff6d8703b104b1c85",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 12,
          "frame_number": 227,
          "timestamp_epoch": "1561247192.786579000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "00:1f:cf:61:19:64",
            "dns.qry.name": "wpad"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-11af3bdfdd9c52d018bc8037",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 16,
          "frame_number": 232,
          "timestamp_epoch": "1561247192.800070000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "00:1f:cf:61:19:64",
            "dns.qry.name": "Bristol-c71f-PC"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-193ec3a7544fa64f0147eed7",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 12,
          "frame_number": 233,
          "timestamp_epoch": "1561247192.881095000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "00:1f:cf:61:19:64",
            "dns.qry.name": "wpad"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-8727f886339cf35b9d3640d1",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 16,
          "frame_number": 234,
          "timestamp_epoch": "1561247192.890864000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-93a6b6ee97f7272d8ee21422",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 235,
          "timestamp_epoch": "1561247193.092169000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "BRISTOL-C71F-PC<20>,BRISTOL-C71F-PC<20> (Server service)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-53affa6b745319f57e526aa0",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 236,
          "timestamp_epoch": "1561247193.161396000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-995170043f6b070bffe42983",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 238,
          "timestamp_epoch": "1561247193.841939000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "00:1f:cf:61:19:64",
            "dns.qry.name": "Bristol-c71f-PC"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-d698ec5295674d9a7cff4bcb",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 19,
          "frame_number": 245,
          "timestamp_epoch": "1561247193.927976000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "00:1f:cf:61:19:64",
            "dns.qry.name": "Bristol-c71f-PC"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-be015b45745c95dcf2c28582",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 19,
          "frame_number": 246,
          "timestamp_epoch": "1561247194.021847000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-f9049813da9f4319bed17f50",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 248,
          "timestamp_epoch": "1561247194.591015000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-4f5f5739cf62bfbdb1b37ca3",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 249,
          "timestamp_epoch": "1561247195.369350000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-d4fd94bfc223053a22f97050",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 250,
          "timestamp_epoch": "1561247195.369809000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-c5ac1c0e8f4e0049d4f70969",
          "src_port": null,
          "tcp_stream": 18,
          "udp_stream": null,
          "frame_number": 265,
          "timestamp_epoch": "1561247195.374333000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-4eae73ece95dbd60f5eb1937",
          "src_port": null,
          "tcp_stream": 18,
          "udp_stream": null,
          "frame_number": 268,
          "timestamp_epoch": "1561247195.375306000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-8803e480c19e164f832f11a4",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 274,
          "timestamp_epoch": "1561247195.375792000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-5097f24544b2ec3eee9b9d01",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 276,
          "timestamp_epoch": "1561247195.376421000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-18068ae26907215524d67ac9",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 277,
          "timestamp_epoch": "1561247195.376607000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "00:1f:cf:61:19:64",
            "dns.qry.name": "wpad"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-6d3c46776d9796eb81ca2756",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 23,
          "frame_number": 288,
          "timestamp_epoch": "1561247195.395595000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "00:1f:cf:61:19:64",
            "dns.qry.name": "wpad"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-2e7a03e5885f8a6dc223e801",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 23,
          "frame_number": 293,
          "timestamp_epoch": "1561247195.503044000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-0ac39b6ab4b198918875c692",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 297,
          "timestamp_epoch": "1561247195.705565000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-37673c77e4bf6e54f8c63dd8",
          "src_port": null,
          "tcp_stream": 21,
          "udp_stream": null,
          "frame_number": 312,
          "timestamp_epoch": "1561247195.965138000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-1a2d3d732f716a4a3eb561b5",
          "src_port": null,
          "tcp_stream": 21,
          "udp_stream": null,
          "frame_number": 314,
          "timestamp_epoch": "1561247195.966028000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-a0bd3c43796b049d6a1df766",
          "src_port": null,
          "tcp_stream": 22,
          "udp_stream": null,
          "frame_number": 319,
          "timestamp_epoch": "1561247195.974643000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-b8d2503bf51ce90f0c4dcc15",
          "src_port": null,
          "tcp_stream": 22,
          "udp_stream": null,
          "frame_number": 322,
          "timestamp_epoch": "1561247195.975858000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-e7ca278311739113bd1bc776",
          "src_port": null,
          "tcp_stream": 23,
          "udp_stream": null,
          "frame_number": 333,
          "timestamp_epoch": "1561247195.981704000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-93f7eccf6c9335e658fb2ea4",
          "src_port": null,
          "tcp_stream": 23,
          "udp_stream": null,
          "frame_number": 335,
          "timestamp_epoch": "1561247195.982464000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-b8314e42e9971e2b0a8bda92",
          "src_port": null,
          "tcp_stream": 24,
          "udp_stream": null,
          "frame_number": 346,
          "timestamp_epoch": "1561247195.987071000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-759308317afb25930eb2df87",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 351,
          "timestamp_epoch": "1561247195.988179000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-98bb465263727dfd59d1214c",
          "src_port": null,
          "tcp_stream": 24,
          "udp_stream": null,
          "frame_number": 353,
          "timestamp_epoch": "1561247195.988468000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-ecb01696cea3cf86b704cec5",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 355,
          "timestamp_epoch": "1561247195.988769000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-e271506336af0fe320c8cc8a",
          "src_port": null,
          "tcp_stream": 26,
          "udp_stream": null,
          "frame_number": 363,
          "timestamp_epoch": "1561247195.989876000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "30"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-be3646d4220fb4e3d8a234d4",
          "src_port": null,
          "tcp_stream": 26,
          "udp_stream": null,
          "frame_number": 366,
          "timestamp_epoch": "1561247195.990750000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-1d294a3119ca353f1c35d388",
          "src_port": null,
          "tcp_stream": 27,
          "udp_stream": null,
          "frame_number": 372,
          "timestamp_epoch": "1561247195.991787000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-7e9556e4c11919f49400498a",
          "src_port": null,
          "tcp_stream": 27,
          "udp_stream": null,
          "frame_number": 376,
          "timestamp_epoch": "1561247195.993262000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-9130bd0ff16bd9aa6788e0c6",
          "src_port": null,
          "tcp_stream": 28,
          "udp_stream": null,
          "frame_number": 385,
          "timestamp_epoch": "1561247195.994399000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-0d56853a4eb0490bda89b936",
          "src_port": null,
          "tcp_stream": 28,
          "udp_stream": null,
          "frame_number": 388,
          "timestamp_epoch": "1561247195.994851000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-3973b256511b0aa9a8af5c8e",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 396,
          "timestamp_epoch": "1561247195.995667000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-dd3bc7aab62b06f8d4b6c5c2",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 397,
          "timestamp_epoch": "1561247195.996533000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-5a84245c82e709113be65cf3",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 398,
          "timestamp_epoch": "1561247195.996991000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-475c11faddc4e02bad95c5cc",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 399,
          "timestamp_epoch": "1561247195.997174000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-398f6b0b44a61bcc3714671c",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 400,
          "timestamp_epoch": "1561247195.997478000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-1856fd36acb40b3524412cc4",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 401,
          "timestamp_epoch": "1561247195.997732000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-2beb006f871b779045673892",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 402,
          "timestamp_epoch": "1561247195.998112000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-6e3b17949960af28c148a2b4",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 403,
          "timestamp_epoch": "1561247195.998326000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-65f5ca57bec71e5fe0e563f5",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 404,
          "timestamp_epoch": "1561247195.998697000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-8449912c9fffb05646d8e5ca",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 405,
          "timestamp_epoch": "1561247195.998879000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-5cc678bb408f4ada8ee860fe",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 406,
          "timestamp_epoch": "1561247195.999292000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-d853e69b86ebb1325752755f",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 407,
          "timestamp_epoch": "1561247195.999819000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-bc7cb3e71cfa1041b401b594",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 408,
          "timestamp_epoch": "1561247196.000215000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-112501d553858d841a053cb1",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 409,
          "timestamp_epoch": "1561247196.000425000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-3e5a38992d67e788c9e72435",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 417,
          "timestamp_epoch": "1561247196.470761000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-1f664806bfbbc007fa1c6d0d",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 419,
          "timestamp_epoch": "1561247197.235123000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-fd6e6190e7aae2365bb2ba8e",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 455,
          "timestamp_epoch": "1561247201.222477000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-a379b9308302544587396c86",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 457,
          "timestamp_epoch": "1561247201.223376000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-20d5bf9927bd93b595153a2b",
          "src_port": null,
          "tcp_stream": 42,
          "udp_stream": null,
          "frame_number": 470,
          "timestamp_epoch": "1561247201.239312000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-48fb522453f4298a4ebaaeae",
          "src_port": null,
          "tcp_stream": 42,
          "udp_stream": null,
          "frame_number": 472,
          "timestamp_epoch": "1561247201.240050000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-7d7b1ce97c5729fbb12d07b4",
          "src_port": null,
          "tcp_stream": 43,
          "udp_stream": null,
          "frame_number": 478,
          "timestamp_epoch": "1561247201.242454000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "30"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-be061692c3bd90d1bd2e0aa7",
          "src_port": null,
          "tcp_stream": 43,
          "udp_stream": null,
          "frame_number": 479,
          "timestamp_epoch": "1561247201.242851000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-c741b63a2f5999be099885a5",
          "src_port": null,
          "tcp_stream": 44,
          "udp_stream": null,
          "frame_number": 486,
          "timestamp_epoch": "1561247201.259385000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "11",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-84cf9ad47d0e0c62b363a6bf",
          "src_port": null,
          "tcp_stream": 44,
          "udp_stream": null,
          "frame_number": 488,
          "timestamp_epoch": "1561247201.260143000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-7ffaa855eaf96a60d14f9152",
          "src_port": null,
          "tcp_stream": 45,
          "udp_stream": null,
          "frame_number": 497,
          "timestamp_epoch": "1561247201.261732000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BRISTOL-C71F-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-f7bd9ae281bc677352ebc710",
          "src_port": null,
          "tcp_stream": 45,
          "udp_stream": null,
          "frame_number": 500,
          "timestamp_epoch": "1561247201.262387000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-738d404625f1797bc54f3365",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 518,
          "timestamp_epoch": "1561247207.110411000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-72b309f25f63399c83797fbf",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 519,
          "timestamp_epoch": "1561247207.110598000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-cd5241708867ced751bb161b",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 520,
          "timestamp_epoch": "1561247207.110884000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-742bdf0fa9f78748d24fdd9d",
          "src_port": null,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 521,
          "timestamp_epoch": "1561247207.111033000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-64870209c9cf3f5b1f735065",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 522,
          "timestamp_epoch": "1561247207.111247000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-1d13cf5e27733a38d277b432",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 524,
          "timestamp_epoch": "1561247207.111438000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-16c1c650e21635694ef3abfb",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 540,
          "timestamp_epoch": "1561247219.121877000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-b0e0a3ac2809172b6a20a56a",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 541,
          "timestamp_epoch": "1561247219.122248000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "dns.qry.name": "Bangkok-8ac2-PC"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-6974075f710d122454ccc794",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 32,
          "frame_number": 549,
          "timestamp_epoch": "1561247224.490383000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "dns.qry.name": "Bangkok-8ac2-PC"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-52ac250f7a7cdd278e5875bd",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 32,
          "frame_number": 551,
          "timestamp_epoch": "1561247224.591823000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "BANGKOK-8AC2-PC<00>,BANGKOK-8AC2-PC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-20e299100833ceea201b1f81",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 552,
          "timestamp_epoch": "1561247225.057759000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "PHENOMENOC<00>,PHENOMENOC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "True"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-92349f3bddfbb7194d7db75e",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 553,
          "timestamp_epoch": "1561247225.058070000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "bangkok-8ac2-pc$"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-444dedcf899e0df471fb4175",
          "src_port": null,
          "tcp_stream": 56,
          "udp_stream": null,
          "frame_number": 596,
          "timestamp_epoch": "1561247225.272842000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "30"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-16070ed073a1a915b52c838d",
          "src_port": null,
          "tcp_stream": 56,
          "udp_stream": null,
          "frame_number": 597,
          "timestamp_epoch": "1561247225.273360000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "bangkok-8ac2-pc$"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-b8c590b5af3c18dc00fbac5f",
          "src_port": null,
          "tcp_stream": 57,
          "udp_stream": null,
          "frame_number": 604,
          "timestamp_epoch": "1561247225.296771000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "11",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-a90350e862180c48fe55bc88",
          "src_port": null,
          "tcp_stream": 57,
          "udp_stream": null,
          "frame_number": 606,
          "timestamp_epoch": "1561247225.297437000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-26b4d193b3c2ebaf9f3f2722",
          "src_port": null,
          "tcp_stream": 58,
          "udp_stream": null,
          "frame_number": 615,
          "timestamp_epoch": "1561247225.301091000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-5217635c91a30dc7a153623b",
          "src_port": null,
          "tcp_stream": 58,
          "udp_stream": null,
          "frame_number": 618,
          "timestamp_epoch": "1561247225.301723000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-3fa0fd83c7d100fc58805e76",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 624,
          "timestamp_epoch": "1561247225.310268000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-e5e5048a6075397488e08440",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 626,
          "timestamp_epoch": "1561247225.310832000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-4dd67d64baf4511eaff85ec0",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 639,
          "timestamp_epoch": "1561247225.349543000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-0634ede4b08648db12d007df",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 640,
          "timestamp_epoch": "1561247225.350234000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-d26580922917491b0cc6a42f",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 641,
          "timestamp_epoch": "1561247225.350421000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "bangkok-8ac2-pc$"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-833c3b34057659bb198849e8",
          "src_port": null,
          "tcp_stream": 60,
          "udp_stream": null,
          "frame_number": 645,
          "timestamp_epoch": "1561247225.351272000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "30"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-ff189d690097878b9cd84f18",
          "src_port": null,
          "tcp_stream": 60,
          "udp_stream": null,
          "frame_number": 646,
          "timestamp_epoch": "1561247225.351654000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "bangkok-8ac2-pc$"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-8f6e18d0d1a4e5466e7bae3b",
          "src_port": null,
          "tcp_stream": 61,
          "udp_stream": null,
          "frame_number": 653,
          "timestamp_epoch": "1561247225.369277000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "11",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-cc9fe53c5bb5fdc76996b805",
          "src_port": null,
          "tcp_stream": 61,
          "udp_stream": null,
          "frame_number": 655,
          "timestamp_epoch": "1561247225.369945000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-22dc2aa1f49163910201bd4c",
          "src_port": null,
          "tcp_stream": 62,
          "udp_stream": null,
          "frame_number": 664,
          "timestamp_epoch": "1561247225.372518000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-6b90b0a13b0d61c9c35bc4f8",
          "src_port": null,
          "tcp_stream": 62,
          "udp_stream": null,
          "frame_number": 667,
          "timestamp_epoch": "1561247225.373388000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-d8f7d0eda8d7e834709d531a",
          "src_port": null,
          "tcp_stream": 63,
          "udp_stream": null,
          "frame_number": 676,
          "timestamp_epoch": "1561247225.375573000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-cc85f38d5c5f38aada72cbe0",
          "src_port": null,
          "tcp_stream": 63,
          "udp_stream": null,
          "frame_number": 679,
          "timestamp_epoch": "1561247225.376028000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-d0dcd4b7fda1e5a8f469ed26",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 687,
          "timestamp_epoch": "1561247225.378119000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-dc95f3501c595db074a06ef9",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 688,
          "timestamp_epoch": "1561247225.378851000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-ce1268495841f6e38c67bd7e",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 689,
          "timestamp_epoch": "1561247225.379640000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-3b53ed4594e0968a7f5ddbf2",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 690,
          "timestamp_epoch": "1561247225.379831000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-9c6ace5bb992ac9cccb7e55d",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 691,
          "timestamp_epoch": "1561247225.380772000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-e536564a1028a8eebd63e630",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 692,
          "timestamp_epoch": "1561247225.380943000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-7b8b285a9cfd139ee8f74f09",
          "src_port": null,
          "tcp_stream": 67,
          "udp_stream": null,
          "frame_number": 732,
          "timestamp_epoch": "1561247225.615988000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-a3a160624a5a44c6c7d89e53",
          "src_port": null,
          "tcp_stream": 67,
          "udp_stream": null,
          "frame_number": 735,
          "timestamp_epoch": "1561247225.616711000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-e4c84644ee39d8dc6a7a667c",
          "src_port": null,
          "tcp_stream": 66,
          "udp_stream": null,
          "frame_number": 741,
          "timestamp_epoch": "1561247225.617524000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-6b3f3d3b04a6e78f45a4aa52",
          "src_port": null,
          "tcp_stream": 66,
          "udp_stream": null,
          "frame_number": 743,
          "timestamp_epoch": "1561247225.618080000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "PHENOMENOC<00>,PHENOMENOC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "True"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-639fd7c8214d85f743864b15",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 770,
          "timestamp_epoch": "1561247225.807529000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "BANGKOK-8AC2-PC<00>,BANGKOK-8AC2-PC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-18dd043686bec6beece5c303",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 771,
          "timestamp_epoch": "1561247225.807661000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "BANGKOK-8AC2-PC<20>,BANGKOK-8AC2-PC<20> (Server service)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-a8342975922cbb3a8f9f76ba",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 772,
          "timestamp_epoch": "1561247225.838873000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-bd97b2d1bdc4ba5f4fa1c770",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 773,
          "timestamp_epoch": "1561247225.875547000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-bb2029e3a15c09ba1dfc2449",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 774,
          "timestamp_epoch": "1561247225.875861000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-01dab6a07eeff7978d33d14e",
          "src_port": null,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 784,
          "timestamp_epoch": "1561247225.991429000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-3ecd1a6e60024e65481c16b0",
          "src_port": null,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 787,
          "timestamp_epoch": "1561247225.992199000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-3febdf1450cfe29582b9a60c",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 793,
          "timestamp_epoch": "1561247225.992802000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-a5c25e50cced3a941df58ed3",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 795,
          "timestamp_epoch": "1561247225.993339000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-60d8f5d1b85d6553c1678fee",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 796,
          "timestamp_epoch": "1561247225.993655000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-de010d8ccbf6f1f77b50fff5",
          "src_port": null,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 821,
          "timestamp_epoch": "1561247226.543651000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-05c4957d5149a7323993498a",
          "src_port": null,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 823,
          "timestamp_epoch": "1561247226.544226000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-7b11bd0fe1719362f267a33f",
          "src_port": null,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 828,
          "timestamp_epoch": "1561247226.553694000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-52d9191d7f62fd35a7d1f03d",
          "src_port": null,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 831,
          "timestamp_epoch": "1561247226.554495000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-5a20c0574e005c72c6be8484",
          "src_port": null,
          "tcp_stream": 74,
          "udp_stream": null,
          "frame_number": 842,
          "timestamp_epoch": "1561247226.561990000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-7a6860bf718da9f184c93c17",
          "src_port": null,
          "tcp_stream": 74,
          "udp_stream": null,
          "frame_number": 844,
          "timestamp_epoch": "1561247226.562723000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "BANGKOK-8AC2-PC<00>,BANGKOK-8AC2-PC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-a655898b53709af76c6bb9ab",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 851,
          "timestamp_epoch": "1561247226.565540000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "PHENOMENOC<00>,PHENOMENOC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "True"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-2203952980e04d0c5422417f",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 852,
          "timestamp_epoch": "1561247226.565664000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-68575a346ff9c83c7b6304e9",
          "src_port": null,
          "tcp_stream": 75,
          "udp_stream": null,
          "frame_number": 857,
          "timestamp_epoch": "1561247226.566418000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-c342c6f31713bf6260496add",
          "src_port": null,
          "tcp_stream": 75,
          "udp_stream": null,
          "frame_number": 860,
          "timestamp_epoch": "1561247226.567206000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-3b3f8ef91b92636eb8ba31a0",
          "src_port": null,
          "tcp_stream": 76,
          "udp_stream": null,
          "frame_number": 869,
          "timestamp_epoch": "1561247226.568113000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "30"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-e7b9398ddc62e15698f52524",
          "src_port": null,
          "tcp_stream": 76,
          "udp_stream": null,
          "frame_number": 871,
          "timestamp_epoch": "1561247226.568600000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-714eb35c76487da48e39390f",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 877,
          "timestamp_epoch": "1561247226.568981000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-1239fd78b6b8fb67ec806f53",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 879,
          "timestamp_epoch": "1561247226.569286000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-00a3baad6f2d74ebef8b0fac",
          "src_port": null,
          "tcp_stream": 78,
          "udp_stream": null,
          "frame_number": 884,
          "timestamp_epoch": "1561247226.570230000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-fdf89e860a5e0506a473e824",
          "src_port": null,
          "tcp_stream": 78,
          "udp_stream": null,
          "frame_number": 887,
          "timestamp_epoch": "1561247226.570982000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-f407caf2358e3ab70da857a2",
          "src_port": null,
          "tcp_stream": 79,
          "udp_stream": null,
          "frame_number": 896,
          "timestamp_epoch": "1561247226.571654000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-77918badddfb22e420b55d28",
          "src_port": null,
          "tcp_stream": 79,
          "udp_stream": null,
          "frame_number": 899,
          "timestamp_epoch": "1561247226.571957000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-733c5aea189378d526507631",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 907,
          "timestamp_epoch": "1561247226.572530000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-9e29f12e73794dc049b051ec",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 908,
          "timestamp_epoch": "1561247226.573094000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-06d5162d555aed7683d3c788",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 909,
          "timestamp_epoch": "1561247226.573478000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-27e1780d4775bcd28db7a2b0",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 910,
          "timestamp_epoch": "1561247226.573593000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-acddfeb55528c97722ba7faf",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 911,
          "timestamp_epoch": "1561247226.573872000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-ed513634a116b7895e364f27",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 912,
          "timestamp_epoch": "1561247226.574016000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-35a236402fcd8f781ac2b116",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 913,
          "timestamp_epoch": "1561247226.574301000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-09e8340fb918ecf34e2c0cfd",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 914,
          "timestamp_epoch": "1561247226.574434000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-a2c3eaed95aa18c90a480df8",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 915,
          "timestamp_epoch": "1561247226.574700000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-b9123add1401d1df22faafec",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 916,
          "timestamp_epoch": "1561247226.574806000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-5b063d2900284a0f05f79430",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 917,
          "timestamp_epoch": "1561247226.575311000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-3691204691b549ba3eb7fa0b",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 918,
          "timestamp_epoch": "1561247226.575577000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-43f5d0bc886cc816820c24ed",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 919,
          "timestamp_epoch": "1561247226.575899000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-857c9f9381e4c1a65498d27d",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 920,
          "timestamp_epoch": "1561247226.576030000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "BANGKOK-8AC2-PC<20>,BANGKOK-8AC2-PC<20> (Server service)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-206475b6cd41372ed58010a7",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 923,
          "timestamp_epoch": "1561247226.585875000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "PHENOMENOC<00>,PHENOMENOC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "True"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-a58b11e01fbdde14a41e9df2",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 928,
          "timestamp_epoch": "1561247227.315803000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "BANGKOK-8AC2-PC<00>,BANGKOK-8AC2-PC<00> (Workstation/Redirector)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-fedf2ca7b6219e46ac7b1567",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 929,
          "timestamp_epoch": "1561247227.316009000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "BANGKOK-8AC2-PC<20>,BANGKOK-8AC2-PC<20> (Server service)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-32f0fd85ba7867fe8a6bfbda",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 930,
          "timestamp_epoch": "1561247227.336649000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "dns.qry.name": "Bangkok-8ac2-PC"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-3fbd3275a2042eb41aeb8620",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 48,
          "frame_number": 933,
          "timestamp_epoch": "1561247227.554237000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "dns.qry.name": "wpad"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-7a4ef00f964506a0df1c09c2",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 52,
          "frame_number": 938,
          "timestamp_epoch": "1561247227.576247000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "dns.qry.name": "Bangkok-8ac2-PC"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-1c876e9fa2c0e4701e4af32a",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 48,
          "frame_number": 939,
          "timestamp_epoch": "1561247227.646379000"
        },
        {
          "kind": "identity",
          "dst_ip": "224.0.0.252",
          "fields": {
            "eth.dst": "01:00:5e:00:00:fc",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "dns.qry.name": "wpad"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-1aac2b897240a27163dfbcb1",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 52,
          "frame_number": 940,
          "timestamp_epoch": "1561247227.676289000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-df6ade607e84c97896e708cd",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 941,
          "timestamp_epoch": "1561247227.876668000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "BANGKOK-8AC2-PC<20>,BANGKOK-8AC2-PC<20> (Server service)",
            "nbns.flags.opcode": "5",
            "nbns.flags.response": "False",
            "nbns.nb_flags.group": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-67590ed6ea20b8311ec9dd34",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 943,
          "timestamp_epoch": "1561247228.086314000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-3858c13e6a7c371d99133a4b",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 944,
          "timestamp_epoch": "1561247228.626613000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-f7eb22c8f00449f4f416b609",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 951,
          "timestamp_epoch": "1561247229.375549000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-f65d87d80e0028214c3ceb61",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 968,
          "timestamp_epoch": "1561247231.117643000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-f6024e646bc68825bf4d9fa4",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 969,
          "timestamp_epoch": "1561247231.117839000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-5282495d190579579cbe3870",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 970,
          "timestamp_epoch": "1561247231.118060000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-b85a2674695f7168155c0353",
          "src_port": null,
          "tcp_stream": 25,
          "udp_stream": null,
          "frame_number": 971,
          "timestamp_epoch": "1561247231.118266000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-e03bda3b55b1f073f306e977",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 985,
          "timestamp_epoch": "1561247235.790536000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-97ac3e9f372f1cbf71979800",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 987,
          "timestamp_epoch": "1561247235.791127000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-60aadcbc43c94c1dcadb1c1c",
          "src_port": null,
          "tcp_stream": 82,
          "udp_stream": null,
          "frame_number": 1000,
          "timestamp_epoch": "1561247235.810376000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-b683e327dfb4d3ae9f29f95c",
          "src_port": null,
          "tcp_stream": 82,
          "udp_stream": null,
          "frame_number": 1002,
          "timestamp_epoch": "1561247235.811046000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-31cfeebcb1aeaa45ff91fc81",
          "src_port": null,
          "tcp_stream": 83,
          "udp_stream": null,
          "frame_number": 1008,
          "timestamp_epoch": "1561247235.814031000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "30"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-eb3712d2516024abfd48f8ee",
          "src_port": null,
          "tcp_stream": 83,
          "udp_stream": null,
          "frame_number": 1009,
          "timestamp_epoch": "1561247235.814402000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-8b7d74c03044ec2f33f90dd0",
          "src_port": null,
          "tcp_stream": 84,
          "udp_stream": null,
          "frame_number": 1016,
          "timestamp_epoch": "1561247235.830429000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "11",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-400f6706a104d0c6e2c6999e",
          "src_port": null,
          "tcp_stream": 84,
          "udp_stream": null,
          "frame_number": 1018,
          "timestamp_epoch": "1561247235.830943000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-8e72d16f16871412841360ea",
          "src_port": null,
          "tcp_stream": 85,
          "udp_stream": null,
          "frame_number": 1027,
          "timestamp_epoch": "1561247235.834206000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "BANGKOK-8AC2-PC$"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-cf0a2243e6cd6a14d46e1da9",
          "src_port": null,
          "tcp_stream": 85,
          "udp_stream": null,
          "frame_number": 1030,
          "timestamp_epoch": "1561247235.834929000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "setsuko.overton"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-877c382aa97d352c7ecbaca4",
          "src_port": null,
          "tcp_stream": 86,
          "udp_stream": null,
          "frame_number": 1044,
          "timestamp_epoch": "1561247238.237684000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "30"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-0c6a677a30d2945b4120e3e1",
          "src_port": null,
          "tcp_stream": 86,
          "udp_stream": null,
          "frame_number": 1045,
          "timestamp_epoch": "1561247238.238120000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "setsuko.overton"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-12eb0c7e4ce18d18faec6fa9",
          "src_port": null,
          "tcp_stream": 87,
          "udp_stream": null,
          "frame_number": 1052,
          "timestamp_epoch": "1561247238.251383000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "11",
            "kerberos.CNameString": "setsuko.overton"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-bedcae855be60490778a8644",
          "src_port": null,
          "tcp_stream": 87,
          "udp_stream": null,
          "frame_number": 1054,
          "timestamp_epoch": "1561247238.252081000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-2badd9aa75c01702a25eef88",
          "src_port": null,
          "tcp_stream": 88,
          "udp_stream": null,
          "frame_number": 1063,
          "timestamp_epoch": "1561247238.253306000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "setsuko.overton"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-3a226458d181fdb1fe55cac3",
          "src_port": null,
          "tcp_stream": 88,
          "udp_stream": null,
          "frame_number": 1066,
          "timestamp_epoch": "1561247238.253912000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-982088ab0d242702b56718c5",
          "src_port": null,
          "tcp_stream": 90,
          "udp_stream": null,
          "frame_number": 1082,
          "timestamp_epoch": "1561247238.403054000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "setsuko.overton"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-6b8151837b31c9d82bf7cf77",
          "src_port": null,
          "tcp_stream": 90,
          "udp_stream": null,
          "frame_number": 1085,
          "timestamp_epoch": "1561247238.403843000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-8ed6d3e95aaf0e4e9ee79f2f",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 1091,
          "timestamp_epoch": "1561247238.404592000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-9fffbb01f6690e406c5511c9",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 1093,
          "timestamp_epoch": "1561247238.405198000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-731e0da3f405683ad29aa810",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 1094,
          "timestamp_epoch": "1561247238.407375000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-08bf7f22d48bb46f6e378cf4",
          "src_port": null,
          "tcp_stream": 92,
          "udp_stream": null,
          "frame_number": 1113,
          "timestamp_epoch": "1561247238.937896000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "setsuko.overton"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-d0d7cd9fc4bf446c581482ba",
          "src_port": null,
          "tcp_stream": 92,
          "udp_stream": null,
          "frame_number": 1116,
          "timestamp_epoch": "1561247238.938637000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-dfa81ef753a46e44ef864c6d",
          "src_port": null,
          "tcp_stream": 91,
          "udp_stream": null,
          "frame_number": 1122,
          "timestamp_epoch": "1561247238.939278000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-6c452fc71f81641b656c0b3d",
          "src_port": null,
          "tcp_stream": 91,
          "udp_stream": null,
          "frame_number": 1124,
          "timestamp_epoch": "1561247238.939782000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-81943f58245f2688367217a4",
          "src_port": null,
          "tcp_stream": 93,
          "udp_stream": null,
          "frame_number": 1131,
          "timestamp_epoch": "1561247238.945123000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-cd5e4e12cf40cabecc96d8a6",
          "src_port": null,
          "tcp_stream": 93,
          "udp_stream": null,
          "frame_number": 1133,
          "timestamp_epoch": "1561247238.945589000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-0c8633d74a71a9893020249d",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 1142,
          "timestamp_epoch": "1561247238.949951000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-43fc910104284885aebce257",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 1143,
          "timestamp_epoch": "1561247238.950234000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-c27df58b25d1b75e1dc6d516",
          "src_port": null,
          "tcp_stream": 95,
          "udp_stream": null,
          "frame_number": 1148,
          "timestamp_epoch": "1561247238.951092000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "setsuko.overton"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-f49ee4351464445e838bae51",
          "src_port": null,
          "tcp_stream": 95,
          "udp_stream": null,
          "frame_number": 1151,
          "timestamp_epoch": "1561247238.951856000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-00c832651e63fd0a846b9d71",
          "src_port": null,
          "tcp_stream": 96,
          "udp_stream": null,
          "frame_number": 1160,
          "timestamp_epoch": "1561247238.952464000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "setsuko.overton"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-e808266f8668afbcb36fa7b1",
          "src_port": null,
          "tcp_stream": 96,
          "udp_stream": null,
          "frame_number": 1163,
          "timestamp_epoch": "1561247238.952735000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-7ab4084d38106a86ae6fdae3",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 1171,
          "timestamp_epoch": "1561247238.953502000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-aff0c21ffed4f5e5c03ee698",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 1172,
          "timestamp_epoch": "1561247238.954012000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-acc2fb3874f26cabceb0bc58",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 1173,
          "timestamp_epoch": "1561247238.954357000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-47f37112485872b43f6f453a",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 1174,
          "timestamp_epoch": "1561247238.954476000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-3b36a1e2cc421f3588dc86de",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 1175,
          "timestamp_epoch": "1561247238.954827000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-67f9eb914ef7af5597ed7587",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 1176,
          "timestamp_epoch": "1561247238.955070000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-4f0e87ef029dcc5ce9372a32",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 1177,
          "timestamp_epoch": "1561247238.955344000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-b78bca3c160d4c75b48294aa",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 1178,
          "timestamp_epoch": "1561247238.955457000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-5f13eedcee3e417843b7851f",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 1186,
          "timestamp_epoch": "1561247241.918429000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-4c1049f8355a29bb1d3e4ed2",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 1187,
          "timestamp_epoch": "1561247241.918709000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-a91798c9c4d64be77ab71d3d",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 1188,
          "timestamp_epoch": "1561247241.918942000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-ee672654eb992a4228b65351",
          "src_port": null,
          "tcp_stream": 59,
          "udp_stream": null,
          "frame_number": 1189,
          "timestamp_epoch": "1561247241.919246000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-2f16f361b4b97acdcebb2378",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 1190,
          "timestamp_epoch": "1561247241.919502000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-51d91dd70c4b114de7184fc0",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 1192,
          "timestamp_epoch": "1561247241.919732000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-e0709c5417766f997648c5f8",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 1224,
          "timestamp_epoch": "1561247253.915928000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-eae4b0bc66815ba6142d37fd",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 1225,
          "timestamp_epoch": "1561247253.916312000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "edris.haight"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-13f6f8f84d6dce0f151b7616",
          "src_port": null,
          "tcp_stream": 115,
          "udp_stream": null,
          "frame_number": 1229,
          "timestamp_epoch": "1561247254.087189000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "30"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-d74287dbbecb77b71f411219",
          "src_port": null,
          "tcp_stream": 115,
          "udp_stream": null,
          "frame_number": 1230,
          "timestamp_epoch": "1561247254.087609000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "10",
            "kerberos.CNameString": "edris.haight"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-1bdaf0e682494826becbf0ab",
          "src_port": null,
          "tcp_stream": 116,
          "udp_stream": null,
          "frame_number": 1237,
          "timestamp_epoch": "1561247254.107001000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "11",
            "kerberos.CNameString": "edris.haight"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-957a9273fe838f68ec5624e6",
          "src_port": null,
          "tcp_stream": 116,
          "udp_stream": null,
          "frame_number": 1239,
          "timestamp_epoch": "1561247254.107597000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-e136993f2552fb218d2a78e0",
          "src_port": null,
          "tcp_stream": 117,
          "udp_stream": null,
          "frame_number": 1248,
          "timestamp_epoch": "1561247254.108477000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "edris.haight"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-e6f20f3cdf40a4bf89597b12",
          "src_port": null,
          "tcp_stream": 117,
          "udp_stream": null,
          "frame_number": 1251,
          "timestamp_epoch": "1561247254.109244000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-8903e4934af11a50e3717e0f",
          "src_port": null,
          "tcp_stream": 119,
          "udp_stream": null,
          "frame_number": 1268,
          "timestamp_epoch": "1561247254.198795000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "edris.haight"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-917a43b1c6ddf089d770b1c4",
          "src_port": null,
          "tcp_stream": 119,
          "udp_stream": null,
          "frame_number": 1271,
          "timestamp_epoch": "1561247254.199605000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-b0bac8692449ef7da05cbde0",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 1277,
          "timestamp_epoch": "1561247254.205902000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-a966ae5ce000a264cd586443",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 1279,
          "timestamp_epoch": "1561247254.206422000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-a4636730e00716baa8e77726",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 1280,
          "timestamp_epoch": "1561247254.208758000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-41e5dc01490d7d35f6304b74",
          "src_port": null,
          "tcp_stream": 121,
          "udp_stream": null,
          "frame_number": 1303,
          "timestamp_epoch": "1561247254.751192000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "edris.haight"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-97c1fa2446cf2fedc107e28d",
          "src_port": null,
          "tcp_stream": 121,
          "udp_stream": null,
          "frame_number": 1306,
          "timestamp_epoch": "1561247254.752212000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-ceb6cf2b364c69416ae2c799",
          "src_port": null,
          "tcp_stream": 120,
          "udp_stream": null,
          "frame_number": 1312,
          "timestamp_epoch": "1561247254.753153000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-3a58f480793af35c50516da4",
          "src_port": null,
          "tcp_stream": 120,
          "udp_stream": null,
          "frame_number": 1314,
          "timestamp_epoch": "1561247254.753741000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-e80db97b8f1205bd93dbcfc4",
          "src_port": null,
          "tcp_stream": 122,
          "udp_stream": null,
          "frame_number": 1321,
          "timestamp_epoch": "1561247254.759798000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-c0306f4d303ebcfd3e9d8ef0",
          "src_port": null,
          "tcp_stream": 122,
          "udp_stream": null,
          "frame_number": 1323,
          "timestamp_epoch": "1561247254.760343000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-40e10bdec7304afb8019d862",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 1333,
          "timestamp_epoch": "1561247254.765080000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-380bed4e57033822bac61264",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 1334,
          "timestamp_epoch": "1561247254.765294000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-227bc367e1560d6b61217d4a",
          "src_port": null,
          "tcp_stream": 124,
          "udp_stream": null,
          "frame_number": 1339,
          "timestamp_epoch": "1561247254.766125000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "edris.haight"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-2f039ac8de876c56bad25ac7",
          "src_port": null,
          "tcp_stream": 124,
          "udp_stream": null,
          "frame_number": 1342,
          "timestamp_epoch": "1561247254.766861000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "12,14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-4a454deaef426da23fffd7f1",
          "src_port": null,
          "tcp_stream": 125,
          "udp_stream": null,
          "frame_number": 1351,
          "timestamp_epoch": "1561247254.767479000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "13",
            "kerberos.CNameString": "edris.haight"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-a5e177ec678b7e73e00d6fe0",
          "src_port": null,
          "tcp_stream": 125,
          "udp_stream": null,
          "frame_number": 1354,
          "timestamp_epoch": "1561247254.767747000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "kerberos.msg_type": "14"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-07323e3671429e44a9d9889c",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 1362,
          "timestamp_epoch": "1561247254.768323000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa",
            "kerberos.msg_type": "15"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-5fb429a8c035cb3340ee7df3",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 1363,
          "timestamp_epoch": "1561247254.768817000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-47c192772f3c621c152dbcea",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 1364,
          "timestamp_epoch": "1561247254.769166000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-3fa546bc09c0382a8a0a57e2",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 1365,
          "timestamp_epoch": "1561247254.769276000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-01e435ee9455007b224c6b19",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 1366,
          "timestamp_epoch": "1561247254.769669000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-9a58f1bd81e469d5c12ebbc7",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 1367,
          "timestamp_epoch": "1561247254.769907000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-9a98f03c793e6976d62455a3",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 1368,
          "timestamp_epoch": "1561247254.770204000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-30c6b9275e0e0c8e50373480",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 1369,
          "timestamp_epoch": "1561247254.770316000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-ab768efdb0c25c4e15796cd5",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 1394,
          "timestamp_epoch": "1561247260.590516000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-cc2daabbde695a34afec0f9e",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 1405,
          "timestamp_epoch": "1561247261.119116000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-268867b1564aafe5168fb6e9",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 1406,
          "timestamp_epoch": "1561247261.119775000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-4b0f79b095d14ed3f9b8831e",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 1457,
          "timestamp_epoch": "1561247261.352014000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-8456c1aa297f71231c73078a",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 1736,
          "timestamp_epoch": "1561247262.116433000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-9002b9370db211e2a2c87a2e",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 2039,
          "timestamp_epoch": "1561247262.902859000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-e0cadc547830b7e76c715bc3",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 2546,
          "timestamp_epoch": "1561247263.658077000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "00:1f:cf:61:19:64",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-362c2e0227667d7bd2fd7301",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 0,
          "frame_number": 3008,
          "timestamp_epoch": "1561247264.409978000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-13f26099126206e8f2dcf11f",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 3193,
          "timestamp_epoch": "1561247265.911221000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-914aefdcf129fd4032acdf54",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 3194,
          "timestamp_epoch": "1561247265.911420000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-294ba1db25c49614c2891bbb",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 3195,
          "timestamp_epoch": "1561247265.911615000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-d065527a374745b540903845",
          "src_port": null,
          "tcp_stream": 77,
          "udp_stream": null,
          "frame_number": 3196,
          "timestamp_epoch": "1561247265.911837000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-8f239d0023b8335065baf961",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 3689,
          "timestamp_epoch": "1561247273.117212000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-39f156731bc395435504fa4b",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 3690,
          "timestamp_epoch": "1561247273.117466000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "00:1f:cf:61:19:64"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-170e09c9cd7b0a9d95e6ba35",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 3691,
          "timestamp_epoch": "1561247273.117655000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.193",
          "fields": {
            "eth.dst": "00:1f:cf:61:19:64",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-8d7abb90925d82a47c79608d",
          "src_port": null,
          "tcp_stream": 94,
          "udp_stream": null,
          "frame_number": 3692,
          "timestamp_epoch": "1561247273.117833000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-75535d6ec3f7e5d9934eddb1",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 3730,
          "timestamp_epoch": "1561247277.921159000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-65182508431ac2c3e3ca86e3",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 3731,
          "timestamp_epoch": "1561247277.921576000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-811dc69fd737e67c3969da11",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 3743,
          "timestamp_epoch": "1561247284.322190000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-74751fce3c8cc46655eab156",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 3756,
          "timestamp_epoch": "1561247285.080013000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-6ec41e561d9f65ac2c698a06",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 3763,
          "timestamp_epoch": "1561247285.845228000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-1f1a0e1c2f6c6c34acf16378",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 3885,
          "timestamp_epoch": "1561247289.916076000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-84f0501485e0d403d88d0d37",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 3886,
          "timestamp_epoch": "1561247289.916326000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.6",
          "fields": {
            "eth.dst": "00:26:b9:30:5c:aa",
            "eth.src": "78:2b:cb:d4:a5:fe"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-7f8ef2340f5cd2ca96152108",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 3887,
          "timestamp_epoch": "1561247289.916502000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.109",
          "fields": {
            "eth.dst": "78:2b:cb:d4:a5:fe",
            "eth.src": "00:26:b9:30:5c:aa"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-e03e23d4369bfcb76ed1b853",
          "src_port": null,
          "tcp_stream": 123,
          "udp_stream": null,
          "frame_number": 3888,
          "timestamp_epoch": "1561247289.916678000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-a89a2dfe584364eba2d40006",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 4885,
          "timestamp_epoch": "1561247302.512305000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-bdd37d5a97adf3c41a238490",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 4895,
          "timestamp_epoch": "1561247303.269332000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-dbcc8e555e4a4a3a674d2681",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 4902,
          "timestamp_epoch": "1561247304.034205000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-3c05864f630d40fd44de63af",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 4903,
          "timestamp_epoch": "1561247307.626592000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-ceac5bfb7a6d8e0ee3d6a61e",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 4915,
          "timestamp_epoch": "1561247308.386163000"
        },
        {
          "kind": "identity",
          "dst_ip": "10.0.76.255",
          "fields": {
            "eth.dst": "ff:ff:ff:ff:ff:ff",
            "eth.src": "78:2b:cb:d4:a5:fe",
            "nbns.name": "WPAD<00>",
            "nbns.flags.opcode": "0",
            "nbns.flags.response": "False"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-5e76319cccc343ad3785058a",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": 33,
          "frame_number": 5205,
          "timestamp_epoch": "1561247309.150698000"
        }
      ],
      "http_request": [
        {
          "kind": "http_request",
          "dst_ip": "23.63.249.186",
          "fields": {
            "http.host": "www.msftncsi.com",
            "http.user_agent": "Microsoft NCSI",
            "http.request.uri": "/ncsi.txt",
            "http.response_in": "433",
            "http.request.method": "GET",
            "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-7b2785f048ebbace8d066258",
          "src_port": 49183,
          "tcp_stream": 30,
          "udp_stream": null,
          "frame_number": 431,
          "timestamp_epoch": "1561247198.038003000"
        },
        {
          "kind": "http_request",
          "dst_ip": "23.63.249.144",
          "fields": {
            "http.host": "www.msftncsi.com",
            "http.user_agent": "Microsoft NCSI",
            "http.request.uri": "/ncsi.txt",
            "http.response_in": "961",
            "http.request.method": "GET",
            "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 80,
          "event_id": "evt-0aebf30056d3c9766d793cde",
          "src_port": 49183,
          "tcp_stream": 80,
          "udp_stream": null,
          "frame_number": 959,
          "timestamp_epoch": "1561247230.191542000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/story-anatomy-beef-cattle-154-104357",
            "http.response_in": "1449",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/story-anatomy-beef-cattle-154-104357"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-17bab954ef75b4e81ab27d45",
          "src_port": 49201,
          "tcp_stream": 138,
          "udp_stream": null,
          "frame_number": 1403,
          "timestamp_epoch": "1561247260.782613000"
        },
        {
          "kind": "http_request",
          "dst_ip": "172.217.164.74",
          "fields": {
            "http.host": "ajax.googleapis.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/ajax/libs/jquery/1.12.4/jquery.min.js",
            "http.response_in": "1524",
            "http.request.method": "GET",
            "http.request.full_uri": "http://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-920aa57e9ff0346838b817c1",
          "src_port": 49203,
          "tcp_stream": 140,
          "udp_stream": null,
          "frame_number": 1462,
          "timestamp_epoch": "1561247261.361127000"
        },
        {
          "kind": "http_request",
          "dst_ip": "172.217.2.34",
          "fields": {
            "http.host": "www.googleadservices.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/pagead/conversion_async.js",
            "http.response_in": "1734",
            "http.request.method": "GET",
            "http.request.full_uri": "http://www.googleadservices.com/pagead/conversion_async.js"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-ac2a7fd843a6cf3547b4f978",
          "src_port": 49211,
          "tcp_stream": 148,
          "udp_stream": null,
          "frame_number": 1720,
          "timestamp_epoch": "1561247261.881869000"
        },
        {
          "kind": "http_request",
          "dst_ip": "74.125.138.138",
          "fields": {
            "http.host": "www.google-analytics.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/ga.js",
            "http.response_in": "1809",
            "http.request.method": "GET",
            "http.request.full_uri": "http://www.google-analytics.com/ga.js"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-f9c85bfe48dba322ee08306b",
          "src_port": 49215,
          "tcp_stream": 152,
          "udp_stream": null,
          "frame_number": 1781,
          "timestamp_epoch": "1561247262.327050000"
        },
        {
          "kind": "http_request",
          "dst_ip": "74.125.138.138",
          "fields": {
            "http.host": "www.google-analytics.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/__utm.gif?utmwv=5.7.2&utms=3&utmn=2054411788&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853867&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
            "http.response_in": "1815",
            "http.request.method": "GET",
            "http.request.full_uri": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=3&utmn=2054411788&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853867&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-3650770d47ca9c2fa8177f5f",
          "src_port": 49215,
          "tcp_stream": 152,
          "udp_stream": null,
          "frame_number": 1811,
          "timestamp_epoch": "1561247262.637770000"
        },
        {
          "kind": "http_request",
          "dst_ip": "74.125.138.138",
          "fields": {
            "http.host": "www.google-analytics.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/__utm.gif?utmwv=5.7.2&utms=4&utmn=1186798248&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853872&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
            "http.response_in": "1817",
            "http.request.method": "GET",
            "http.request.full_uri": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=4&utmn=1186798248&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853872&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-f3749a98adfc707610fef651",
          "src_port": 49216,
          "tcp_stream": 153,
          "udp_stream": null,
          "frame_number": 1813,
          "timestamp_epoch": "1561247262.641599000"
        },
        {
          "kind": "http_request",
          "dst_ip": "31.13.65.7",
          "fields": {
            "http.host": "connect.facebook.net",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/en_US/all.js",
            "http.response_in": "1851",
            "http.request.method": "GET",
            "http.request.full_uri": "http://connect.facebook.net/en_US/all.js"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-8f4bb295c852d5926ff1ca88",
          "src_port": 49219,
          "tcp_stream": 156,
          "udp_stream": null,
          "frame_number": 1836,
          "timestamp_epoch": "1561247262.717994000"
        },
        {
          "kind": "http_request",
          "dst_ip": "74.125.136.102",
          "fields": {
            "http.host": "cse.google.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/adsense/search/async-ads.js",
            "http.response_in": "2787",
            "http.request.method": "GET",
            "http.request.full_uri": "http://cse.google.com/adsense/search/async-ads.js"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-f7e44e8afc20399f571d5ecc",
          "src_port": 49231,
          "tcp_stream": 169,
          "udp_stream": null,
          "frame_number": 2649,
          "timestamp_epoch": "1561247263.809346000"
        },
        {
          "kind": "http_request",
          "dst_ip": "74.125.136.101",
          "fields": {
            "http.host": "clients1.google.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/generate_204",
            "http.response_in": "2800",
            "http.request.method": "GET",
            "http.request.full_uri": "http://clients1.google.com/generate_204"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-348c1bf9be3e91ce204db516",
          "src_port": 49234,
          "tcp_stream": 172,
          "udp_stream": null,
          "frame_number": 2789,
          "timestamp_epoch": "1561247263.972756000"
        },
        {
          "kind": "http_request",
          "dst_ip": "13.107.21.200",
          "fields": {
            "http.host": "www.bing.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/favicon.ico",
            "http.response_in": "3190",
            "http.request.method": "GET",
            "http.request.full_uri": "http://www.bing.com/favicon.ico"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-80c72034ee28dcc630e0f09f",
          "src_port": 49246,
          "tcp_stream": 183,
          "udp_stream": null,
          "frame_number": 3186,
          "timestamp_epoch": "1561247265.487488000"
        },
        {
          "kind": "http_request",
          "dst_ip": "91.235.129.60",
          "fields": {
            "http.host": "letsdoitquick.site",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/",
            "http.response_in": "3752",
            "http.request.method": "GET",
            "http.request.full_uri": "http://letsdoitquick.site/"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 80,
          "event_id": "evt-66dadbb6dc8f4bbb22f409d8",
          "src_port": 49201,
          "tcp_stream": 199,
          "udp_stream": null,
          "frame_number": 3750,
          "timestamp_epoch": "1561247284.617933000"
        },
        {
          "kind": "http_request",
          "dst_ip": "37.46.135.170",
          "fields": {
            "http.host": "37.46.135.170",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/?MTQwMjg3&ZqHoAiAzR&ff5sdfds=xXjQMvWUbRXQDJ3EKvPcT6NMMVHRFUCL2YedmrHZefjac1WkzrvFTF_7ozKATQSG6_ptdfJ&ZJull=known&ClGaW=known&PETxiFG=community&sMRo=wrapped&HuUMPiKpj=heartfelt&LfBYp=criticized&trlQvmgW=wrapped&t4tsdfsg4=WDQCwhBfTcwJom9xbAw4b8futjEnVzkCb1p6H-hGPYwNDrcSdRuVo31ykxrkkQPshg1TH4GI&QVQi=detonator&scUJaJdNW=golfer&eaqBiV=referred&eunX=heartfelt&lTfNSvPso=wrapped&cuxKdC=constitution&TGbNZdI=known&YAVpMLL=difference&KcBDoegcFMTU1OTU1",
            "http.response_in": "3840",
            "http.request.method": "GET",
            "http.request.full_uri": "http://37.46.135.170/?MTQwMjg3&ZqHoAiAzR&ff5sdfds=xXjQMvWUbRXQDJ3EKvPcT6NMMVHRFUCL2YedmrHZefjac1WkzrvFTF_7ozKATQSG6_ptdfJ&ZJull=known&ClGaW=known&PETxiFG=community&sMRo=wrapped&HuUMPiKpj=heartfelt&LfBYp=criticized&trlQvmgW=wrapped&t4tsdfsg4=WDQCwhBfTcwJom9xbAw4b8futjEnVzkCb1p6H-hGPYwNDrcSdRuVo31ykxrkkQPshg1TH4GI&QVQi=detonator&scUJaJdNW=golfer&eaqBiV=referred&eunX=heartfelt&lTfNSvPso=wrapped&cuxKdC=constitution&TGbNZdI=known&YAVpMLL=difference&KcBDoegcFMTU1OTU1"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 80,
          "event_id": "evt-8b3e05b02c270f4e991d10c0",
          "src_port": 49204,
          "tcp_stream": 202,
          "udp_stream": null,
          "frame_number": 3761,
          "timestamp_epoch": "1561247285.237383000"
        },
        {
          "kind": "http_request",
          "dst_ip": "37.46.135.170",
          "fields": {
            "http.host": "37.46.135.170",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/?MTg0MzEy&UOViokhlz&aposAqGuAYQhGJO=difference&JhdAxqxZHPMIkeK=difference&dsWGIXdorJRe=detonator&qIHWsvSKCKW=referred&zoZXprPP=known&lbepukXxCTe=vest&WQLDTkVC=heartfelt&hziRqmWCrsMaus=constitution&evkJcGbq=referred&ff5sdfds=w3bQMvXcJxjQFYbGMvzDSKNbNknWHViPxomG9MildZeqZGX_k7vDfF-qoVXcCgWRxfQ&sIusXJLxas=community&DFWEKmZUkxxeB=golfer&t4tsdfsg4=ufOADNQToihfRLwJpzo1fUlIUof-ni0nRyxSa0p7Ur0HeYAMU9qKcELk82VzFjLdTJvs&gSlEAaKzG=criticized&sXTxIOfYGsZL=golfer&qSnbemVoJtsl=criticized&UjrvHHTG=blackmail&bpiAMNrElSNjI0OTM5",
            "http.response_in": "3856",
            "http.request.method": "GET",
            "http.request.full_uri": "http://37.46.135.170/?MTg0MzEy&UOViokhlz&aposAqGuAYQhGJO=difference&JhdAxqxZHPMIkeK=difference&dsWGIXdorJRe=detonator&qIHWsvSKCKW=referred&zoZXprPP=known&lbepukXxCTe=vest&WQLDTkVC=heartfelt&hziRqmWCrsMaus=constitution&evkJcGbq=referred&ff5sdfds=w3bQMvXcJxjQFYbGMvzDSKNbNknWHViPxomG9MildZeqZGX_k7vDfF-qoVXcCgWRxfQ&sIusXJLxas=community&DFWEKmZUkxxeB=golfer&t4tsdfsg4=ufOADNQToihfRLwJpzo1fUlIUof-ni0nRyxSa0p7Ur0HeYAMU9qKcELk82VzFjLdTJvs&gSlEAaKzG=criticized&sXTxIOfYGsZL=golfer&qSnbemVoJtsl=criticized&UjrvHHTG=blackmail&bpiAMNrElSNjI0OTM5"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 80,
          "event_id": "evt-1df1e6c968cae56a753f6f86",
          "src_port": 49203,
          "tcp_stream": 201,
          "udp_stream": null,
          "frame_number": 3842,
          "timestamp_epoch": "1561247287.553767000"
        },
        {
          "kind": "http_request",
          "dst_ip": "37.46.135.170",
          "fields": {
            "http.host": "37.46.135.170",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/favicon.ico",
            "http.response_in": "3872",
            "http.request.method": "GET",
            "http.request.full_uri": "http://37.46.135.170/favicon.ico"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 80,
          "event_id": "evt-58ab712196d11ab929738682",
          "src_port": 49203,
          "tcp_stream": 201,
          "udp_stream": null,
          "frame_number": 3869,
          "timestamp_epoch": "1561247288.688439000"
        },
        {
          "kind": "http_request",
          "dst_ip": "13.107.21.200",
          "fields": {
            "http.host": "www.bing.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/favicon.ico",
            "http.response_in": "3883",
            "http.request.method": "GET",
            "http.request.full_uri": "http://www.bing.com/favicon.ico"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 80,
          "event_id": "evt-10ca0c7bc841eac36e897690",
          "src_port": 49205,
          "tcp_stream": 205,
          "udp_stream": null,
          "frame_number": 3879,
          "timestamp_epoch": "1561247289.412234000"
        },
        {
          "kind": "http_request",
          "dst_ip": "37.46.135.170",
          "fields": {
            "http.host": "37.46.135.170",
            "http.user_agent": "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)",
            "http.request.uri": "/?MzU4NjA0&kaZDWzI&AkwenzFXp=perpetual&EIDOXmpaHLIMQ=blackmail&PmNkusRzUKjdxi=known&embBMhXHEVqMM=already&nvQgwJI=community&PtVAedNAUU=difference&jDCoPDPCLNkpJ=heartfelt&SJjNZIaGHxK=known&vvHefJ=heartfelt&t4tsdfsg4=PAVMb_q6p3EiEnR6U0pGB_xyNZgITqZucEbg_2lT3ybZGJsJ1kx_R6GcBxewtW10Z6AwalanCH6fAnUctFEsxYQ&IJbAFjBSlWY=heartfelt&hyYviEG=criticized&ff5sdfds=xHjQMrnYbRbFFYTfKPPEUKNEMUjWA0-KwYmZhafVF5mxFDHGpbX1FxXspVSdCFSEmvRvdLUHIwSh1U3ASwNizYk&SfDdcBJQLntZc=everyone&ZwddKCJISaTB=blackmail&IqnFgRnJ=known&WWmEHUqy=vest&niUheyKPRbLYEdyNjEwOTgy",
            "http.response_in": "4397",
            "http.request.method": "GET",
            "http.request.full_uri": "http://37.46.135.170/?MzU4NjA0&kaZDWzI&AkwenzFXp=perpetual&EIDOXmpaHLIMQ=blackmail&PmNkusRzUKjdxi=known&embBMhXHEVqMM=already&nvQgwJI=community&PtVAedNAUU=difference&jDCoPDPCLNkpJ=heartfelt&SJjNZIaGHxK=known&vvHefJ=heartfelt&t4tsdfsg4=PAVMb_q6p3EiEnR6U0pGB_xyNZgITqZucEbg_2lT3ybZGJsJ1kx_R6GcBxewtW10Z6AwalanCH6fAnUctFEsxYQ&IJbAFjBSlWY=heartfelt&hyYviEG=criticized&ff5sdfds=xHjQMrnYbRbFFYTfKPPEUKNEMUjWA0-KwYmZhafVF5mxFDHGpbX1FxXspVSdCFSEmvRvdLUHIwSh1U3ASwNizYk&SfDdcBJQLntZc=everyone&ZwddKCJISaTB=blackmail&IqnFgRnJ=known&WWmEHUqy=vest&niUheyKPRbLYEdyNjEwOTgy"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 80,
          "event_id": "evt-b784646530f0781c251414c0",
          "src_port": 49207,
          "tcp_stream": 207,
          "udp_stream": null,
          "frame_number": 3893,
          "timestamp_epoch": "1561247290.335491000"
        },
        {
          "kind": "http_request",
          "dst_ip": "37.46.135.170",
          "fields": {
            "http.host": "37.46.135.170",
            "http.user_agent": "�",
            "http.request.uri": "/?NDk4MTE5&tmCVgJMQbeHjv&znbcjFaUOmZy=vest&aTijcut=blackmail&kBgQawTJSFlOAu=difference&NCThQKrrQh=blackmail&lvQmqFyq=constitution&zCrDVEX=known&wLBVVjhJGAWC=detonator&PLFPhyyqZCa=known&lfJYgkH=perpetual&t4tsdfsg4=YPAVwb_q6p3EaEnRGU0p6B_x2NZgMTqZWcEbk_2lv3ybhGJs11kx_R6GYBxewtUFMT4wMWmKjKHqj58EgwV0sC&nVJnyJYij=vest&eZvTJjAeJ=professional&ISzjHlO=strategy&tAMbBJnq=referred&bwgDFqD=strategy&kdPRkesmuQ=heartfelt&ff5sdfds=xHjQMrbYbRfFFYvfKPzEUKxEMUbWA0GKwYeZhajVF5exFD7Gpbr1FxXspVWdCFWEmvtvdLUHIwuh1UPASwJizY&kxbRJWYrNpZbNlVMzU3NDAz",
            "http.response_in": "4881",
            "http.request.method": "GET",
            "http.request.full_uri": "http://37.46.135.170/?NDk4MTE5&tmCVgJMQbeHjv&znbcjFaUOmZy=vest&aTijcut=blackmail&kBgQawTJSFlOAu=difference&NCThQKrrQh=blackmail&lvQmqFyq=constitution&zCrDVEX=known&wLBVVjhJGAWC=detonator&PLFPhyyqZCa=known&lfJYgkH=perpetual&t4tsdfsg4=YPAVwb_q6p3EaEnRGU0p6B_x2NZgMTqZWcEbk_2lv3ybhGJs11kx_R6GYBxewtUFMT4wMWmKjKHqj58EgwV0sC&nVJnyJYij=vest&eZvTJjAeJ=professional&ISzjHlO=strategy&tAMbBJnq=referred&bwgDFqD=strategy&kdPRkesmuQ=heartfelt&ff5sdfds=xHjQMrbYbRfFFYvfKPzEUKxEMUbWA0GKwYeZhajVF5exFD7Gpbr1FxXspVWdCFWEmvtvdLUHIwuh1UPASwJizY&kxbRJWYrNpZbNlVMzU3NDAz"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 80,
          "event_id": "evt-5749d57ef407243874c298d6",
          "src_port": 49208,
          "tcp_stream": 210,
          "udp_stream": null,
          "frame_number": 4417,
          "timestamp_epoch": "1561247296.354584000"
        },
        {
          "kind": "http_request",
          "dst_ip": "8.209.83.76",
          "fields": {
            "http.host": "fghjkmgru34.site",
            "http.request.uri": "/gQBljYzDJBnrt4JX/gate.php",
            "http.response_in": "4896",
            "http.request.method": "GET",
            "http.request.full_uri": "http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 80,
          "event_id": "evt-c5881c8fe01051cb0057ddb0",
          "src_port": 49209,
          "tcp_stream": 211,
          "udp_stream": null,
          "frame_number": 4893,
          "timestamp_epoch": "1561247303.076396000"
        },
        {
          "kind": "http_request",
          "dst_ip": "8.209.83.76",
          "fields": {
            "http.host": "fghjkmgru34.site",
            "http.request.uri": "/gQBljYzDJBnrt4JX/gate.php",
            "http.response_in": "4909",
            "http.request.method": "GET",
            "http.request.full_uri": "http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 80,
          "event_id": "evt-03946ac3ee99a2f8ccbc13dd",
          "src_port": 49210,
          "tcp_stream": 212,
          "udp_stream": null,
          "frame_number": 4907,
          "timestamp_epoch": "1561247307.815439000"
        },
        {
          "kind": "http_request",
          "dst_ip": "8.209.83.76",
          "fields": {
            "http.host": "fghjkmgru34.site",
            "http.request.uri": "/gQBljYzDJBnrt4JX/gate.php",
            "http.response_in": "5898",
            "http.content_length": "346854",
            "http.request.method": "POST",
            "http.request.full_uri": "http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 80,
          "event_id": "evt-8564e428946245ea4069595f",
          "src_port": 49211,
          "tcp_stream": 213,
          "udp_stream": null,
          "frame_number": 5364,
          "timestamp_epoch": "1561247309.386333000"
        },
        {
          "kind": "http_request",
          "dst_ip": "8.209.83.76",
          "fields": {
            "http.host": "fghjkmgru34.site",
            "http.request.uri": "/gQBljYzDJBnrt4JX/gate.php",
            "http.response_in": "5908",
            "http.content_length": "347545",
            "http.request.method": "POST",
            "http.request.full_uri": "http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 80,
          "event_id": "evt-93e9a0ffc9235a94a06dbc3a",
          "src_port": 49212,
          "tcp_stream": 214,
          "udp_stream": null,
          "frame_number": 5852,
          "timestamp_epoch": "1561247310.208061000"
        },
        {
          "kind": "http_request",
          "dst_ip": "239.255.255.250",
          "fields": {
            "http.host": "239.255.255.250:1900",
            "http.request.uri": "*",
            "http.request.method": "M-SEARCH",
            "http.request.full_uri": "http://239.255.255.250:1900*"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-fcb1602f8755a51da4518c80",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": null,
          "frame_number": 5905,
          "timestamp_epoch": "1561247311.213862000"
        },
        {
          "kind": "http_request",
          "dst_ip": "239.255.255.250",
          "fields": {
            "http.host": "239.255.255.250:1900",
            "http.request.uri": "*",
            "http.request.method": "M-SEARCH",
            "http.request.full_uri": "http://239.255.255.250:1900*"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-34bde94de4ea67a4acb2259d",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": null,
          "frame_number": 5907,
          "timestamp_epoch": "1561247311.549851000"
        },
        {
          "kind": "http_request",
          "dst_ip": "239.255.255.250",
          "fields": {
            "http.host": "239.255.255.250:1900",
            "http.request.uri": "*",
            "http.request.method": "M-SEARCH",
            "http.request.full_uri": "http://239.255.255.250:1900*"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-40eac178349840dd6551e180",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": null,
          "frame_number": 5989,
          "timestamp_epoch": "1561247314.225235000"
        },
        {
          "kind": "http_request",
          "dst_ip": "239.255.255.250",
          "fields": {
            "http.host": "239.255.255.250:1900",
            "http.request.uri": "*",
            "http.request.method": "M-SEARCH",
            "http.request.full_uri": "http://239.255.255.250:1900*"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-84e4092ffecd7c83a34bc5a9",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": null,
          "frame_number": 6002,
          "timestamp_epoch": "1561247314.553386000"
        },
        {
          "kind": "http_request",
          "dst_ip": "239.255.255.250",
          "fields": {
            "http.host": "239.255.255.250:1900",
            "http.request.uri": "*",
            "http.request.method": "M-SEARCH",
            "http.request.full_uri": "http://239.255.255.250:1900*"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-f58a5af874145e7aec9367e4",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": null,
          "frame_number": 6003,
          "timestamp_epoch": "1561247317.235836000"
        },
        {
          "kind": "http_request",
          "dst_ip": "239.255.255.250",
          "fields": {
            "http.host": "239.255.255.250:1900",
            "http.request.uri": "*",
            "http.request.method": "M-SEARCH",
            "http.request.full_uri": "http://239.255.255.250:1900*"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-6bfec8c9883ead6c6f6d40ac",
          "src_port": null,
          "tcp_stream": null,
          "udp_stream": null,
          "frame_number": 6004,
          "timestamp_epoch": "1561247317.564933000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/markets",
            "http.response_in": "6313",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/markets"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-48cb2e8ff757445b383236cb",
          "src_port": 49261,
          "tcp_stream": 227,
          "udp_stream": null,
          "frame_number": 6268,
          "timestamp_epoch": "1561247390.600547000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/style/templates/page/markets.css?v=1",
            "http.response_in": "6358",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/style/templates/page/markets.css?v=1"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-2d3becf4198e1bf2e25cf032",
          "src_port": 49260,
          "tcp_stream": 226,
          "udp_stream": null,
          "frame_number": 6286,
          "timestamp_epoch": "1561247391.280854000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/style/marketsResponsiveNoSidebar.css",
            "http.response_in": "6363",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/style/marketsResponsiveNoSidebar.css"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-f0635507c9d95de862685e83",
          "src_port": 49262,
          "tcp_stream": 228,
          "udp_stream": null,
          "frame_number": 6317,
          "timestamp_epoch": "1561247391.481400000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/scripts/bootstrap.js",
            "http.response_in": "6470",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/scripts/bootstrap.js"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-d0644fbd912eb80fc41f2ebe",
          "src_port": 49261,
          "tcp_stream": 227,
          "udp_stream": null,
          "frame_number": 6343,
          "timestamp_epoch": "1561247391.619220000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/scripts/jquery.selectbox-0.2.js",
            "http.response_in": "6514",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/scripts/jquery.selectbox-0.2.js"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-b5e37fed0e5c322649dcb24d",
          "src_port": 49260,
          "tcp_stream": 226,
          "udp_stream": null,
          "frame_number": 6367,
          "timestamp_epoch": "1561247391.999359000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/style/templates/controls/tabbedQuotesResponsive.css?v=2",
            "http.response_in": "6495",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/style/templates/controls/tabbedQuotesResponsive.css?v=2"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-377886962b6f4b7dc594922e",
          "src_port": 49262,
          "tcp_stream": 228,
          "udp_stream": null,
          "frame_number": 6369,
          "timestamp_epoch": "1561247391.999939000"
        },
        {
          "kind": "http_request",
          "dst_ip": "74.125.138.138",
          "fields": {
            "http.host": "www.google-analytics.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/__utm.gif?utmwv=5.7.2&utms=5&utmn=1173868244&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982849&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
            "http.response_in": "6389",
            "http.request.method": "GET",
            "http.request.full_uri": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=5&utmn=1173868244&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982849&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-022b1cc4adf269e0656aa4ef",
          "src_port": 49266,
          "tcp_stream": 232,
          "udp_stream": null,
          "frame_number": 6375,
          "timestamp_epoch": "1561247392.006900000"
        },
        {
          "kind": "http_request",
          "dst_ip": "74.125.138.138",
          "fields": {
            "http.host": "www.google-analytics.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/__utm.gif?utmwv=5.7.2&utms=6&utmn=1716294095&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982853&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
            "http.response_in": "6394",
            "http.request.method": "GET",
            "http.request.full_uri": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=6&utmn=1716294095&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982853&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-7855563508fba9f04bbcedc7",
          "src_port": 49265,
          "tcp_stream": 231,
          "udp_stream": null,
          "frame_number": 6379,
          "timestamp_epoch": "1561247392.007298000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/scripts/amcharts/amcharts.js",
            "http.response_in": "6807",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/scripts/amcharts/amcharts.js"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-fe0cc91145355a52e8292b82",
          "src_port": 49268,
          "tcp_stream": 234,
          "udp_stream": null,
          "frame_number": 6432,
          "timestamp_epoch": "1561247392.034702000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "portal.farmcentric.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/images/pointerup.png",
            "http.response_in": "6565",
            "http.request.method": "GET",
            "http.request.full_uri": "http://portal.farmcentric.com/images/pointerup.png"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-89b5863afce82d9299524a7b",
          "src_port": 49270,
          "tcp_stream": 236,
          "udp_stream": null,
          "frame_number": 6434,
          "timestamp_epoch": "1561247392.034821000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "portal.farmcentric.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/images/arrow-down-large.png",
            "http.response_in": "6567",
            "http.request.method": "GET",
            "http.request.full_uri": "http://portal.farmcentric.com/images/arrow-down-large.png"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-d9f4189b98594db6afc5fc3c",
          "src_port": 49271,
          "tcp_stream": 237,
          "udp_stream": null,
          "frame_number": 6442,
          "timestamp_epoch": "1561247392.036635000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/scripts/amcharts/serial.js",
            "http.response_in": "6560",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/scripts/amcharts/serial.js"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-bf18b631bab5c25f776c171e",
          "src_port": 49261,
          "tcp_stream": 227,
          "udp_stream": null,
          "frame_number": 6475,
          "timestamp_epoch": "1561247392.064267000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/scripts/amcharts/themes/light.js",
            "http.response_in": "6562",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/scripts/amcharts/themes/light.js"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-40258247ff818aff15d293aa",
          "src_port": 49262,
          "tcp_stream": 228,
          "udp_stream": null,
          "frame_number": 6497,
          "timestamp_epoch": "1561247392.075452000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/images/options.png",
            "http.response_in": "6582",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/images/options.png"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-5128ed2ef09780ad4ffd4ce6",
          "src_port": 49260,
          "tcp_stream": 226,
          "udp_stream": null,
          "frame_number": 6520,
          "timestamp_epoch": "1561247392.085467000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/images/clear.gif",
            "http.response_in": "6692",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/images/clear.gif"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-2a529dae6e6ac1b5e99cc2bc",
          "src_port": 49261,
          "tcp_stream": 227,
          "udp_stream": null,
          "frame_number": 6600,
          "timestamp_epoch": "1561247392.525706000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/style/templates/images/chgDnArrow.png",
            "http.response_in": "6988",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/style/templates/images/chgDnArrow.png"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-ba71f62bdee683aba9a126e1",
          "src_port": 49268,
          "tcp_stream": 234,
          "udp_stream": null,
          "frame_number": 6852,
          "timestamp_epoch": "1561247393.347532000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/style/templates/images/chgUpArrow.png",
            "http.response_in": "6985",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/style/templates/images/chgUpArrow.png"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-10b0315e633e61ec2dc2ba2c",
          "src_port": 49261,
          "tcp_stream": 227,
          "udp_stream": null,
          "frame_number": 6854,
          "timestamp_epoch": "1561247393.347726000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/images/selectbox-sprite.png",
            "http.response_in": "6983",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/images/selectbox-sprite.png"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-c8b922194a7356be87a56159",
          "src_port": 49260,
          "tcp_stream": 226,
          "udp_stream": null,
          "frame_number": 6860,
          "timestamp_epoch": "1561247393.479635000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/scripts/jquery-ui/images/ui-bg_flat_75_ffffff_40x100.png",
            "http.response_in": "6986",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/scripts/jquery-ui/images/ui-bg_flat_75_ffffff_40x100.png"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-02971d43e0db3df970914311",
          "src_port": 49262,
          "tcp_stream": 228,
          "udp_stream": null,
          "frame_number": 6862,
          "timestamp_epoch": "1561247393.479843000"
        },
        {
          "kind": "http_request",
          "dst_ip": "74.125.136.101",
          "fields": {
            "http.host": "clients1.google.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/generate_204",
            "http.response_in": "6971",
            "http.request.method": "GET",
            "http.request.full_uri": "http://clients1.google.com/generate_204"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-a219e212b8035b842637785f",
          "src_port": 49288,
          "tcp_stream": 254,
          "udp_stream": null,
          "frame_number": 6941,
          "timestamp_epoch": "1561247393.604635000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/scripts/jquery-ui/images/ui-bg_highlight-soft_75_cccccc_1x100.png",
            "http.response_in": "7026",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/scripts/jquery-ui/images/ui-bg_highlight-soft_75_cccccc_1x100.png"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-139ac23baaa9fa528d7bc95e",
          "src_port": 49290,
          "tcp_stream": 256,
          "udp_stream": null,
          "frame_number": 6979,
          "timestamp_epoch": "1561247393.631042000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/scripts/jquery-ui/images/ui-icons_222222_256x240.png",
            "http.response_in": "7037",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/scripts/jquery-ui/images/ui-icons_222222_256x240.png"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-58a3d02b17546af2c67b0487",
          "src_port": 49262,
          "tcp_stream": 228,
          "udp_stream": null,
          "frame_number": 6996,
          "timestamp_epoch": "1561247393.644758000"
        },
        {
          "kind": "http_request",
          "dst_ip": "35.226.156.55",
          "fields": {
            "http.host": "beef2live.com",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
            "http.request.uri": "/scripts/jquery-ui/images/ui-bg_glass_75_e6e6e6_1x400.png",
            "http.response_in": "7028",
            "http.request.method": "GET",
            "http.request.full_uri": "http://beef2live.com/scripts/jquery-ui/images/ui-bg_glass_75_e6e6e6_1x400.png"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 80,
          "event_id": "evt-4a22b0def321dc8c3d7b1be8",
          "src_port": 49291,
          "tcp_stream": 257,
          "udp_stream": null,
          "frame_number": 6998,
          "timestamp_epoch": "1561247393.644968000"
        }
      ],
      "http_response": [
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "431",
            "http.content_type": "text/plain",
            "http.response.code": "200",
            "http.content_length": "14"
          },
          "src_ip": "23.63.249.186",
          "dst_port": 49183,
          "event_id": "evt-b37294794f13fa8b26e07454",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012",
          "frame_number": 433,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 14,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 14,
          "timestamp_epoch": "1561247198.049981000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.109",
          "fields": {
            "http.request_in": "959",
            "http.content_type": "text/plain",
            "http.response.code": "200",
            "http.content_length": "14"
          },
          "src_ip": "23.63.249.144",
          "dst_port": 49183,
          "event_id": "evt-40b5bff5cccddf06143c808b",
          "src_port": 80,
          "tcp_stream": 80,
          "udp_stream": null,
          "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012",
          "frame_number": 961,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 14,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 14,
          "timestamp_epoch": "1561247230.201225000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "1403",
            "http.content_type": "text/html; charset=utf-8",
            "http.response.code": "200",
            "http.content_encoding": "gzip",
            "http.transfer_encoding": "chunked"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49201,
          "event_id": "evt-d421b5f3e7e9fa6829a8daca",
          "src_port": 80,
          "tcp_stream": 138,
          "udp_stream": null,
          "body_sha256": "3103a01f90e95eef3300a895ab3411575325e0d2a1a4807e2fb5ae8e6f110f99",
          "frame_number": 1449,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 117009,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 117009,
          "timestamp_epoch": "1561247261.232626000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "1462",
            "http.content_type": "text/javascript; charset=UTF-8",
            "http.response.code": "200",
            "http.content_length": "33951",
            "http.content_encoding": "gzip"
          },
          "src_ip": "172.217.164.74",
          "dst_port": 49203,
          "event_id": "evt-35f88a888015053412437816",
          "src_port": 80,
          "tcp_stream": 140,
          "udp_stream": null,
          "body_sha256": "668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404",
          "frame_number": 1524,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 97163,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 97163,
          "timestamp_epoch": "1561247261.424777000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "1720",
            "http.content_type": "text/javascript; charset=UTF-8",
            "http.response.code": "200",
            "http.content_length": "8916",
            "http.content_encoding": "gzip"
          },
          "src_ip": "172.217.2.34",
          "dst_port": 49211,
          "event_id": "evt-f383a1c40971f3da99d74aef",
          "src_port": 80,
          "tcp_stream": 148,
          "udp_stream": null,
          "body_sha256": "cc900a14f6b6e17c5299c3f619b98ac2048780932d3b409cc9c5be79db70d15a",
          "frame_number": 1734,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23681,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23681,
          "timestamp_epoch": "1561247261.913335000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "1781",
            "http.content_type": "text/javascript",
            "http.response.code": "200",
            "http.content_length": "17168",
            "http.content_encoding": "gzip"
          },
          "src_ip": "74.125.138.138",
          "dst_port": 49215,
          "event_id": "evt-29c6798a8c9a2361a776fdfb",
          "src_port": 80,
          "tcp_stream": 152,
          "udp_stream": null,
          "body_sha256": "1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f",
          "frame_number": 1809,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 46274,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 46274,
          "timestamp_epoch": "1561247262.362620000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "1811",
            "http.content_type": "image/gif",
            "http.response.code": "200",
            "http.content_length": "35"
          },
          "src_ip": "74.125.138.138",
          "dst_port": 49215,
          "event_id": "evt-74cb3dcb6fc4a2794311d8ab",
          "src_port": 80,
          "tcp_stream": 152,
          "udp_stream": null,
          "body_sha256": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015",
          "frame_number": 1815,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 35,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 35,
          "timestamp_epoch": "1561247262.652951000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "1813",
            "http.content_type": "image/gif",
            "http.response.code": "200",
            "http.content_length": "35"
          },
          "src_ip": "74.125.138.138",
          "dst_port": 49216,
          "event_id": "evt-55c061a61e0f280bd605c369",
          "src_port": 80,
          "tcp_stream": 153,
          "udp_stream": null,
          "body_sha256": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015",
          "frame_number": 1817,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 35,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 35,
          "timestamp_epoch": "1561247262.654993000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "1836",
            "http.content_type": "application/x-javascript; charset=utf-8",
            "http.response.code": "200",
            "http.content_length": "1781",
            "http.content_encoding": "gzip"
          },
          "src_ip": "31.13.65.7",
          "dst_port": 49219,
          "event_id": "evt-e242c737dc5a0e9d192b2e8c",
          "src_port": 80,
          "tcp_stream": 156,
          "udp_stream": null,
          "body_sha256": "63386b64f7d940f3864917cd9dc6443500ae82f0c717e7a82bec5b7b80361393",
          "frame_number": 1851,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 3224,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 3224,
          "timestamp_epoch": "1561247262.733092000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "2649",
            "http.content_type": "text/javascript; charset=UTF-8",
            "http.response.code": "200",
            "http.content_encoding": "gzip",
            "http.transfer_encoding": "chunked"
          },
          "src_ip": "74.125.136.102",
          "dst_port": 49231,
          "event_id": "evt-beba3efa635d204190ffbfd5",
          "src_port": 80,
          "tcp_stream": 169,
          "udp_stream": null,
          "body_sha256": "c1f5379165637b2d8c5dea37642242e5aae279d5e2b4b2a00bc2a1f6463f02de",
          "frame_number": 2787,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 170211,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 170211,
          "timestamp_epoch": "1561247263.967936000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "2789",
            "http.response.code": "204",
            "http.content_length": "0"
          },
          "src_ip": "74.125.136.101",
          "dst_port": 49234,
          "event_id": "evt-e6822047914af404ebde24df",
          "src_port": 80,
          "tcp_stream": 172,
          "udp_stream": null,
          "frame_number": 2800,
          "timestamp_epoch": "1561247263.985392000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "3186",
            "http.content_type": "image/x-icon",
            "http.response.code": "200",
            "http.content_length": "237"
          },
          "src_ip": "13.107.21.200",
          "dst_port": 49246,
          "event_id": "evt-20c7100f065c4e5f2c7cdb03",
          "src_port": 80,
          "tcp_stream": 183,
          "udp_stream": null,
          "body_sha256": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914",
          "frame_number": 3190,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 237,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 237,
          "timestamp_epoch": "1561247265.507280000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.109",
          "fields": {
            "http.request_in": "3750",
            "http.content_type": "text/html; charset=utf-8",
            "http.response.code": "302",
            "http.content_length": "0"
          },
          "src_ip": "91.235.129.60",
          "dst_port": 49201,
          "event_id": "evt-d3f9d327a90a698b9944eb07",
          "src_port": 80,
          "tcp_stream": 199,
          "udp_stream": null,
          "frame_number": 3752,
          "timestamp_epoch": "1561247284.916981000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.109",
          "fields": {
            "http.request_in": "3761",
            "http.content_type": "text/html;charset=UTF-8",
            "http.response.code": "200",
            "http.content_encoding": "gzip",
            "http.transfer_encoding": "chunked"
          },
          "src_ip": "37.46.135.170",
          "dst_port": 49204,
          "event_id": "evt-7c3218b1328b863f9084dbb5",
          "src_port": 80,
          "tcp_stream": 202,
          "udp_stream": null,
          "body_sha256": "ca5a37a5c3401ffcd1b7c98c3a22a921c013d1121fe33122e94dd81c382bf9b0",
          "frame_number": 3840,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 136566,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 136566,
          "timestamp_epoch": "1561247286.918023000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.109",
          "fields": {
            "http.request_in": "3842",
            "http.content_type": "application/x-shockwave-flash",
            "http.response.code": "200",
            "http.content_length": "9207"
          },
          "src_ip": "37.46.135.170",
          "dst_port": 49203,
          "event_id": "evt-e9806da0608947c09dcfd5d7",
          "src_port": 80,
          "tcp_stream": 201,
          "udp_stream": null,
          "body_sha256": "39bf8220d772efc49f7a8f0709ac8607af17997d38525eacec1448d5317dcf38",
          "frame_number": 3856,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 9207,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 9207,
          "timestamp_epoch": "1561247287.843953000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.109",
          "fields": {
            "http.request_in": "3869",
            "http.content_type": "image/x-icon",
            "http.response.code": "200",
            "http.content_length": "0"
          },
          "src_ip": "37.46.135.170",
          "dst_port": 49203,
          "event_id": "evt-dc6bf39e338f807028aaf85d",
          "src_port": 80,
          "tcp_stream": 201,
          "udp_stream": null,
          "frame_number": 3872,
          "timestamp_epoch": "1561247289.351518000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.109",
          "fields": {
            "http.request_in": "3879",
            "http.content_type": "image/x-icon",
            "http.response.code": "200",
            "http.content_length": "237"
          },
          "src_ip": "13.107.21.200",
          "dst_port": 49205,
          "event_id": "evt-bbe992d62274cf573b25d04c",
          "src_port": 80,
          "tcp_stream": 205,
          "udp_stream": null,
          "body_sha256": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914",
          "frame_number": 3883,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 237,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 237,
          "timestamp_epoch": "1561247289.446572000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.109",
          "fields": {
            "http.request_in": "3893",
            "http.content_type": "application/x-msdownload",
            "http.response.code": "200",
            "http.content_length": "584192"
          },
          "src_ip": "37.46.135.170",
          "dst_port": 49207,
          "event_id": "evt-cd25e447d9ae7d06058c6025",
          "src_port": 80,
          "tcp_stream": 207,
          "udp_stream": null,
          "body_sha256": "4fe572e7d49282f6bb5dde888b8e5d06e8264add26b8aebd6b706b79f11d0893",
          "frame_number": 4397,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": true,
            "identities": [],
            "inspected_bytes": 262144,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 584192,
          "timestamp_epoch": "1561247294.066676000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.109",
          "fields": {
            "http.request_in": "4417",
            "http.content_type": "application/x-msdownload",
            "http.response.code": "200",
            "http.content_length": "584192"
          },
          "src_ip": "37.46.135.170",
          "dst_port": 49208,
          "event_id": "evt-b7f03283274dfc33c8efa639",
          "src_port": 80,
          "tcp_stream": 210,
          "udp_stream": null,
          "body_sha256": "4fe572e7d49282f6bb5dde888b8e5d06e8264add26b8aebd6b706b79f11d0893",
          "frame_number": 4881,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": true,
            "identities": [],
            "inspected_bytes": 262144,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 584192,
          "timestamp_epoch": "1561247299.346917000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.109",
          "fields": {
            "http.request_in": "4893",
            "http.content_type": "text/html; charset=UTF-8",
            "http.response.code": "200",
            "http.transfer_encoding": "chunked"
          },
          "src_ip": "8.209.83.76",
          "dst_port": 49209,
          "event_id": "evt-0291c11944e97677f479e138",
          "src_port": 80,
          "tcp_stream": 211,
          "udp_stream": null,
          "body_sha256": "96d61a66fda99897f47232a1f3d15fe711fee6726c2e976eed42011948d87049",
          "frame_number": 4896,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 340,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 340,
          "timestamp_epoch": "1561247303.511633000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.109",
          "fields": {
            "http.request_in": "4907",
            "http.content_type": "text/html; charset=UTF-8",
            "http.response.code": "200",
            "http.transfer_encoding": "chunked"
          },
          "src_ip": "8.209.83.76",
          "dst_port": 49210,
          "event_id": "evt-f271bb843e3024786b6d8ce9",
          "src_port": 80,
          "tcp_stream": 212,
          "udp_stream": null,
          "body_sha256": "96d61a66fda99897f47232a1f3d15fe711fee6726c2e976eed42011948d87049",
          "frame_number": 4909,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 340,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 340,
          "timestamp_epoch": "1561247308.195361000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.109",
          "fields": {
            "http.request_in": "5364",
            "http.content_type": "text/html; charset=UTF-8",
            "http.response.code": "200",
            "http.content_length": "2"
          },
          "src_ip": "8.209.83.76",
          "dst_port": 49211,
          "event_id": "evt-3547e7513a14d59e099a5278",
          "src_port": 80,
          "tcp_stream": 213,
          "udp_stream": null,
          "body_sha256": "565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3",
          "frame_number": 5898,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 2,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 2,
          "timestamp_epoch": "1561247311.114840000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.109",
          "fields": {
            "http.request_in": "5852",
            "http.content_type": "text/html; charset=UTF-8",
            "http.response.code": "200",
            "http.content_length": "2"
          },
          "src_ip": "8.209.83.76",
          "dst_port": 49212,
          "event_id": "evt-5ec0671c488a6a561675e95a",
          "src_port": 80,
          "tcp_stream": 214,
          "udp_stream": null,
          "body_sha256": "565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3",
          "frame_number": 5908,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 2,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 2,
          "timestamp_epoch": "1561247311.862856000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6268",
            "http.content_type": "text/html; charset=utf-8",
            "http.response.code": "200",
            "http.content_encoding": "gzip",
            "http.transfer_encoding": "chunked"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49261,
          "event_id": "evt-5cd6e80b1dca4d996d6a236e",
          "src_port": 80,
          "tcp_stream": 227,
          "udp_stream": null,
          "body_sha256": "13163ed737fd61106e44f7078caebe16df4549bc45b39c8928a956f987690fee",
          "frame_number": 6313,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 203254,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 203254,
          "timestamp_epoch": "1561247391.480847000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6286",
            "http.content_type": "text/css",
            "http.response.code": "200",
            "http.content_encoding": "gzip",
            "http.transfer_encoding": "chunked"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49260,
          "event_id": "evt-1f1c936d4459c228111a0e57",
          "src_port": 80,
          "tcp_stream": 226,
          "udp_stream": null,
          "body_sha256": "9a392fadea3ef641a75223fba61b5bc5c4d21c231360fe25d12218288d65ef0d",
          "frame_number": 6358,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23171,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23171,
          "timestamp_epoch": "1561247391.997128000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6317",
            "http.content_type": "text/css",
            "http.response.code": "200",
            "http.content_encoding": "gzip",
            "http.transfer_encoding": "chunked"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49262,
          "event_id": "evt-1637b68de652f06f0f5cbad5",
          "src_port": 80,
          "tcp_stream": 228,
          "udp_stream": null,
          "body_sha256": "dd4da68f83df075213351c713fa2067594e9ff7a402de406d3fe20f0c2a2f47e",
          "frame_number": 6363,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 27596,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 27596,
          "timestamp_epoch": "1561247391.997255000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6375",
            "http.content_type": "image/gif",
            "http.response.code": "200",
            "http.content_length": "35"
          },
          "src_ip": "74.125.138.138",
          "dst_port": 49266,
          "event_id": "evt-50b25e3aa077a3651556eff3",
          "src_port": 80,
          "tcp_stream": 232,
          "udp_stream": null,
          "body_sha256": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015",
          "frame_number": 6389,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 35,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 35,
          "timestamp_epoch": "1561247392.017412000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6379",
            "http.content_type": "image/gif",
            "http.response.code": "200",
            "http.content_length": "35"
          },
          "src_ip": "74.125.138.138",
          "dst_port": 49265,
          "event_id": "evt-31c415542525648348cb17d8",
          "src_port": 80,
          "tcp_stream": 231,
          "udp_stream": null,
          "body_sha256": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015",
          "frame_number": 6394,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 35,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 35,
          "timestamp_epoch": "1561247392.019387000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6343",
            "http.content_type": "application/javascript",
            "http.response.code": "200",
            "http.content_encoding": "gzip",
            "http.transfer_encoding": "chunked"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49261,
          "event_id": "evt-1066d8415850447883f01386",
          "src_port": 80,
          "tcp_stream": 227,
          "udp_stream": null,
          "body_sha256": "9bb35e2cb32e2507d2294fda6265966fe617d567b20845d53d2667a150b34311",
          "frame_number": 6470,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 60543,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 60543,
          "timestamp_epoch": "1561247392.063687000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6369",
            "http.content_type": "text/css",
            "http.response.code": "200",
            "http.content_encoding": "gzip",
            "http.transfer_encoding": "chunked"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49262,
          "event_id": "evt-3adeaffb407c69c9583b0af7",
          "src_port": 80,
          "tcp_stream": 228,
          "udp_stream": null,
          "body_sha256": "5d3e3d13333f572afe8df9cd7079c23b1049802e277d2cabce0221e2eaddc807",
          "frame_number": 6495,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 8436,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 8436,
          "timestamp_epoch": "1561247392.074770000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6367",
            "http.content_type": "application/javascript",
            "http.response.code": "200",
            "http.content_encoding": "gzip",
            "http.transfer_encoding": "chunked"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49260,
          "event_id": "evt-5027604c66755e9b0f688c67",
          "src_port": 80,
          "tcp_stream": 226,
          "udp_stream": null,
          "body_sha256": "afa93c8baeaf1c28d1c5646ccdc701c636109bbc765549777a6417fa41fb5d6d",
          "frame_number": 6514,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 15200,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 15200,
          "timestamp_epoch": "1561247392.084851000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6475",
            "http.content_type": "application/javascript",
            "http.response.code": "200",
            "http.content_encoding": "gzip",
            "http.transfer_encoding": "chunked"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49261,
          "event_id": "evt-9962c7a2b0563caf2ce03ba0",
          "src_port": 80,
          "tcp_stream": 227,
          "udp_stream": null,
          "body_sha256": "78bcd250cc75ff96fd3f96452b04875ebc3e990f0982f8cb2053c2897a3fde4c",
          "frame_number": 6560,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 29452,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 29452,
          "timestamp_epoch": "1561247392.522006000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6497",
            "http.content_type": "application/javascript",
            "http.response.code": "200",
            "http.content_length": "1142",
            "http.content_encoding": "gzip"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49262,
          "event_id": "evt-85b3d35dc6b959cbe94fcb98",
          "src_port": 80,
          "tcp_stream": 228,
          "udp_stream": null,
          "body_sha256": "a22fdaf4fdff6850730248a8c81a482e2c10bf0f1a5cfb5861dc5893442cf279",
          "frame_number": 6562,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 4148,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 4148,
          "timestamp_epoch": "1561247392.522037000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6434",
            "http.content_type": "image/png",
            "http.response.code": "200",
            "http.content_length": "1134"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49270,
          "event_id": "evt-b991eb320a341783575234a9",
          "src_port": 80,
          "tcp_stream": 236,
          "udp_stream": null,
          "body_sha256": "5ce99a897720a7b57ff1da615b9d99b4eb5035ffcfd036e1de93536b507d4089",
          "frame_number": 6565,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 1134,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 1134,
          "timestamp_epoch": "1561247392.522118000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6442",
            "http.content_type": "image/png",
            "http.response.code": "200",
            "http.content_length": "1251"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49271,
          "event_id": "evt-8d9028a935419c0aceedce43",
          "src_port": 80,
          "tcp_stream": 237,
          "udp_stream": null,
          "body_sha256": "be7a8e1f7fddc3fd63f2540ea7103ba91c47d55c340504f69b286a64823678a0",
          "frame_number": 6567,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 1251,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 1251,
          "timestamp_epoch": "1561247392.522149000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6520",
            "http.content_type": "image/png",
            "http.response.code": "200",
            "http.content_length": "5529"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49260,
          "event_id": "evt-953f20587d4c46b9e646ecbd",
          "src_port": 80,
          "tcp_stream": 226,
          "udp_stream": null,
          "body_sha256": "9bf59058c99ed3af3b2568fa61791e9b31ca2f85a1a0b630e78449f3598fae33",
          "frame_number": 6582,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 5529,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 5529,
          "timestamp_epoch": "1561247392.522478000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6600",
            "http.content_type": "image/gif",
            "http.response.code": "200",
            "http.content_length": "67"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49261,
          "event_id": "evt-816b0afe305f813d78356e05",
          "src_port": 80,
          "tcp_stream": 227,
          "udp_stream": null,
          "body_sha256": "09d46019c7a75b96187202c3c8412182f27c413a9c3661857923dc8e94e91b7b",
          "frame_number": 6692,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 67,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 67,
          "timestamp_epoch": "1561247392.627546000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6432",
            "http.content_type": "application/javascript",
            "http.response.code": "200",
            "http.content_length": "58269",
            "http.content_encoding": "gzip"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49268,
          "event_id": "evt-27ab606a0460312669fee95d",
          "src_port": 80,
          "tcp_stream": 234,
          "udp_stream": null,
          "body_sha256": "6a77c8ea3af1cd0853993af5fa4724dee868e2c9a285eed61f8d0de3753b40ba",
          "frame_number": 6807,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 196326,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 196326,
          "timestamp_epoch": "1561247393.120096000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6941",
            "http.response.code": "204",
            "http.content_length": "0"
          },
          "src_ip": "74.125.136.101",
          "dst_port": 49288,
          "event_id": "evt-3780694a519b8429d684fb6a",
          "src_port": 80,
          "tcp_stream": 254,
          "udp_stream": null,
          "frame_number": 6971,
          "timestamp_epoch": "1561247393.617136000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6860",
            "http.content_type": "image/png",
            "http.response.code": "200",
            "http.content_length": "656"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49260,
          "event_id": "evt-203ed25e92fdc52dff8c4206",
          "src_port": 80,
          "tcp_stream": 226,
          "udp_stream": null,
          "body_sha256": "9ed561402e41c753f32f30917a1b1e50ea12c272f203fae74d1cfee3d091da3a",
          "frame_number": 6983,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 656,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 656,
          "timestamp_epoch": "1561247393.643447000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6854",
            "http.content_type": "image/png",
            "http.response.code": "200",
            "http.content_length": "652"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49261,
          "event_id": "evt-4ae818df50351ec12de0114a",
          "src_port": 80,
          "tcp_stream": 227,
          "udp_stream": null,
          "body_sha256": "6d4ae7517a2914b5de787ebe33efc2915d5872f4d0c5839a0f84149adedb306e",
          "frame_number": 6985,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 652,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 652,
          "timestamp_epoch": "1561247393.643474000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6862",
            "http.content_type": "image/png",
            "http.response.code": "200",
            "http.content_length": "208"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49262,
          "event_id": "evt-0ba894021df795e8acf4b2d9",
          "src_port": 80,
          "tcp_stream": 228,
          "udp_stream": null,
          "body_sha256": "502de2a45dc07ff1b837e168cbe37ca77056804aff81a5a510cecb199fbde654",
          "frame_number": 6986,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 208,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 208,
          "timestamp_epoch": "1561247393.643496000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6852",
            "http.content_type": "image/png",
            "http.response.code": "200",
            "http.content_length": "636"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49268,
          "event_id": "evt-de5e6a35b19243d474304aa0",
          "src_port": 80,
          "tcp_stream": 234,
          "udp_stream": null,
          "body_sha256": "d428b93962535e52f3631fe647be46828868b6a88e2ecb203c706a86919502a0",
          "frame_number": 6988,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 636,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 636,
          "timestamp_epoch": "1561247393.643548000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6979",
            "http.content_type": "image/png",
            "http.response.code": "200",
            "http.content_length": "280"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49290,
          "event_id": "evt-7d79b99eab6b72dda3953248",
          "src_port": 80,
          "tcp_stream": 256,
          "udp_stream": null,
          "body_sha256": "4cfe13f4450dd2250c80995a84e11eff6c3300a17ff3d6518362a2a0696d51da",
          "frame_number": 7026,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 280,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 280,
          "timestamp_epoch": "1561247393.684728000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6998",
            "http.content_type": "image/png",
            "http.response.code": "200",
            "http.content_length": "262"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49291,
          "event_id": "evt-af1704060122d6112f0e6cc0",
          "src_port": 80,
          "tcp_stream": 257,
          "udp_stream": null,
          "body_sha256": "4bbea1dbbdc058cc976c290bc9c0f506c6d175011da6fed42a499db1d2377af3",
          "frame_number": 7028,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 262,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 262,
          "timestamp_epoch": "1561247393.686279000"
        },
        {
          "kind": "http_response",
          "dst_ip": "10.0.76.193",
          "fields": {
            "http.request_in": "6996",
            "http.content_type": "image/png",
            "http.response.code": "200",
            "http.content_length": "6922"
          },
          "src_ip": "35.226.156.55",
          "dst_port": 49262,
          "event_id": "evt-dd291fa700a4bf7cb8282a95",
          "src_port": 80,
          "tcp_stream": 228,
          "udp_stream": null,
          "body_sha256": "3b1ac036763d3a59c88578486ae698d22a37dd2d46a553485e1eabb9fe255b3f",
          "frame_number": 7037,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 6922,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 6922,
          "timestamp_epoch": "1561247393.928875000"
        }
      ],
      "tls_client_hello": [
        {
          "kind": "tls_client_hello",
          "dst_ip": "35.226.156.55",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "portal.farmcentric.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-fead267ef4a865983878338e",
          "src_port": 49207,
          "tcp_stream": 144,
          "udp_stream": null,
          "frame_number": 1530,
          "timestamp_epoch": "1561247261.495740000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "64.233.185.103",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.google.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-495cff636c6b65cb4d94c38b",
          "src_port": 49206,
          "tcp_stream": 143,
          "udp_stream": null,
          "frame_number": 1532,
          "timestamp_epoch": "1561247261.496133000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "64.233.185.103",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.google.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-87927ea67ef4249065bdae8d",
          "src_port": 49205,
          "tcp_stream": 142,
          "udp_stream": null,
          "frame_number": 1534,
          "timestamp_epoch": "1561247261.496408000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "35.226.156.55",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "portal.farmcentric.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-ba007dba323673ae5b474e27",
          "src_port": 49208,
          "tcp_stream": 145,
          "udp_stream": null,
          "frame_number": 1536,
          "timestamp_epoch": "1561247261.496614000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "173.194.219.97",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.googletagmanager.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-f92d905fb4fc72a5d0036270",
          "src_port": 49210,
          "tcp_stream": 147,
          "udp_stream": null,
          "frame_number": 1583,
          "timestamp_epoch": "1561247261.634636000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "173.194.219.97",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.googletagmanager.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-2e86e7ea2d4670af30b8ab19",
          "src_port": 49209,
          "tcp_stream": 146,
          "udp_stream": null,
          "frame_number": 1587,
          "timestamp_epoch": "1561247261.636357000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "173.194.219.156",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-7db906957ef121e08e39e39c",
          "src_port": 49213,
          "tcp_stream": 150,
          "udp_stream": null,
          "frame_number": 1743,
          "timestamp_epoch": "1561247262.221483000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "173.194.219.156",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-8111fe7a7347c2ca57af771f",
          "src_port": 49214,
          "tcp_stream": 151,
          "udp_stream": null,
          "frame_number": 1747,
          "timestamp_epoch": "1561247262.222981000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.7",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "connect.facebook.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-5a5c73e1b5401c60a6a0c07a",
          "src_port": 49217,
          "tcp_stream": 154,
          "udp_stream": null,
          "frame_number": 1827,
          "timestamp_epoch": "1561247262.707143000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.7",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "connect.facebook.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-4436a7739a5a414c3c6b45d4",
          "src_port": 49218,
          "tcp_stream": 155,
          "udp_stream": null,
          "frame_number": 1832,
          "timestamp_epoch": "1561247262.712948000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "72.21.91.66",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "platform.twitter.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-e46eae56573d632d95731378",
          "src_port": 49222,
          "tcp_stream": 159,
          "udp_stream": null,
          "frame_number": 1872,
          "timestamp_epoch": "1561247262.746928000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "72.21.91.66",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "platform.twitter.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-a106700c5c3ec6e5034b30fd",
          "src_port": 49223,
          "tcp_stream": 160,
          "udp_stream": null,
          "frame_number": 1875,
          "timestamp_epoch": "1561247262.747182000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "74.125.136.102",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "cse.google.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-d900fceef0710bd247435715",
          "src_port": 49220,
          "tcp_stream": 157,
          "udp_stream": null,
          "frame_number": 1878,
          "timestamp_epoch": "1561247262.747786000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "74.125.136.102",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "cse.google.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-64d814af85cef2a82f0f5a1f",
          "src_port": 49221,
          "tcp_stream": 158,
          "udp_stream": null,
          "frame_number": 1880,
          "timestamp_epoch": "1561247262.747896000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.7",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "connect.facebook.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-839a56f792c65c79dd7722fe",
          "src_port": 49224,
          "tcp_stream": 161,
          "udp_stream": null,
          "frame_number": 1920,
          "timestamp_epoch": "1561247262.787382000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "35.226.156.55",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "beef2live.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-a8bd8e9b37a874611d4d5e73",
          "src_port": 49225,
          "tcp_stream": 162,
          "udp_stream": null,
          "frame_number": 2035,
          "timestamp_epoch": "1561247262.900779000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "64.233.185.94",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.gstatic.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-fa52dfd16e254308190fc93a",
          "src_port": 49226,
          "tcp_stream": 163,
          "udp_stream": null,
          "frame_number": 2155,
          "timestamp_epoch": "1561247263.133155000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "64.233.185.94",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.gstatic.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-9943ca58b055ca5907270c23",
          "src_port": 49227,
          "tcp_stream": 164,
          "udp_stream": null,
          "frame_number": 2157,
          "timestamp_epoch": "1561247263.133344000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "64.233.185.103",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.google.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-5fa3c080a43887fec32edef3",
          "src_port": 49228,
          "tcp_stream": 165,
          "udp_stream": null,
          "frame_number": 2344,
          "timestamp_epoch": "1561247263.333716000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "172.217.0.74",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.googleapis.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-227116e56da6c4dcfa3a6f1d",
          "src_port": 49232,
          "tcp_stream": 170,
          "udp_stream": null,
          "frame_number": 2653,
          "timestamp_epoch": "1561247263.816326000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "172.217.0.74",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.googleapis.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-1e2b6f5beffa988f8d3530d1",
          "src_port": 49233,
          "tcp_stream": 171,
          "udp_stream": null,
          "frame_number": 2657,
          "timestamp_epoch": "1561247263.817502000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "216.58.193.163",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "fonts.gstatic.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-26deec6819c621720513dacf",
          "src_port": 49237,
          "tcp_stream": 175,
          "udp_stream": null,
          "frame_number": 2839,
          "timestamp_epoch": "1561247264.090457000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "216.58.193.163",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "fonts.gstatic.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-8cb19e1d66964519b5663171",
          "src_port": 49238,
          "tcp_stream": 176,
          "udp_stream": null,
          "frame_number": 2841,
          "timestamp_epoch": "1561247264.090692000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "216.58.193.163",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "fonts.gstatic.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-41abfaa5bde29204239e4b88",
          "src_port": 49236,
          "tcp_stream": 174,
          "udp_stream": null,
          "frame_number": 2843,
          "timestamp_epoch": "1561247264.092729000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "104.244.42.8",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "syndication.twitter.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-07c4781e914129af6b4d1cf5",
          "src_port": 49240,
          "tcp_stream": 178,
          "udp_stream": null,
          "frame_number": 2963,
          "timestamp_epoch": "1561247264.272189000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "104.244.42.8",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "syndication.twitter.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-4f501e25d5855eee7b947c9e",
          "src_port": 49239,
          "tcp_stream": 177,
          "udp_stream": null,
          "frame_number": 2965,
          "timestamp_epoch": "1561247264.272415000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.7",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "staticxx.facebook.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-7fcb90d8dfa5859b9f0f3cf6",
          "src_port": 49230,
          "tcp_stream": 167,
          "udp_stream": null,
          "frame_number": 3049,
          "timestamp_epoch": "1561247264.452287000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "172.217.2.35",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "ssl.gstatic.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-99b829acb39630ee5a5f5e09",
          "src_port": 49241,
          "tcp_stream": 179,
          "udp_stream": null,
          "frame_number": 3108,
          "timestamp_epoch": "1561247264.582974000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "172.217.2.35",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "ssl.gstatic.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-fbef4f06e4d8684620c5b1c9",
          "src_port": 49242,
          "tcp_stream": 180,
          "udp_stream": null,
          "frame_number": 3110,
          "timestamp_epoch": "1561247264.583905000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "64.233.185.155",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "bid.g.doubleclick.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-d81b66cf2e06562cf57d98d1",
          "src_port": 49244,
          "tcp_stream": 182,
          "udp_stream": null,
          "frame_number": 3144,
          "timestamp_epoch": "1561247264.740324000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "64.233.185.155",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "bid.g.doubleclick.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-c2b3f51b2d6805551cbd4450",
          "src_port": 49243,
          "tcp_stream": 181,
          "udp_stream": null,
          "frame_number": 3146,
          "timestamp_epoch": "1561247264.740416000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.7",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "staticxx.facebook.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-89484d7c7062e9b419348a06",
          "src_port": 49229,
          "tcp_stream": 185,
          "udp_stream": null,
          "frame_number": 3201,
          "timestamp_epoch": "1561247266.398278000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.36",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.facebook.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-279a3783c725692c9b8b9ae3",
          "src_port": 49247,
          "tcp_stream": 186,
          "udp_stream": null,
          "frame_number": 3225,
          "timestamp_epoch": "1561247270.223580000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.36",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.facebook.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-a91f88f7f5457b6fa50fbe04",
          "src_port": 49251,
          "tcp_stream": 190,
          "udp_stream": null,
          "frame_number": 3227,
          "timestamp_epoch": "1561247270.223785000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.36",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.facebook.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-829eb180df2bbf0c7d174f4b",
          "src_port": 49249,
          "tcp_stream": 188,
          "udp_stream": null,
          "frame_number": 3230,
          "timestamp_epoch": "1561247270.224180000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.36",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.facebook.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-aab9491395c89535d85694a6",
          "src_port": 49248,
          "tcp_stream": 187,
          "udp_stream": null,
          "frame_number": 3231,
          "timestamp_epoch": "1561247270.224254000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.7",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "static.xx.fbcdn.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-38a3f9532217577c5a17b174",
          "src_port": 49255,
          "tcp_stream": 194,
          "udp_stream": null,
          "frame_number": 3351,
          "timestamp_epoch": "1561247270.468082000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.36",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.facebook.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-88cf7ee6907ba923793345e9",
          "src_port": 49250,
          "tcp_stream": 195,
          "udp_stream": null,
          "frame_number": 3697,
          "timestamp_epoch": "1561247273.219467000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.7",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "static.xx.fbcdn.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-c3916a7eb7efba0e7503955a",
          "src_port": 49253,
          "tcp_stream": 197,
          "udp_stream": null,
          "frame_number": 3712,
          "timestamp_epoch": "1561247273.454412000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.7",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "static.xx.fbcdn.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-7af4ee488a57db39dc63d308",
          "src_port": 49252,
          "tcp_stream": 198,
          "udp_stream": null,
          "frame_number": 3713,
          "timestamp_epoch": "1561247273.454524000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.7",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "static.xx.fbcdn.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-8c66c828b97cb86e9519fa23",
          "src_port": 49254,
          "tcp_stream": 196,
          "udp_stream": null,
          "frame_number": 3715,
          "timestamp_epoch": "1561247273.454705000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "72.21.81.200",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "iecvlist.microsoft.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-bb5bc49277a8ee5f42c76d14",
          "src_port": 49259,
          "tcp_stream": 209,
          "udp_stream": null,
          "frame_number": 3903,
          "timestamp_epoch": "1561247290.450381000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "72.21.81.200",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "iecvlist.microsoft.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-2b878fbad7d9d1714a33c1f3",
          "src_port": 49258,
          "tcp_stream": 208,
          "udp_stream": null,
          "frame_number": 3905,
          "timestamp_epoch": "1561247290.450632000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "72.21.81.200",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "iecvlist.microsoft.com"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 443,
          "event_id": "evt-5d4d6183b1b41941206941bf",
          "src_port": 49214,
          "tcp_stream": 216,
          "udp_stream": null,
          "frame_number": 5926,
          "timestamp_epoch": "1561247314.104889000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "72.21.81.200",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "iecvlist.microsoft.com"
          },
          "src_ip": "10.0.76.109",
          "dst_port": 443,
          "event_id": "evt-a9368b208bc4eb41da24efb3",
          "src_port": 49213,
          "tcp_stream": 215,
          "udp_stream": null,
          "frame_number": 5927,
          "timestamp_epoch": "1561247314.104969000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "173.194.219.156",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-140348cf1be3aba96e38ac9c",
          "src_port": 49263,
          "tcp_stream": 229,
          "udp_stream": null,
          "frame_number": 6325,
          "timestamp_epoch": "1561247391.533388000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "173.194.219.156",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-7b66e20e2b76e346b46527cb",
          "src_port": 49264,
          "tcp_stream": 230,
          "udp_stream": null,
          "frame_number": 6327,
          "timestamp_epoch": "1561247391.533584000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "64.233.185.103",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.google.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-8224a73488186406cd17bd2b",
          "src_port": 49274,
          "tcp_stream": 240,
          "udp_stream": null,
          "frame_number": 6383,
          "timestamp_epoch": "1561247392.014828000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "64.233.185.103",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.google.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-55db9e504e0580190911409a",
          "src_port": 49275,
          "tcp_stream": 241,
          "udp_stream": null,
          "frame_number": 6387,
          "timestamp_epoch": "1561247392.015511000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "64.233.185.95",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "fonts.googleapis.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-dca7b38851d4d4a804f59f7c",
          "src_port": 49277,
          "tcp_stream": 243,
          "udp_stream": null,
          "frame_number": 6408,
          "timestamp_epoch": "1561247392.030188000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "64.233.185.95",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "fonts.googleapis.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-fb6acb7d2e9c80b551d0bf73",
          "src_port": 49276,
          "tcp_stream": 242,
          "udp_stream": null,
          "frame_number": 6416,
          "timestamp_epoch": "1561247392.031356000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "35.226.156.55",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "beef2live.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-85b06f5088618dab5c6afdae",
          "src_port": 49267,
          "tcp_stream": 233,
          "udp_stream": null,
          "frame_number": 6418,
          "timestamp_epoch": "1561247392.031469000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "35.226.156.55",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "portal.farmcentric.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-6044c76078b258f5ac836854",
          "src_port": 49272,
          "tcp_stream": 238,
          "udp_stream": null,
          "frame_number": 6422,
          "timestamp_epoch": "1561247392.032145000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "35.226.156.55",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "beef2live.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-ce6dcc684ae81fe38c4ddff6",
          "src_port": 49269,
          "tcp_stream": 235,
          "udp_stream": null,
          "frame_number": 6436,
          "timestamp_epoch": "1561247392.035043000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "35.226.156.55",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "portal.farmcentric.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-c3abd9e6a5862e08ce36b5b8",
          "src_port": 49273,
          "tcp_stream": 239,
          "udp_stream": null,
          "frame_number": 6438,
          "timestamp_epoch": "1561247392.035174000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "74.125.136.102",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "cse.google.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-ac49443ee7a7658fff9b8e36",
          "src_port": 49278,
          "tcp_stream": 244,
          "udp_stream": null,
          "frame_number": 6476,
          "timestamp_epoch": "1561247392.064329000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "74.125.136.102",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "cse.google.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-3a25f2404f8efa45f61726d6",
          "src_port": 49279,
          "tcp_stream": 245,
          "udp_stream": null,
          "frame_number": 6481,
          "timestamp_epoch": "1561247392.064892000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "54.192.207.126",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.farmprogress.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-848dbe37c87037cacaa86371",
          "src_port": 49280,
          "tcp_stream": 246,
          "udp_stream": null,
          "frame_number": 6610,
          "timestamp_epoch": "1561247392.529697000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "54.192.207.126",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.farmprogress.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-fdbd9860186338a482292535",
          "src_port": 49281,
          "tcp_stream": 247,
          "udp_stream": null,
          "frame_number": 6618,
          "timestamp_epoch": "1561247392.533958000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "54.192.207.126",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.farmprogress.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-9824c7a4305df48aec7fec36",
          "src_port": 49282,
          "tcp_stream": 248,
          "udp_stream": null,
          "frame_number": 6622,
          "timestamp_epoch": "1561247392.534881000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "54.192.207.126",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.farmprogress.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-618865271b9280887c633ab9",
          "src_port": 49283,
          "tcp_stream": 249,
          "udp_stream": null,
          "frame_number": 6624,
          "timestamp_epoch": "1561247392.535330000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.7",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "connect.facebook.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-e5957c3b96c0b02490eae985",
          "src_port": 49284,
          "tcp_stream": 250,
          "udp_stream": null,
          "frame_number": 6626,
          "timestamp_epoch": "1561247392.535623000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.7",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "connect.facebook.net"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-22638d49447775028ba80e42",
          "src_port": 49285,
          "tcp_stream": 251,
          "udp_stream": null,
          "frame_number": 6628,
          "timestamp_epoch": "1561247392.535837000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "172.217.0.74",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.googleapis.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-989f45396296ff7fb91e91e6",
          "src_port": 49287,
          "tcp_stream": 253,
          "udp_stream": null,
          "frame_number": 6931,
          "timestamp_epoch": "1561247393.601016000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "172.217.0.74",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.googleapis.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-b30ee1dccc215035615be64f",
          "src_port": 49286,
          "tcp_stream": 252,
          "udp_stream": null,
          "frame_number": 6935,
          "timestamp_epoch": "1561247393.603282000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.36",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.facebook.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-8ceb1d0dd1564e103840f317",
          "src_port": 49293,
          "tcp_stream": 259,
          "udp_stream": null,
          "frame_number": 7010,
          "timestamp_epoch": "1561247393.665953000"
        },
        {
          "kind": "tls_client_hello",
          "dst_ip": "31.13.65.36",
          "fields": {
            "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3",
            "tls.handshake.extensions_server_name": "www.facebook.com"
          },
          "src_ip": "10.0.76.193",
          "dst_port": 443,
          "event_id": "evt-936f8f0731d220a3cc7957dd",
          "src_port": 49292,
          "tcp_stream": 258,
          "udp_stream": null,
          "frame_number": 7011,
          "timestamp_epoch": "1561247393.666065000"
        }
      ],
      "unclassified_tcp": [],
      "directory_service": [
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-6b272a6ec74e41db9a49d969",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 42,
          "timestamp_epoch": "1561247190.638496000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-c2d637dd464e3584be42b72f",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 44,
          "timestamp_epoch": "1561247190.638685000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-2034e133eeb1001fceb5a245",
          "src_port": null,
          "tcp_stream": 3,
          "udp_stream": null,
          "frame_number": 49,
          "timestamp_epoch": "1561247190.639779000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-548016539d0a02aeb17cc5aa",
          "src_port": null,
          "tcp_stream": 3,
          "udp_stream": null,
          "frame_number": 51,
          "timestamp_epoch": "1561247190.639984000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-9c685165a3b48623216ec3a1",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 96,
          "timestamp_epoch": "1561247190.684945000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-a6e04f3ac4480b7b3cb263e1",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 100,
          "timestamp_epoch": "1561247190.686329000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-d80fa1a8eede031c74679f46",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 105,
          "timestamp_epoch": "1561247190.687689000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-1d79ab35210c8717c82b5890",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 106,
          "timestamp_epoch": "1561247190.687959000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-654fadf90b4f0b3c8ee58f65",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 109,
          "timestamp_epoch": "1561247190.688549000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-0ed89c4528553f328045c7eb",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 110,
          "timestamp_epoch": "1561247190.688858000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-61bfd570be86a46725ea918e",
          "src_port": null,
          "tcp_stream": 3,
          "udp_stream": null,
          "frame_number": 122,
          "timestamp_epoch": "1561247190.691003000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-fc7cb2d5e2a75bfc33f2f978",
          "src_port": null,
          "tcp_stream": 3,
          "udp_stream": null,
          "frame_number": 126,
          "timestamp_epoch": "1561247190.691781000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-78e6ad506d789c21e03fdb46",
          "src_port": null,
          "tcp_stream": 3,
          "udp_stream": null,
          "frame_number": 127,
          "timestamp_epoch": "1561247190.694001000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-c07be9bc0dc72f84904a335b",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 176,
          "timestamp_epoch": "1561247190.799581000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-8a9c71979618e25ebe479483",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 179,
          "timestamp_epoch": "1561247190.800082000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-f0efeedad4b5b7837a729e59",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 190,
          "timestamp_epoch": "1561247190.906269000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-9b310fc7c05c54e45ffe4b9d",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 193,
          "timestamp_epoch": "1561247190.906887000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-61806311634e7a2299b006e4",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 199,
          "timestamp_epoch": "1561247190.916424000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-90cd19ec9d78ee7f4152e79e",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 202,
          "timestamp_epoch": "1561247190.916914000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-b89f4fc5b5e90987a10b464e",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 207,
          "timestamp_epoch": "1561247190.922205000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-5ad8f34f9f8b14e3496142f3",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 210,
          "timestamp_epoch": "1561247190.922623000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-fd5b0915eb83af2a1895016a",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 211,
          "timestamp_epoch": "1561247190.923506000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-77e691ea05c407565a9c95db",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 212,
          "timestamp_epoch": "1561247190.923773000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-3c99cf5a16d7c29bb435dd76",
          "src_port": null,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 213,
          "timestamp_epoch": "1561247190.924477000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "0"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-a05b649ad34951e85b803da1",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 279,
          "timestamp_epoch": "1561247195.377129000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "drsuapi.opnum": "0"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-515427db2e13ed6294bd9656",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 280,
          "timestamp_epoch": "1561247195.377360000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-99055cc59e8489f1b6257b87",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 281,
          "timestamp_epoch": "1561247195.377532000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-976f5b4ddbdbcfe3588b0c15",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 282,
          "timestamp_epoch": "1561247195.377814000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-2fe8bfed50b30cf8d34154cb",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 283,
          "timestamp_epoch": "1561247195.378432000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-420aa2f676b00205c064e806",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 284,
          "timestamp_epoch": "1561247195.378694000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "1"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-9090391cbe1d2c0735e17df5",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 285,
          "timestamp_epoch": "1561247195.379377000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "drsuapi.opnum": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-785041a17064ce745f631254",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 286,
          "timestamp_epoch": "1561247195.379565000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-9da7ffa9bebd1f2582dc7790",
          "src_port": null,
          "tcp_stream": 21,
          "udp_stream": null,
          "frame_number": 307,
          "timestamp_epoch": "1561247195.963025000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-522b9743a9ebbd1f3e2c43df",
          "src_port": null,
          "tcp_stream": 21,
          "udp_stream": null,
          "frame_number": 309,
          "timestamp_epoch": "1561247195.963407000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-f0f992254a60d5c4410c7254",
          "src_port": null,
          "tcp_stream": 21,
          "udp_stream": null,
          "frame_number": 312,
          "timestamp_epoch": "1561247195.965138000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-636a018ba8b2212288b4a9c0",
          "src_port": null,
          "tcp_stream": 21,
          "udp_stream": null,
          "frame_number": 314,
          "timestamp_epoch": "1561247195.966028000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "1",
            "ldap.baseObject": "DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-218cb82ab9932928e31f5aad",
          "src_port": null,
          "tcp_stream": 21,
          "udp_stream": null,
          "frame_number": 327,
          "timestamp_epoch": "1561247195.978166000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,19,19,19,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-2cf25d4abd310c06eae388b3",
          "src_port": null,
          "tcp_stream": 21,
          "udp_stream": null,
          "frame_number": 328,
          "timestamp_epoch": "1561247195.978569000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-2ac911b64dd0adcbf732c364",
          "src_port": null,
          "tcp_stream": 23,
          "udp_stream": null,
          "frame_number": 333,
          "timestamp_epoch": "1561247195.981704000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-f90f8896adcc071905c9c9bc",
          "src_port": null,
          "tcp_stream": 23,
          "udp_stream": null,
          "frame_number": 335,
          "timestamp_epoch": "1561247195.982464000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-4bc15983c8cf2838027b447e",
          "src_port": null,
          "tcp_stream": 23,
          "udp_stream": null,
          "frame_number": 336,
          "timestamp_epoch": "1561247195.982838000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-73d13a5fbc32df50bbaeb285",
          "src_port": null,
          "tcp_stream": 23,
          "udp_stream": null,
          "frame_number": 337,
          "timestamp_epoch": "1561247195.983111000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-0f6e9a5a14eb56f28a54c322",
          "src_port": null,
          "tcp_stream": 23,
          "udp_stream": null,
          "frame_number": 338,
          "timestamp_epoch": "1561247195.983365000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-b7476177e9f2491fcc2559f7",
          "src_port": null,
          "tcp_stream": 23,
          "udp_stream": null,
          "frame_number": 339,
          "timestamp_epoch": "1561247195.983604000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "1",
            "ldap.baseObject": "cn=policies,cn=system,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-1e2001bab02930cf8fb21b47",
          "src_port": null,
          "tcp_stream": 21,
          "udp_stream": null,
          "frame_number": 340,
          "timestamp_epoch": "1561247195.983883000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-7443845b5286857da1f5ae60",
          "src_port": null,
          "tcp_stream": 21,
          "udp_stream": null,
          "frame_number": 341,
          "timestamp_epoch": "1561247195.984193000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-60e200e4589f31ee37621975",
          "src_port": null,
          "tcp_stream": 23,
          "udp_stream": null,
          "frame_number": 410,
          "timestamp_epoch": "1561247196.001696000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-e7459501591063230f3a787a",
          "src_port": null,
          "tcp_stream": 21,
          "udp_stream": null,
          "frame_number": 415,
          "timestamp_epoch": "1561247196.415353000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-0d82741f262091ea7d91a734",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 450,
          "timestamp_epoch": "1561247201.219766000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-f330dc2fea4a412a80842828",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 452,
          "timestamp_epoch": "1561247201.220000000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-f957c2e4da23c9b8e332ef1d",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 455,
          "timestamp_epoch": "1561247201.222477000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-b0539bcece3532838613c6ce",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 457,
          "timestamp_epoch": "1561247201.223376000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-8b8396437fc5c4e0caea6869",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 458,
          "timestamp_epoch": "1561247201.225763000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-cf52c009d75db50e5043616c",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 459,
          "timestamp_epoch": "1561247201.225935000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-67596d5252ba058516c7f862",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 460,
          "timestamp_epoch": "1561247201.226122000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-30e75817026b24df8a8ca1c2",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 461,
          "timestamp_epoch": "1561247201.226316000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.baseObject": "CN=NTDS Settings,CN=PHENOMENOC-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-f5924cdc77f103dfd18ecfc4",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 462,
          "timestamp_epoch": "1561247201.226490000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-8b00f4d16b7dd4882fe204ea",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 463,
          "timestamp_epoch": "1561247201.226701000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "3",
            "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-77f20c20a4d7879ba4d89b8e",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 464,
          "timestamp_epoch": "1561247201.226890000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-6d52b0550e617b1097b2a627",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 465,
          "timestamp_epoch": "1561247201.227478000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-9265c43b13c37c922149b922",
          "src_port": null,
          "tcp_stream": 42,
          "udp_stream": null,
          "frame_number": 470,
          "timestamp_epoch": "1561247201.239312000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-2b6ef47c48de168d5ffb2103",
          "src_port": null,
          "tcp_stream": 42,
          "udp_stream": null,
          "frame_number": 472,
          "timestamp_epoch": "1561247201.240050000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-c857ff2c51ef048c3217a6d4",
          "src_port": null,
          "tcp_stream": 42,
          "udp_stream": null,
          "frame_number": 473,
          "timestamp_epoch": "1561247201.240493000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-b9719b0860d8b9c90ef7cf0b",
          "src_port": null,
          "tcp_stream": 42,
          "udp_stream": null,
          "frame_number": 474,
          "timestamp_epoch": "1561247201.240689000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "3",
            "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-0b4378357125ae5c1e29f08b",
          "src_port": null,
          "tcp_stream": 42,
          "udp_stream": null,
          "frame_number": 505,
          "timestamp_epoch": "1561247201.265590000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-662084dd02f9642f7a5b0572",
          "src_port": null,
          "tcp_stream": 42,
          "udp_stream": null,
          "frame_number": 506,
          "timestamp_epoch": "1561247201.266284000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-be20a801384f0a2775baf08a",
          "src_port": null,
          "tcp_stream": 42,
          "udp_stream": null,
          "frame_number": 507,
          "timestamp_epoch": "1561247201.266519000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-35cd3186027ac919e298d22d",
          "src_port": null,
          "tcp_stream": 41,
          "udp_stream": null,
          "frame_number": 509,
          "timestamp_epoch": "1561247201.266980000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-91353ac2162813be2d72b87b",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 589,
          "timestamp_epoch": "1561247225.253118000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-3a72a5489fc6eb3535e82c2f",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 591,
          "timestamp_epoch": "1561247225.253454000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-4153204d68af75e7b547d3ed",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 624,
          "timestamp_epoch": "1561247225.310268000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-9abb4cb8fc41d7de0d168698",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 626,
          "timestamp_epoch": "1561247225.310832000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-ae2ac279c33ec0909e97c2c1",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 627,
          "timestamp_epoch": "1561247225.315229000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-07e64d6523f48e097c9a82a8",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 628,
          "timestamp_epoch": "1561247225.315431000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-286179d5e22e160c09dcfa3d",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 629,
          "timestamp_epoch": "1561247225.315772000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-c00d4f0b3620107c24b48a8a",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 630,
          "timestamp_epoch": "1561247225.316127000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-d1ef79baa69075d0647955b8",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 698,
          "timestamp_epoch": "1561247225.427743000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-de65f127179c562b0ddc02b9",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 700,
          "timestamp_epoch": "1561247225.428191000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-36af51872aba6e5255235717",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 716,
          "timestamp_epoch": "1561247225.533359000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-dc899683d4d2a6c91151b53e",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 717,
          "timestamp_epoch": "1561247225.533649000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-40446fc65bc4115b82777d2a",
          "src_port": null,
          "tcp_stream": 66,
          "udp_stream": null,
          "frame_number": 724,
          "timestamp_epoch": "1561247225.613260000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-2baa4151758ccd03866e2d80",
          "src_port": null,
          "tcp_stream": 66,
          "udp_stream": null,
          "frame_number": 726,
          "timestamp_epoch": "1561247225.613522000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-39f35181648db49640e203c4",
          "src_port": null,
          "tcp_stream": 66,
          "udp_stream": null,
          "frame_number": 741,
          "timestamp_epoch": "1561247225.617524000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-69418297a4542981463034d3",
          "src_port": null,
          "tcp_stream": 66,
          "udp_stream": null,
          "frame_number": 743,
          "timestamp_epoch": "1561247225.618080000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-847cbc177f94d5d72bee7570",
          "src_port": null,
          "tcp_stream": 66,
          "udp_stream": null,
          "frame_number": 744,
          "timestamp_epoch": "1561247225.619649000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-0f68ef8222ab809144a8f932",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 750,
          "timestamp_epoch": "1561247225.632894000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-9bc0344dfeb299528fa5a83e",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 753,
          "timestamp_epoch": "1561247225.633345000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-fc73eeb9981577da4fd4280a",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 759,
          "timestamp_epoch": "1561247225.636405000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-1b995c9e99777fe14d18a840",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 761,
          "timestamp_epoch": "1561247225.636780000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-7c0ecc6aef6fe0bf653daca6",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 762,
          "timestamp_epoch": "1561247225.640110000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {},
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-6eb2deae1667d227abc5bac2",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 763,
          "timestamp_epoch": "1561247225.640341000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {},
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-f8f5d47f7ade53770132bdda",
          "src_port": null,
          "tcp_stream": 55,
          "udp_stream": null,
          "frame_number": 764,
          "timestamp_epoch": "1561247225.640632000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "0"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-f40314a8298905651db930f4",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 798,
          "timestamp_epoch": "1561247225.995113000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "drsuapi.opnum": "0"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-0abb6f8790b77c5674dfe8de",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 799,
          "timestamp_epoch": "1561247225.995391000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-570e2945489bc4a3b5369f02",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 800,
          "timestamp_epoch": "1561247225.995706000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-85bc7b3164459009ed4e8f6b",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 801,
          "timestamp_epoch": "1561247225.996028000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-d5443d3549e8cf2c1b9ac461",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 802,
          "timestamp_epoch": "1561247225.996193000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-1b03d1a063609a7b572b6d31",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 803,
          "timestamp_epoch": "1561247225.996422000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "1"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-d77ef988bd913f6f9dd7f1e5",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 804,
          "timestamp_epoch": "1561247225.997541000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "drsuapi.opnum": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-1c298b12514a1c1d24b2eabf",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 805,
          "timestamp_epoch": "1561247225.997719000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-8835392562c02d563872d5e6",
          "src_port": null,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 816,
          "timestamp_epoch": "1561247226.541879000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-f9a3de38ddd404e3c04919e6",
          "src_port": null,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 818,
          "timestamp_epoch": "1561247226.542090000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-f4d3270caf58ec92dfabb4ea",
          "src_port": null,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 821,
          "timestamp_epoch": "1561247226.543651000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-3b89871a8901d9de2b4f116a",
          "src_port": null,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 823,
          "timestamp_epoch": "1561247226.544226000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "1",
            "ldap.baseObject": "DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-50a6473a58db72e90e01a546",
          "src_port": null,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 836,
          "timestamp_epoch": "1561247226.557680000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,19,19,19,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-4fac1a20df3560d7069dc20a",
          "src_port": null,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 837,
          "timestamp_epoch": "1561247226.557974000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-149309729535621b99d14a9c",
          "src_port": null,
          "tcp_stream": 74,
          "udp_stream": null,
          "frame_number": 842,
          "timestamp_epoch": "1561247226.561990000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-0ece8ecdb2c61a05dfceb7e8",
          "src_port": null,
          "tcp_stream": 74,
          "udp_stream": null,
          "frame_number": 844,
          "timestamp_epoch": "1561247226.562723000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-85c834d7de9878b89d0bf845",
          "src_port": null,
          "tcp_stream": 74,
          "udp_stream": null,
          "frame_number": 845,
          "timestamp_epoch": "1561247226.563194000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-42524218949e70e735cc42c8",
          "src_port": null,
          "tcp_stream": 74,
          "udp_stream": null,
          "frame_number": 846,
          "timestamp_epoch": "1561247226.563388000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-33a8dba79e493a2ff131751b",
          "src_port": null,
          "tcp_stream": 74,
          "udp_stream": null,
          "frame_number": 847,
          "timestamp_epoch": "1561247226.563632000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-9925fc11e5a8e683b6aa8988",
          "src_port": null,
          "tcp_stream": 74,
          "udp_stream": null,
          "frame_number": 848,
          "timestamp_epoch": "1561247226.563833000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "1",
            "ldap.baseObject": "cn=policies,cn=system,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-598e53211280735d4b35a846",
          "src_port": null,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 849,
          "timestamp_epoch": "1561247226.564117000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-a407a1791586a9a139a6e558",
          "src_port": null,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 850,
          "timestamp_epoch": "1561247226.564358000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-8d657ebb398b7859debae86e",
          "src_port": null,
          "tcp_stream": 74,
          "udp_stream": null,
          "frame_number": 921,
          "timestamp_epoch": "1561247226.578011000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-47b88138616196e3e23a6707",
          "src_port": null,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 926,
          "timestamp_epoch": "1561247226.973955000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-d0d6aad5b315508169336ec2",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 980,
          "timestamp_epoch": "1561247235.787779000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-c99fe2d665d39c0d5c71c8bf",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 982,
          "timestamp_epoch": "1561247235.788096000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-98a59f7e60f7afe8a437f8ae",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 985,
          "timestamp_epoch": "1561247235.790536000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-046322290226bb411fcdf0be",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 987,
          "timestamp_epoch": "1561247235.791127000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-ed80ae273e64b2f5a7c6343d",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 988,
          "timestamp_epoch": "1561247235.793192000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-fa6be8d7b5f51c5b61dc5980",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 989,
          "timestamp_epoch": "1561247235.793395000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-4f4986ea65336fd9ced8ba8d",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 990,
          "timestamp_epoch": "1561247235.793632000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-af2de15fd76f64059c80880d",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 991,
          "timestamp_epoch": "1561247235.793826000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.baseObject": "CN=NTDS Settings,CN=PHENOMENOC-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-7ea851a156178a6374ba249f",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 992,
          "timestamp_epoch": "1561247235.794058000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-2383f8b6021a451e6636e513",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 993,
          "timestamp_epoch": "1561247235.794282000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "3",
            "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-287bfd57d0adf98898e0a08c",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 994,
          "timestamp_epoch": "1561247235.794502000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-d87ccf0c8e7c82fbc8b33052",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 995,
          "timestamp_epoch": "1561247235.794932000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-04bfdacb81148556e2c1ab0a",
          "src_port": null,
          "tcp_stream": 82,
          "udp_stream": null,
          "frame_number": 1000,
          "timestamp_epoch": "1561247235.810376000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-0584245cbc0cd4b860b8839c",
          "src_port": null,
          "tcp_stream": 82,
          "udp_stream": null,
          "frame_number": 1002,
          "timestamp_epoch": "1561247235.811046000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-656fe629aa5cfdf421a4a113",
          "src_port": null,
          "tcp_stream": 82,
          "udp_stream": null,
          "frame_number": 1003,
          "timestamp_epoch": "1561247235.811679000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-844e2626813abe16bc37d61c",
          "src_port": null,
          "tcp_stream": 82,
          "udp_stream": null,
          "frame_number": 1004,
          "timestamp_epoch": "1561247235.811890000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "3",
            "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-0e5b67582ec258685f1c4434",
          "src_port": null,
          "tcp_stream": 82,
          "udp_stream": null,
          "frame_number": 1035,
          "timestamp_epoch": "1561247235.838731000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-71360570e9ddf9715983f5cf",
          "src_port": null,
          "tcp_stream": 82,
          "udp_stream": null,
          "frame_number": 1036,
          "timestamp_epoch": "1561247235.839321000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-4ef0fa2ffcdc2683f577453e",
          "src_port": null,
          "tcp_stream": 82,
          "udp_stream": null,
          "frame_number": 1037,
          "timestamp_epoch": "1561247235.839533000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-5fc81d620b06be73dd5f2e24",
          "src_port": null,
          "tcp_stream": 81,
          "udp_stream": null,
          "frame_number": 1039,
          "timestamp_epoch": "1561247235.840085000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "0"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-6537b334cdce362d436fdbcb",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 1096,
          "timestamp_epoch": "1561247238.408025000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "drsuapi.opnum": "0"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-e29266c64ae98e4cb0d5bcff",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 1097,
          "timestamp_epoch": "1561247238.408275000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-d58b2bc6293fa772b7daa953",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 1098,
          "timestamp_epoch": "1561247238.408446000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-cda9ac9c7f09fc2c00c8b753",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 1099,
          "timestamp_epoch": "1561247238.408723000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-7bd1c010936963056edd53a7",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 1100,
          "timestamp_epoch": "1561247238.409437000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-90b651a28fbe0a59c8d67d5e",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 1101,
          "timestamp_epoch": "1561247238.409719000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "1"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-1eedce9322d1bec596062c10",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 1102,
          "timestamp_epoch": "1561247238.409927000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "drsuapi.opnum": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-84756a1161f3799a5710ec9d",
          "src_port": null,
          "tcp_stream": 17,
          "udp_stream": null,
          "frame_number": 1103,
          "timestamp_epoch": "1561247238.410174000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-17428ef471ff5e60861dcf15",
          "src_port": null,
          "tcp_stream": 91,
          "udp_stream": null,
          "frame_number": 1122,
          "timestamp_epoch": "1561247238.939278000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-7928a0d99983db61e4585318",
          "src_port": null,
          "tcp_stream": 91,
          "udp_stream": null,
          "frame_number": 1124,
          "timestamp_epoch": "1561247238.939782000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "1",
            "ldap.baseObject": "DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-bdffd9448e6a8ec374af3880",
          "src_port": null,
          "tcp_stream": 91,
          "udp_stream": null,
          "frame_number": 1125,
          "timestamp_epoch": "1561247238.941922000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,19,19,19,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-ba1a1fef775f7fcdeef5d30f",
          "src_port": null,
          "tcp_stream": 91,
          "udp_stream": null,
          "frame_number": 1126,
          "timestamp_epoch": "1561247238.942172000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-204e6f623ea2a8f6b2c5c268",
          "src_port": null,
          "tcp_stream": 93,
          "udp_stream": null,
          "frame_number": 1131,
          "timestamp_epoch": "1561247238.945123000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-0394c3be87e64de493f81382",
          "src_port": null,
          "tcp_stream": 93,
          "udp_stream": null,
          "frame_number": 1133,
          "timestamp_epoch": "1561247238.945589000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-4f22f2589312567b82836bac",
          "src_port": null,
          "tcp_stream": 93,
          "udp_stream": null,
          "frame_number": 1134,
          "timestamp_epoch": "1561247238.945968000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-e001049eb6422ef4e2323178",
          "src_port": null,
          "tcp_stream": 93,
          "udp_stream": null,
          "frame_number": 1135,
          "timestamp_epoch": "1561247238.946121000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-73eb79b055686aeff1a18274",
          "src_port": null,
          "tcp_stream": 93,
          "udp_stream": null,
          "frame_number": 1136,
          "timestamp_epoch": "1561247238.946291000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-d9c9719a7119cce4a9434ef0",
          "src_port": null,
          "tcp_stream": 93,
          "udp_stream": null,
          "frame_number": 1137,
          "timestamp_epoch": "1561247238.946467000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "1",
            "ldap.baseObject": "cn=policies,cn=system,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-0e6552670ead11e4d4113f39",
          "src_port": null,
          "tcp_stream": 91,
          "udp_stream": null,
          "frame_number": 1138,
          "timestamp_epoch": "1561247238.946754000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.193",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-9f7e73201cdb535e3227ccc0",
          "src_port": null,
          "tcp_stream": 91,
          "udp_stream": null,
          "frame_number": 1139,
          "timestamp_epoch": "1561247238.947071000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-4a4fd0d77a70cef121b425c0",
          "src_port": null,
          "tcp_stream": 93,
          "udp_stream": null,
          "frame_number": 1179,
          "timestamp_epoch": "1561247238.956078000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.193",
          "dst_port": null,
          "event_id": "evt-17316c136188e29691c65b6e",
          "src_port": null,
          "tcp_stream": 91,
          "udp_stream": null,
          "frame_number": 1183,
          "timestamp_epoch": "1561247239.477951000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "0"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-a9679d6c1a4f52f8b21f440c",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 1282,
          "timestamp_epoch": "1561247254.210400000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "drsuapi.opnum": "0"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-729eaab10440b61fccf6e730",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 1283,
          "timestamp_epoch": "1561247254.210695000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-a6c0a018077c3da9edf7814e",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 1284,
          "timestamp_epoch": "1561247254.211494000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-bc98abaa200c44734e87100f",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 1285,
          "timestamp_epoch": "1561247254.211876000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-f0d226edf455d150079c7fac",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 1286,
          "timestamp_epoch": "1561247254.212507000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "drsuapi.opnum": "12"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-fff678e64b4f6543b8144b42",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 1287,
          "timestamp_epoch": "1561247254.212899000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "drsuapi.opnum": "1"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-33dac129800b492b1e0c6870",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 1288,
          "timestamp_epoch": "1561247254.213747000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "drsuapi.opnum": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-360b88219885a43af7923c15",
          "src_port": null,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 1289,
          "timestamp_epoch": "1561247254.213932000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-557f7b81aeee8b1fbdaea01a",
          "src_port": null,
          "tcp_stream": 120,
          "udp_stream": null,
          "frame_number": 1312,
          "timestamp_epoch": "1561247254.753153000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-fb7a8bf6cb83703ff5b4f8ab",
          "src_port": null,
          "tcp_stream": 120,
          "udp_stream": null,
          "frame_number": 1314,
          "timestamp_epoch": "1561247254.753741000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "1",
            "ldap.baseObject": "DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-4e2cc60f75fde1b691592737",
          "src_port": null,
          "tcp_stream": 120,
          "udp_stream": null,
          "frame_number": 1315,
          "timestamp_epoch": "1561247254.755823000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,19,19,19,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-72ddb3704e20160ed10466d0",
          "src_port": null,
          "tcp_stream": 120,
          "udp_stream": null,
          "frame_number": 1316,
          "timestamp_epoch": "1561247254.756137000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "0"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-48eff567b4a63b8d5988e555",
          "src_port": null,
          "tcp_stream": 122,
          "udp_stream": null,
          "frame_number": 1321,
          "timestamp_epoch": "1561247254.759798000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "1"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-c6dd36dec0ec6a9288b3178b",
          "src_port": null,
          "tcp_stream": 122,
          "udp_stream": null,
          "frame_number": 1323,
          "timestamp_epoch": "1561247254.760343000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-014173501ee204ee5fff13ad",
          "src_port": null,
          "tcp_stream": 122,
          "udp_stream": null,
          "frame_number": 1324,
          "timestamp_epoch": "1561247254.760685000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-40bb11569bfbd512ecafbce1",
          "src_port": null,
          "tcp_stream": 122,
          "udp_stream": null,
          "frame_number": 1325,
          "timestamp_epoch": "1561247254.760923000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "7",
            "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-e1ee3a3b6196f0ff0f52d5e8",
          "src_port": null,
          "tcp_stream": 122,
          "udp_stream": null,
          "frame_number": 1326,
          "timestamp_epoch": "1561247254.761139000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-69e33ba3bb9f3e68458167c1",
          "src_port": null,
          "tcp_stream": 122,
          "udp_stream": null,
          "frame_number": 1327,
          "timestamp_epoch": "1561247254.761352000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.filter": "1",
            "ldap.baseObject": "cn=policies,cn=system,DC=phenomenoc,DC=com",
            "ldap.protocolOp": "3"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-65d3ffd4bce55b76fd96d3d1",
          "src_port": null,
          "tcp_stream": 120,
          "udp_stream": null,
          "frame_number": 1328,
          "timestamp_epoch": "1561247254.761592000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.109",
          "fields": {
            "ldap.protocolOp": "4,5"
          },
          "src_ip": "10.0.76.6",
          "dst_port": null,
          "event_id": "evt-8c1acf9f9e41bf1f26b0d84b",
          "src_port": null,
          "tcp_stream": 120,
          "udp_stream": null,
          "frame_number": 1329,
          "timestamp_epoch": "1561247254.761908000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-07e8b1c49f5a9009149c92aa",
          "src_port": null,
          "tcp_stream": 122,
          "udp_stream": null,
          "frame_number": 1370,
          "timestamp_epoch": "1561247254.770902000"
        },
        {
          "kind": "directory_service",
          "dst_ip": "10.0.76.6",
          "fields": {
            "ldap.protocolOp": "2"
          },
          "src_ip": "10.0.76.109",
          "dst_port": null,
          "event_id": "evt-1c9aa2754ade8513f575a08e",
          "src_port": null,
          "tcp_stream": 120,
          "udp_stream": null,
          "frame_number": 1375,
          "timestamp_epoch": "1561247255.289559000"
        }
      ]
    },
    "capture": {
      "format": "pcap-le-microsecond",
      "packet_count": 7103,
      "interface_ids": [],
      "source_sha256": "6a89013b9e9bc6d443810245b92f49db4df33c1671a43db03a6bbde8f2bc6e63",
      "captured_bytes": 4580376,
      "protocol_counts": {
        "ip": 7103,
        "dns": 163,
        "eth": 7103,
        "ntp": 4,
        "png": 12,
        "smb": 2,
        "tcp": 6823,
        "tls": 1038,
        "udp": 265,
        "data": 6,
        "dhcp": 8,
        "http": 92,
        "igmp": 30,
        "ldap": 156,
        "nbns": 48,
        "nbss": 112,
        "smb2": 110,
        "ssdp": 6,
        "cldap": 22,
        "llmnr": 14,
        "media": 8,
        "dcerpc": 108,
        "pkcs-1": 27,
        "spnego": 68,
        "x509ce": 725,
        "gss-api": 136,
        "x509sat": 748,
        "kerberos": 96,
        "ethertype": 7103,
        "image-gif": 5,
        "spnego-krb5": 228,
        "pkix1explicit": 61,
        "pkix1implicit": 98,
        "data-text-lines": 17
      },
      "duration_seconds": 232.185013,
      "last_packet_epoch": "1561247422.558507",
      "source_size_bytes": 4694048,
      "first_packet_epoch": "1561247190.373494",
      "encapsulation_types": [
        1
      ]
    },
    "summary": "Decoded 7103 packets across 47 IP endpoints and 367 transport flows. Observed 163 DNS events, 52 HTTP requests, 67 TLS ClientHello events, and 34 recovered file/message object(s). Deterministic rules produced 20 finding(s): 0 high, 12 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.",
    "coverage": {
      "warnings": [],
      "limitations": [
        "Encrypted application contents are not decrypted",
        "Protocol decoding and heuristic findings do not establish malware family or attribution",
        "No endpoint execution, persistence, or credential-theft proof without corresponding evidence"
      ],
      "event_limits": {
        "dns": {
          "returned": 163,
          "truncated": false
        },
        "dhcp": {
          "returned": 8,
          "truncated": false
        },
        "smtp": {
          "returned": 0,
          "truncated": false
        },
        "identity": {
          "returned": 312,
          "truncated": false
        },
        "http_request": {
          "returned": 52,
          "truncated": false
        },
        "http_response": {
          "returned": 46,
          "truncated": false
        },
        "tls_client_hello": {
          "returned": 67,
          "truncated": false
        },
        "unclassified_tcp": {
          "returned": 0,
          "truncated": false
        },
        "directory_service": {
          "returned": 180,
          "truncated": false
        }
      },
      "http_objects": {
        "complete": true,
        "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index",
        "hashed_bytes": 2358768,
        "export_status": "completed",
        "unique_hashes": 34,
        "hashed_objects": 42,
        "compact_objects": 0,
        "detailed_objects": 34,
        "exported_objects": 42,
        "unhashed_objects": 0,
        "compact_hash_index": [],
        "omitted_unique_hashes": 0,
        "returned_unique_hashes": 34
      },
      "name_resolution": false,
      "supplemental_objects": {
        "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery",
        "returned": 0
      },
      "complete_within_profile": true,
      "encrypted_payload_visibility": "metadata-only"
    },
    "findings": [
      {
        "title": "Script, archive, or executable transfer candidate",
        "status": "candidate",
        "metrics": {
          "uri": "/ajax/libs/jquery/1.12.4/jquery.min.js",
          "source": "172.217.164.74",
          "destination": "10.0.76.193",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 33951
        },
        "rule_id": "script-or-executable-transfer",
        "evidence": [
          {
            "tcp_stream": 140,
            "frame_number": 1462,
            "display_filter": "frame.number == 1462",
            "timestamp_epoch": "1561247261.361127000"
          },
          {
            "tcp_stream": 140,
            "frame_number": 1524,
            "display_filter": "frame.number == 1524",
            "timestamp_epoch": "1561247261.424777000"
          }
        ],
        "severity": "medium",
        "confidence": 0.86,
        "finding_id": "finding-5f2de1aa6c579add0e950384",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Script, archive, or executable transfer candidate",
        "status": "candidate",
        "metrics": {
          "uri": "/pagead/conversion_async.js",
          "source": "172.217.2.34",
          "destination": "10.0.76.193",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 8916
        },
        "rule_id": "script-or-executable-transfer",
        "evidence": [
          {
            "tcp_stream": 148,
            "frame_number": 1720,
            "display_filter": "frame.number == 1720",
            "timestamp_epoch": "1561247261.881869000"
          },
          {
            "tcp_stream": 148,
            "frame_number": 1734,
            "display_filter": "frame.number == 1734",
            "timestamp_epoch": "1561247261.913335000"
          }
        ],
        "severity": "medium",
        "confidence": 0.86,
        "finding_id": "finding-1ad8745f112f35735cb5a0a8",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Script, archive, or executable transfer candidate",
        "status": "candidate",
        "metrics": {
          "uri": "/ga.js",
          "source": "74.125.138.138",
          "destination": "10.0.76.193",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 17168
        },
        "rule_id": "script-or-executable-transfer",
        "evidence": [
          {
            "tcp_stream": 152,
            "frame_number": 1781,
            "display_filter": "frame.number == 1781",
            "timestamp_epoch": "1561247262.327050000"
          },
          {
            "tcp_stream": 152,
            "frame_number": 1809,
            "display_filter": "frame.number == 1809",
            "timestamp_epoch": "1561247262.362620000"
          }
        ],
        "severity": "medium",
        "confidence": 0.86,
        "finding_id": "finding-e6aedd02e0d353476ed20963",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Script, archive, or executable transfer candidate",
        "status": "candidate",
        "metrics": {
          "uri": "/en_US/all.js",
          "source": "31.13.65.7",
          "destination": "10.0.76.193",
          "content_type": "application/x-javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 1781
        },
        "rule_id": "script-or-executable-transfer",
        "evidence": [
          {
            "tcp_stream": 156,
            "frame_number": 1836,
            "display_filter": "frame.number == 1836",
            "timestamp_epoch": "1561247262.717994000"
          },
          {
            "tcp_stream": 156,
            "frame_number": 1851,
            "display_filter": "frame.number == 1851",
            "timestamp_epoch": "1561247262.733092000"
          }
        ],
        "severity": "medium",
        "confidence": 0.86,
        "finding_id": "finding-e9ee998a0955f3399f03c498",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Script, archive, or executable transfer candidate",
        "status": "candidate",
        "metrics": {
          "uri": "/adsense/search/async-ads.js",
          "source": "74.125.136.102",
          "destination": "10.0.76.193",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "evidence": [
          {
            "tcp_stream": 169,
            "frame_number": 2649,
            "display_filter": "frame.number == 2649",
            "timestamp_epoch": "1561247263.809346000"
          },
          {
            "tcp_stream": 169,
            "frame_number": 2787,
            "display_filter": "frame.number == 2787",
            "timestamp_epoch": "1561247263.967936000"
          }
        ],
        "severity": "medium",
        "confidence": 0.86,
        "finding_id": "finding-73a8cfed784dbaf2b0d04d22",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Script, archive, or executable transfer candidate",
        "status": "candidate",
        "metrics": {
          "uri": "/?MzU4NjA0&kaZDWzI&AkwenzFXp=perpetual&EIDOXmpaHLIMQ=blackmail&PmNkusRzUKjdxi=known&embBMhXHEVqMM=already&nvQgwJI=community&PtVAedNAUU=difference&jDCoPDPCLNkpJ=heartfelt&SJjNZIaGHxK=known&vvHefJ=heartfelt&t4tsdfsg4=PAVMb_q6p3EiEnR6U0pGB_xyNZgITqZucEbg_2lT3ybZGJsJ1kx_R6GcBxewtW10Z6AwalanCH6fAnUctFEsxYQ&IJbAFjBSlWY=heartfelt&hyYviEG=criticized&ff5sdfds=xHjQMrnYbRbFFYTfKPPEUKNEMUjWA0-KwYmZhafVF5mxFDHGpbX1FxXspVSdCFSEmvRvdLUHIwSh1U3ASwNizYk&SfDdcBJQLntZc=everyone&ZwddKCJISaTB=blackmail&IqnFgRnJ=known&WWmEHUqy=vest&niUheyKPRbLYEdyNjEwOTgy",
          "source": "37.46.135.170",
          "destination": "10.0.76.109",
          "content_type": "application/x-msdownload",
          "response_count": 1,
          "declared_body_bytes": 584192
        },
        "rule_id": "script-or-executable-transfer",
        "evidence": [
          {
            "tcp_stream": 207,
            "frame_number": 3893,
            "display_filter": "frame.number == 3893",
            "timestamp_epoch": "1561247290.335491000"
          },
          {
            "tcp_stream": 207,
            "frame_number": 4397,
            "display_filter": "frame.number == 4397",
            "timestamp_epoch": "1561247294.066676000"
          }
        ],
        "severity": "medium",
        "confidence": 0.86,
        "finding_id": "finding-1fd15c185fe156513055bdf4",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Script, archive, or executable transfer candidate",
        "status": "candidate",
        "metrics": {
          "uri": "/?NDk4MTE5&tmCVgJMQbeHjv&znbcjFaUOmZy=vest&aTijcut=blackmail&kBgQawTJSFlOAu=difference&NCThQKrrQh=blackmail&lvQmqFyq=constitution&zCrDVEX=known&wLBVVjhJGAWC=detonator&PLFPhyyqZCa=known&lfJYgkH=perpetual&t4tsdfsg4=YPAVwb_q6p3EaEnRGU0p6B_x2NZgMTqZWcEbk_2lv3ybhGJs11kx_R6GYBxewtUFMT4wMWmKjKHqj58EgwV0sC&nVJnyJYij=vest&eZvTJjAeJ=professional&ISzjHlO=strategy&tAMbBJnq=referred&bwgDFqD=strategy&kdPRkesmuQ=heartfelt&ff5sdfds=xHjQMrbYbRfFFYvfKPzEUKxEMUbWA0GKwYeZhajVF5exFD7Gpbr1FxXspVWdCFWEmvtvdLUHIwuh1UPASwJizY&kxbRJWYrNpZbNlVMzU3NDAz",
          "source": "37.46.135.170",
          "destination": "10.0.76.109",
          "content_type": "application/x-msdownload",
          "response_count": 1,
          "declared_body_bytes": 584192
        },
        "rule_id": "script-or-executable-transfer",
        "evidence": [
          {
            "tcp_stream": 210,
            "frame_number": 4417,
            "display_filter": "frame.number == 4417",
            "timestamp_epoch": "1561247296.354584000"
          },
          {
            "tcp_stream": 210,
            "frame_number": 4881,
            "display_filter": "frame.number == 4881",
            "timestamp_epoch": "1561247299.346917000"
          }
        ],
        "severity": "medium",
        "confidence": 0.86,
        "finding_id": "finding-4a116bcfdf925e0d8bfc2ee2",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Script, archive, or executable transfer candidate",
        "status": "candidate",
        "metrics": {
          "uri": "/scripts/bootstrap.js",
          "source": "35.226.156.55",
          "destination": "10.0.76.193",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6343,
            "display_filter": "frame.number == 6343",
            "timestamp_epoch": "1561247391.619220000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6470,
            "display_filter": "frame.number == 6470",
            "timestamp_epoch": "1561247392.063687000"
          }
        ],
        "severity": "medium",
        "confidence": 0.86,
        "finding_id": "finding-a7642385f3d14ba128b22f34",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Script, archive, or executable transfer candidate",
        "status": "candidate",
        "metrics": {
          "uri": "/scripts/jquery.selectbox-0.2.js",
          "source": "35.226.156.55",
          "destination": "10.0.76.193",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6367,
            "display_filter": "frame.number == 6367",
            "timestamp_epoch": "1561247391.999359000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6514,
            "display_filter": "frame.number == 6514",
            "timestamp_epoch": "1561247392.084851000"
          }
        ],
        "severity": "medium",
        "confidence": 0.86,
        "finding_id": "finding-11e10d956e266bb1f17197e1",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Script, archive, or executable transfer candidate",
        "status": "candidate",
        "metrics": {
          "uri": "/scripts/amcharts/amcharts.js",
          "source": "35.226.156.55",
          "destination": "10.0.76.193",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 58269
        },
        "rule_id": "script-or-executable-transfer",
        "evidence": [
          {
            "tcp_stream": 234,
            "frame_number": 6432,
            "display_filter": "frame.number == 6432",
            "timestamp_epoch": "1561247392.034702000"
          },
          {
            "tcp_stream": 234,
            "frame_number": 6807,
            "display_filter": "frame.number == 6807",
            "timestamp_epoch": "1561247393.120096000"
          }
        ],
        "severity": "medium",
        "confidence": 0.86,
        "finding_id": "finding-899c3baf9e827da688f77aca",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Script, archive, or executable transfer candidate",
        "status": "candidate",
        "metrics": {
          "uri": "/scripts/amcharts/serial.js",
          "source": "35.226.156.55",
          "destination": "10.0.76.193",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6475,
            "display_filter": "frame.number == 6475",
            "timestamp_epoch": "1561247392.064267000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6560,
            "display_filter": "frame.number == 6560",
            "timestamp_epoch": "1561247392.522006000"
          }
        ],
        "severity": "medium",
        "confidence": 0.86,
        "finding_id": "finding-5104a0204f7bd3cc9acfeb99",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Script, archive, or executable transfer candidate",
        "status": "candidate",
        "metrics": {
          "uri": "/scripts/amcharts/themes/light.js",
          "source": "35.226.156.55",
          "destination": "10.0.76.193",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 1142
        },
        "rule_id": "script-or-executable-transfer",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6497,
            "display_filter": "frame.number == 6497",
            "timestamp_epoch": "1561247392.075452000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6562,
            "display_filter": "frame.number == 6562",
            "timestamp_epoch": "1561247392.522037000"
          }
        ],
        "severity": "medium",
        "confidence": 0.86,
        "finding_id": "finding-2f5b08bb1d3c8868430f4e23",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Directory-service protocol activity",
        "status": "candidate",
        "metrics": {
          "source": "10.0.76.109",
          "protocol": "drsuapi",
          "destination": "10.0.76.6",
          "event_count": 8,
          "operation_numbers": [
            "0",
            "1",
            "12"
          ]
        },
        "rule_id": "directory-service-activity",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 798,
            "display_filter": "frame.number == 798",
            "timestamp_epoch": "1561247225.995113000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 800,
            "display_filter": "frame.number == 800",
            "timestamp_epoch": "1561247225.995706000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 802,
            "display_filter": "frame.number == 802",
            "timestamp_epoch": "1561247225.996193000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 804,
            "display_filter": "frame.number == 804",
            "timestamp_epoch": "1561247225.997541000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1282,
            "display_filter": "frame.number == 1282",
            "timestamp_epoch": "1561247254.210400000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1284,
            "display_filter": "frame.number == 1284",
            "timestamp_epoch": "1561247254.211494000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1286,
            "display_filter": "frame.number == 1286",
            "timestamp_epoch": "1561247254.212507000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1288,
            "display_filter": "frame.number == 1288",
            "timestamp_epoch": "1561247254.213747000"
          }
        ],
        "severity": "low",
        "confidence": 0.95,
        "finding_id": "finding-1f68a6d774afd56eb1ed1c35",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Directory-service protocol activity",
        "status": "candidate",
        "metrics": {
          "source": "10.0.76.109",
          "protocol": "ldap",
          "destination": "10.0.76.6",
          "event_count": 41,
          "operation_numbers": [
            "",
            "0",
            "2",
            "3"
          ]
        },
        "rule_id": "directory-service-activity",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 589,
            "display_filter": "frame.number == 589",
            "timestamp_epoch": "1561247225.253118000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 624,
            "display_filter": "frame.number == 624",
            "timestamp_epoch": "1561247225.310268000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 627,
            "display_filter": "frame.number == 627",
            "timestamp_epoch": "1561247225.315229000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 629,
            "display_filter": "frame.number == 629",
            "timestamp_epoch": "1561247225.315772000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 698,
            "display_filter": "frame.number == 698",
            "timestamp_epoch": "1561247225.427743000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 716,
            "display_filter": "frame.number == 716",
            "timestamp_epoch": "1561247225.533359000"
          },
          {
            "tcp_stream": 66,
            "frame_number": 724,
            "display_filter": "frame.number == 724",
            "timestamp_epoch": "1561247225.613260000"
          },
          {
            "tcp_stream": 66,
            "frame_number": 741,
            "display_filter": "frame.number == 741",
            "timestamp_epoch": "1561247225.617524000"
          },
          {
            "tcp_stream": 66,
            "frame_number": 744,
            "display_filter": "frame.number == 744",
            "timestamp_epoch": "1561247225.619649000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 750,
            "display_filter": "frame.number == 750",
            "timestamp_epoch": "1561247225.632894000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 759,
            "display_filter": "frame.number == 759",
            "timestamp_epoch": "1561247225.636405000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 762,
            "display_filter": "frame.number == 762",
            "timestamp_epoch": "1561247225.640110000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 764,
            "display_filter": "frame.number == 764",
            "timestamp_epoch": "1561247225.640632000"
          },
          {
            "tcp_stream": 72,
            "frame_number": 816,
            "display_filter": "frame.number == 816",
            "timestamp_epoch": "1561247226.541879000"
          },
          {
            "tcp_stream": 72,
            "frame_number": 821,
            "display_filter": "frame.number == 821",
            "timestamp_epoch": "1561247226.543651000"
          },
          {
            "tcp_stream": 72,
            "frame_number": 836,
            "display_filter": "frame.number == 836",
            "timestamp_epoch": "1561247226.557680000"
          },
          {
            "tcp_stream": 74,
            "frame_number": 842,
            "display_filter": "frame.number == 842",
            "timestamp_epoch": "1561247226.561990000"
          },
          {
            "tcp_stream": 74,
            "frame_number": 845,
            "display_filter": "frame.number == 845",
            "timestamp_epoch": "1561247226.563194000"
          },
          {
            "tcp_stream": 74,
            "frame_number": 847,
            "display_filter": "frame.number == 847",
            "timestamp_epoch": "1561247226.563632000"
          },
          {
            "tcp_stream": 72,
            "frame_number": 849,
            "display_filter": "frame.number == 849",
            "timestamp_epoch": "1561247226.564117000"
          },
          {
            "tcp_stream": 74,
            "frame_number": 921,
            "display_filter": "frame.number == 921",
            "timestamp_epoch": "1561247226.578011000"
          },
          {
            "tcp_stream": 72,
            "frame_number": 926,
            "display_filter": "frame.number == 926",
            "timestamp_epoch": "1561247226.973955000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 980,
            "display_filter": "frame.number == 980",
            "timestamp_epoch": "1561247235.787779000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 985,
            "display_filter": "frame.number == 985",
            "timestamp_epoch": "1561247235.790536000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 988,
            "display_filter": "frame.number == 988",
            "timestamp_epoch": "1561247235.793192000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 990,
            "display_filter": "frame.number == 990",
            "timestamp_epoch": "1561247235.793632000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 992,
            "display_filter": "frame.number == 992",
            "timestamp_epoch": "1561247235.794058000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 994,
            "display_filter": "frame.number == 994",
            "timestamp_epoch": "1561247235.794502000"
          },
          {
            "tcp_stream": 82,
            "frame_number": 1000,
            "display_filter": "frame.number == 1000",
            "timestamp_epoch": "1561247235.810376000"
          },
          {
            "tcp_stream": 82,
            "frame_number": 1003,
            "display_filter": "frame.number == 1003",
            "timestamp_epoch": "1561247235.811679000"
          },
          {
            "tcp_stream": 82,
            "frame_number": 1035,
            "display_filter": "frame.number == 1035",
            "timestamp_epoch": "1561247235.838731000"
          },
          {
            "tcp_stream": 82,
            "frame_number": 1037,
            "display_filter": "frame.number == 1037",
            "timestamp_epoch": "1561247235.839533000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 1039,
            "display_filter": "frame.number == 1039",
            "timestamp_epoch": "1561247235.840085000"
          },
          {
            "tcp_stream": 120,
            "frame_number": 1312,
            "display_filter": "frame.number == 1312",
            "timestamp_epoch": "1561247254.753153000"
          },
          {
            "tcp_stream": 120,
            "frame_number": 1315,
            "display_filter": "frame.number == 1315",
            "timestamp_epoch": "1561247254.755823000"
          },
          {
            "tcp_stream": 122,
            "frame_number": 1321,
            "display_filter": "frame.number == 1321",
            "timestamp_epoch": "1561247254.759798000"
          },
          {
            "tcp_stream": 122,
            "frame_number": 1324,
            "display_filter": "frame.number == 1324",
            "timestamp_epoch": "1561247254.760685000"
          },
          {
            "tcp_stream": 122,
            "frame_number": 1326,
            "display_filter": "frame.number == 1326",
            "timestamp_epoch": "1561247254.761139000"
          },
          {
            "tcp_stream": 120,
            "frame_number": 1328,
            "display_filter": "frame.number == 1328",
            "timestamp_epoch": "1561247254.761592000"
          },
          {
            "tcp_stream": 122,
            "frame_number": 1370,
            "display_filter": "frame.number == 1370",
            "timestamp_epoch": "1561247254.770902000"
          },
          {
            "tcp_stream": 120,
            "frame_number": 1375,
            "display_filter": "frame.number == 1375",
            "timestamp_epoch": "1561247255.289559000"
          }
        ],
        "severity": "low",
        "confidence": 0.95,
        "finding_id": "finding-088d67a4a95db14e15918503",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Directory-service protocol activity",
        "status": "candidate",
        "metrics": {
          "source": "10.0.76.193",
          "protocol": "drsuapi",
          "destination": "10.0.76.6",
          "event_count": 8,
          "operation_numbers": [
            "0",
            "1",
            "12"
          ]
        },
        "rule_id": "directory-service-activity",
        "evidence": [
          {
            "tcp_stream": 17,
            "frame_number": 279,
            "display_filter": "frame.number == 279",
            "timestamp_epoch": "1561247195.377129000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 281,
            "display_filter": "frame.number == 281",
            "timestamp_epoch": "1561247195.377532000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 283,
            "display_filter": "frame.number == 283",
            "timestamp_epoch": "1561247195.378432000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 285,
            "display_filter": "frame.number == 285",
            "timestamp_epoch": "1561247195.379377000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 1096,
            "display_filter": "frame.number == 1096",
            "timestamp_epoch": "1561247238.408025000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 1098,
            "display_filter": "frame.number == 1098",
            "timestamp_epoch": "1561247238.408446000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 1100,
            "display_filter": "frame.number == 1100",
            "timestamp_epoch": "1561247238.409437000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 1102,
            "display_filter": "frame.number == 1102",
            "timestamp_epoch": "1561247238.409927000"
          }
        ],
        "severity": "low",
        "confidence": 0.95,
        "finding_id": "finding-283b7ef7685272ce8421105a",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Directory-service protocol activity",
        "status": "candidate",
        "metrics": {
          "source": "10.0.76.193",
          "protocol": "ldap",
          "destination": "10.0.76.6",
          "event_count": 41,
          "operation_numbers": [
            "",
            "0",
            "2",
            "3"
          ]
        },
        "rule_id": "directory-service-activity",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 42,
            "display_filter": "frame.number == 42",
            "timestamp_epoch": "1561247190.638496000"
          },
          {
            "tcp_stream": 3,
            "frame_number": 49,
            "display_filter": "frame.number == 49",
            "timestamp_epoch": "1561247190.639779000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 96,
            "display_filter": "frame.number == 96",
            "timestamp_epoch": "1561247190.684945000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 105,
            "display_filter": "frame.number == 105",
            "timestamp_epoch": "1561247190.687689000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 109,
            "display_filter": "frame.number == 109",
            "timestamp_epoch": "1561247190.688549000"
          },
          {
            "tcp_stream": 3,
            "frame_number": 122,
            "display_filter": "frame.number == 122",
            "timestamp_epoch": "1561247190.691003000"
          },
          {
            "tcp_stream": 3,
            "frame_number": 127,
            "display_filter": "frame.number == 127",
            "timestamp_epoch": "1561247190.694001000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 176,
            "display_filter": "frame.number == 176",
            "timestamp_epoch": "1561247190.799581000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 190,
            "display_filter": "frame.number == 190",
            "timestamp_epoch": "1561247190.906269000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 199,
            "display_filter": "frame.number == 199",
            "timestamp_epoch": "1561247190.916424000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 207,
            "display_filter": "frame.number == 207",
            "timestamp_epoch": "1561247190.922205000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 211,
            "display_filter": "frame.number == 211",
            "timestamp_epoch": "1561247190.923506000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 213,
            "display_filter": "frame.number == 213",
            "timestamp_epoch": "1561247190.924477000"
          },
          {
            "tcp_stream": 21,
            "frame_number": 307,
            "display_filter": "frame.number == 307",
            "timestamp_epoch": "1561247195.963025000"
          },
          {
            "tcp_stream": 21,
            "frame_number": 312,
            "display_filter": "frame.number == 312",
            "timestamp_epoch": "1561247195.965138000"
          },
          {
            "tcp_stream": 21,
            "frame_number": 327,
            "display_filter": "frame.number == 327",
            "timestamp_epoch": "1561247195.978166000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 333,
            "display_filter": "frame.number == 333",
            "timestamp_epoch": "1561247195.981704000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 336,
            "display_filter": "frame.number == 336",
            "timestamp_epoch": "1561247195.982838000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 338,
            "display_filter": "frame.number == 338",
            "timestamp_epoch": "1561247195.983365000"
          },
          {
            "tcp_stream": 21,
            "frame_number": 340,
            "display_filter": "frame.number == 340",
            "timestamp_epoch": "1561247195.983883000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 410,
            "display_filter": "frame.number == 410",
            "timestamp_epoch": "1561247196.001696000"
          },
          {
            "tcp_stream": 21,
            "frame_number": 415,
            "display_filter": "frame.number == 415",
            "timestamp_epoch": "1561247196.415353000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 450,
            "display_filter": "frame.number == 450",
            "timestamp_epoch": "1561247201.219766000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 455,
            "display_filter": "frame.number == 455",
            "timestamp_epoch": "1561247201.222477000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 458,
            "display_filter": "frame.number == 458",
            "timestamp_epoch": "1561247201.225763000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 460,
            "display_filter": "frame.number == 460",
            "timestamp_epoch": "1561247201.226122000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 462,
            "display_filter": "frame.number == 462",
            "timestamp_epoch": "1561247201.226490000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 464,
            "display_filter": "frame.number == 464",
            "timestamp_epoch": "1561247201.226890000"
          },
          {
            "tcp_stream": 42,
            "frame_number": 470,
            "display_filter": "frame.number == 470",
            "timestamp_epoch": "1561247201.239312000"
          },
          {
            "tcp_stream": 42,
            "frame_number": 473,
            "display_filter": "frame.number == 473",
            "timestamp_epoch": "1561247201.240493000"
          },
          {
            "tcp_stream": 42,
            "frame_number": 505,
            "display_filter": "frame.number == 505",
            "timestamp_epoch": "1561247201.265590000"
          },
          {
            "tcp_stream": 42,
            "frame_number": 507,
            "display_filter": "frame.number == 507",
            "timestamp_epoch": "1561247201.266519000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 509,
            "display_filter": "frame.number == 509",
            "timestamp_epoch": "1561247201.266980000"
          },
          {
            "tcp_stream": 91,
            "frame_number": 1122,
            "display_filter": "frame.number == 1122",
            "timestamp_epoch": "1561247238.939278000"
          },
          {
            "tcp_stream": 91,
            "frame_number": 1125,
            "display_filter": "frame.number == 1125",
            "timestamp_epoch": "1561247238.941922000"
          },
          {
            "tcp_stream": 93,
            "frame_number": 1131,
            "display_filter": "frame.number == 1131",
            "timestamp_epoch": "1561247238.945123000"
          },
          {
            "tcp_stream": 93,
            "frame_number": 1134,
            "display_filter": "frame.number == 1134",
            "timestamp_epoch": "1561247238.945968000"
          },
          {
            "tcp_stream": 93,
            "frame_number": 1136,
            "display_filter": "frame.number == 1136",
            "timestamp_epoch": "1561247238.946291000"
          },
          {
            "tcp_stream": 91,
            "frame_number": 1138,
            "display_filter": "frame.number == 1138",
            "timestamp_epoch": "1561247238.946754000"
          },
          {
            "tcp_stream": 93,
            "frame_number": 1179,
            "display_filter": "frame.number == 1179",
            "timestamp_epoch": "1561247238.956078000"
          },
          {
            "tcp_stream": 91,
            "frame_number": 1183,
            "display_filter": "frame.number == 1183",
            "timestamp_epoch": "1561247239.477951000"
          }
        ],
        "severity": "low",
        "confidence": 0.95,
        "finding_id": "finding-a618bcdc6a165a0aedbdd0bc",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Directory-service protocol activity",
        "status": "candidate",
        "metrics": {
          "source": "10.0.76.6",
          "protocol": "drsuapi",
          "destination": "10.0.76.109",
          "event_count": 8,
          "operation_numbers": [
            "0",
            "1",
            "12"
          ]
        },
        "rule_id": "directory-service-activity",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 799,
            "display_filter": "frame.number == 799",
            "timestamp_epoch": "1561247225.995391000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 801,
            "display_filter": "frame.number == 801",
            "timestamp_epoch": "1561247225.996028000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 803,
            "display_filter": "frame.number == 803",
            "timestamp_epoch": "1561247225.996422000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 805,
            "display_filter": "frame.number == 805",
            "timestamp_epoch": "1561247225.997719000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1283,
            "display_filter": "frame.number == 1283",
            "timestamp_epoch": "1561247254.210695000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1285,
            "display_filter": "frame.number == 1285",
            "timestamp_epoch": "1561247254.211876000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1287,
            "display_filter": "frame.number == 1287",
            "timestamp_epoch": "1561247254.212899000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 1289,
            "display_filter": "frame.number == 1289",
            "timestamp_epoch": "1561247254.213932000"
          }
        ],
        "severity": "low",
        "confidence": 0.95,
        "finding_id": "finding-6c0240a129c7b4aa8d877a6b",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Directory-service protocol activity",
        "status": "candidate",
        "metrics": {
          "source": "10.0.76.6",
          "protocol": "ldap",
          "destination": "10.0.76.109",
          "event_count": 33,
          "operation_numbers": [
            "",
            "1",
            "4,19,19,19,5",
            "4,5",
            "5"
          ]
        },
        "rule_id": "directory-service-activity",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 591,
            "display_filter": "frame.number == 591",
            "timestamp_epoch": "1561247225.253454000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 626,
            "display_filter": "frame.number == 626",
            "timestamp_epoch": "1561247225.310832000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 628,
            "display_filter": "frame.number == 628",
            "timestamp_epoch": "1561247225.315431000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 630,
            "display_filter": "frame.number == 630",
            "timestamp_epoch": "1561247225.316127000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 700,
            "display_filter": "frame.number == 700",
            "timestamp_epoch": "1561247225.428191000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 717,
            "display_filter": "frame.number == 717",
            "timestamp_epoch": "1561247225.533649000"
          },
          {
            "tcp_stream": 66,
            "frame_number": 726,
            "display_filter": "frame.number == 726",
            "timestamp_epoch": "1561247225.613522000"
          },
          {
            "tcp_stream": 66,
            "frame_number": 743,
            "display_filter": "frame.number == 743",
            "timestamp_epoch": "1561247225.618080000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 753,
            "display_filter": "frame.number == 753",
            "timestamp_epoch": "1561247225.633345000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 761,
            "display_filter": "frame.number == 761",
            "timestamp_epoch": "1561247225.636780000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 763,
            "display_filter": "frame.number == 763",
            "timestamp_epoch": "1561247225.640341000"
          },
          {
            "tcp_stream": 72,
            "frame_number": 818,
            "display_filter": "frame.number == 818",
            "timestamp_epoch": "1561247226.542090000"
          },
          {
            "tcp_stream": 72,
            "frame_number": 823,
            "display_filter": "frame.number == 823",
            "timestamp_epoch": "1561247226.544226000"
          },
          {
            "tcp_stream": 72,
            "frame_number": 837,
            "display_filter": "frame.number == 837",
            "timestamp_epoch": "1561247226.557974000"
          },
          {
            "tcp_stream": 74,
            "frame_number": 844,
            "display_filter": "frame.number == 844",
            "timestamp_epoch": "1561247226.562723000"
          },
          {
            "tcp_stream": 74,
            "frame_number": 846,
            "display_filter": "frame.number == 846",
            "timestamp_epoch": "1561247226.563388000"
          },
          {
            "tcp_stream": 74,
            "frame_number": 848,
            "display_filter": "frame.number == 848",
            "timestamp_epoch": "1561247226.563833000"
          },
          {
            "tcp_stream": 72,
            "frame_number": 850,
            "display_filter": "frame.number == 850",
            "timestamp_epoch": "1561247226.564358000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 982,
            "display_filter": "frame.number == 982",
            "timestamp_epoch": "1561247235.788096000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 987,
            "display_filter": "frame.number == 987",
            "timestamp_epoch": "1561247235.791127000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 989,
            "display_filter": "frame.number == 989",
            "timestamp_epoch": "1561247235.793395000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 991,
            "display_filter": "frame.number == 991",
            "timestamp_epoch": "1561247235.793826000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 993,
            "display_filter": "frame.number == 993",
            "timestamp_epoch": "1561247235.794282000"
          },
          {
            "tcp_stream": 81,
            "frame_number": 995,
            "display_filter": "frame.number == 995",
            "timestamp_epoch": "1561247235.794932000"
          },
          {
            "tcp_stream": 82,
            "frame_number": 1002,
            "display_filter": "frame.number == 1002",
            "timestamp_epoch": "1561247235.811046000"
          },
          {
            "tcp_stream": 82,
            "frame_number": 1004,
            "display_filter": "frame.number == 1004",
            "timestamp_epoch": "1561247235.811890000"
          },
          {
            "tcp_stream": 82,
            "frame_number": 1036,
            "display_filter": "frame.number == 1036",
            "timestamp_epoch": "1561247235.839321000"
          },
          {
            "tcp_stream": 120,
            "frame_number": 1314,
            "display_filter": "frame.number == 1314",
            "timestamp_epoch": "1561247254.753741000"
          },
          {
            "tcp_stream": 120,
            "frame_number": 1316,
            "display_filter": "frame.number == 1316",
            "timestamp_epoch": "1561247254.756137000"
          },
          {
            "tcp_stream": 122,
            "frame_number": 1323,
            "display_filter": "frame.number == 1323",
            "timestamp_epoch": "1561247254.760343000"
          },
          {
            "tcp_stream": 122,
            "frame_number": 1325,
            "display_filter": "frame.number == 1325",
            "timestamp_epoch": "1561247254.760923000"
          },
          {
            "tcp_stream": 122,
            "frame_number": 1327,
            "display_filter": "frame.number == 1327",
            "timestamp_epoch": "1561247254.761352000"
          },
          {
            "tcp_stream": 120,
            "frame_number": 1329,
            "display_filter": "frame.number == 1329",
            "timestamp_epoch": "1561247254.761908000"
          }
        ],
        "severity": "low",
        "confidence": 0.95,
        "finding_id": "finding-c212361993fc784b333b7416",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Directory-service protocol activity",
        "status": "candidate",
        "metrics": {
          "source": "10.0.76.6",
          "protocol": "drsuapi",
          "destination": "10.0.76.193",
          "event_count": 8,
          "operation_numbers": [
            "0",
            "1",
            "12"
          ]
        },
        "rule_id": "directory-service-activity",
        "evidence": [
          {
            "tcp_stream": 17,
            "frame_number": 280,
            "display_filter": "frame.number == 280",
            "timestamp_epoch": "1561247195.377360000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 282,
            "display_filter": "frame.number == 282",
            "timestamp_epoch": "1561247195.377814000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 284,
            "display_filter": "frame.number == 284",
            "timestamp_epoch": "1561247195.378694000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 286,
            "display_filter": "frame.number == 286",
            "timestamp_epoch": "1561247195.379565000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 1097,
            "display_filter": "frame.number == 1097",
            "timestamp_epoch": "1561247238.408275000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 1099,
            "display_filter": "frame.number == 1099",
            "timestamp_epoch": "1561247238.408723000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 1101,
            "display_filter": "frame.number == 1101",
            "timestamp_epoch": "1561247238.409719000"
          },
          {
            "tcp_stream": 17,
            "frame_number": 1103,
            "display_filter": "frame.number == 1103",
            "timestamp_epoch": "1561247238.410174000"
          }
        ],
        "severity": "low",
        "confidence": 0.95,
        "finding_id": "finding-18be0b885eee3250f00e4be1",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Directory-service protocol activity",
        "status": "candidate",
        "metrics": {
          "source": "10.0.76.6",
          "protocol": "ldap",
          "destination": "10.0.76.193",
          "event_count": 33,
          "operation_numbers": [
            "",
            "1",
            "4,19,19,19,5",
            "4,5",
            "5"
          ]
        },
        "rule_id": "directory-service-activity",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 44,
            "display_filter": "frame.number == 44",
            "timestamp_epoch": "1561247190.638685000"
          },
          {
            "tcp_stream": 3,
            "frame_number": 51,
            "display_filter": "frame.number == 51",
            "timestamp_epoch": "1561247190.639984000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 100,
            "display_filter": "frame.number == 100",
            "timestamp_epoch": "1561247190.686329000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 106,
            "display_filter": "frame.number == 106",
            "timestamp_epoch": "1561247190.687959000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 110,
            "display_filter": "frame.number == 110",
            "timestamp_epoch": "1561247190.688858000"
          },
          {
            "tcp_stream": 3,
            "frame_number": 126,
            "display_filter": "frame.number == 126",
            "timestamp_epoch": "1561247190.691781000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 179,
            "display_filter": "frame.number == 179",
            "timestamp_epoch": "1561247190.800082000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 193,
            "display_filter": "frame.number == 193",
            "timestamp_epoch": "1561247190.906887000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 202,
            "display_filter": "frame.number == 202",
            "timestamp_epoch": "1561247190.916914000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 210,
            "display_filter": "frame.number == 210",
            "timestamp_epoch": "1561247190.922623000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 212,
            "display_filter": "frame.number == 212",
            "timestamp_epoch": "1561247190.923773000"
          },
          {
            "tcp_stream": 21,
            "frame_number": 309,
            "display_filter": "frame.number == 309",
            "timestamp_epoch": "1561247195.963407000"
          },
          {
            "tcp_stream": 21,
            "frame_number": 314,
            "display_filter": "frame.number == 314",
            "timestamp_epoch": "1561247195.966028000"
          },
          {
            "tcp_stream": 21,
            "frame_number": 328,
            "display_filter": "frame.number == 328",
            "timestamp_epoch": "1561247195.978569000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 335,
            "display_filter": "frame.number == 335",
            "timestamp_epoch": "1561247195.982464000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 337,
            "display_filter": "frame.number == 337",
            "timestamp_epoch": "1561247195.983111000"
          },
          {
            "tcp_stream": 23,
            "frame_number": 339,
            "display_filter": "frame.number == 339",
            "timestamp_epoch": "1561247195.983604000"
          },
          {
            "tcp_stream": 21,
            "frame_number": 341,
            "display_filter": "frame.number == 341",
            "timestamp_epoch": "1561247195.984193000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 452,
            "display_filter": "frame.number == 452",
            "timestamp_epoch": "1561247201.220000000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 457,
            "display_filter": "frame.number == 457",
            "timestamp_epoch": "1561247201.223376000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 459,
            "display_filter": "frame.number == 459",
            "timestamp_epoch": "1561247201.225935000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 461,
            "display_filter": "frame.number == 461",
            "timestamp_epoch": "1561247201.226316000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 463,
            "display_filter": "frame.number == 463",
            "timestamp_epoch": "1561247201.226701000"
          },
          {
            "tcp_stream": 41,
            "frame_number": 465,
            "display_filter": "frame.number == 465",
            "timestamp_epoch": "1561247201.227478000"
          },
          {
            "tcp_stream": 42,
            "frame_number": 472,
            "display_filter": "frame.number == 472",
            "timestamp_epoch": "1561247201.240050000"
          },
          {
            "tcp_stream": 42,
            "frame_number": 474,
            "display_filter": "frame.number == 474",
            "timestamp_epoch": "1561247201.240689000"
          },
          {
            "tcp_stream": 42,
            "frame_number": 506,
            "display_filter": "frame.number == 506",
            "timestamp_epoch": "1561247201.266284000"
          },
          {
            "tcp_stream": 91,
            "frame_number": 1124,
            "display_filter": "frame.number == 1124",
            "timestamp_epoch": "1561247238.939782000"
          },
          {
            "tcp_stream": 91,
            "frame_number": 1126,
            "display_filter": "frame.number == 1126",
            "timestamp_epoch": "1561247238.942172000"
          },
          {
            "tcp_stream": 93,
            "frame_number": 1133,
            "display_filter": "frame.number == 1133",
            "timestamp_epoch": "1561247238.945589000"
          },
          {
            "tcp_stream": 93,
            "frame_number": 1135,
            "display_filter": "frame.number == 1135",
            "timestamp_epoch": "1561247238.946121000"
          },
          {
            "tcp_stream": 93,
            "frame_number": 1137,
            "display_filter": "frame.number == 1137",
            "timestamp_epoch": "1561247238.946467000"
          },
          {
            "tcp_stream": 91,
            "frame_number": 1139,
            "display_filter": "frame.number == 1139",
            "timestamp_epoch": "1561247238.947071000"
          }
        ],
        "severity": "low",
        "confidence": 0.95,
        "finding_id": "finding-c07541f5320ea483b2e7980d",
        "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
        "rule_version": "pcap-rules-v5"
      }
    ],
    "artifacts": [
      {
        "md5": "4aa3c0266b5cef79849996efce7679d6",
        "sha1": "803183fa83fba219cfbe1fb902cd22d52ad4b88a",
        "type": "http-exported-object",
        "sha256": "3103a01f90e95eef3300a895ab3411575325e0d2a1a4807e2fb5ae8e6f110f99",
        "evidence": [
          {
            "tcp_stream": 138,
            "frame_number": 1449,
            "display_filter": "frame.number == 1449",
            "timestamp_epoch": "1561247261.232626000"
          }
        ],
        "filename": "story-anatomy-beef-cattle-154-104357",
        "filenames": [
          "story-anatomy-beef-cattle-154-104357"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/story-anatomy-beef-cattle-154-104357",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 138,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 1403,
            "response_frame": 1449
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 117009,
        "artifact_id": "artifact-bfa836b5989940b9b854f34a",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 117009,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [
            {
              "offset": 90794,
              "excerpt": "downloadFile",
              "feature": "powershell-download"
            }
          ],
          "content_kind": "script-like-text",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 117009,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "49f65c766a37afefd42941c0197b752a",
        "sha1": "2a4c971012e6f8d48d43193e21d73f547df05989",
        "type": "http-exported-object",
        "sha256": "4fe572e7d49282f6bb5dde888b8e5d06e8264add26b8aebd6b706b79f11d0893",
        "evidence": [
          {
            "tcp_stream": 207,
            "frame_number": 4397,
            "display_filter": "frame.number == 4397",
            "timestamp_epoch": "1561247294.066676000"
          },
          {
            "tcp_stream": 210,
            "frame_number": 4881,
            "display_filter": "frame.number == 4881",
            "timestamp_epoch": "1561247299.346917000"
          }
        ],
        "filename": "%3fMzU4NjA0&kaZDWzI&AkwenzFXp=perpetual&EIDOXmpaHLIMQ=blackmail&PmNkusRzUKjdxi=known&embBMhXHEVqMM=already&nvQgwJI=community&PtVAedNAUU=difference&jDCoPDPCLNkpJ=heartfelt&SJjNZIaGHxK=known&vvHefJ=heartfelt&t4tsdfsg4=PAVMb_q6p3EiEnR6U0pGB_xyNZgITqZucEbg_2l",
        "filenames": [
          "%3fMzU4NjA0&kaZDWzI&AkwenzFXp=perpetual&EIDOXmpaHLIMQ=blackmail&PmNkusRzUKjdxi=known&embBMhXHEVqMM=already&nvQgwJI=community&PtVAedNAUU=difference&jDCoPDPCLNkpJ=heartfelt&SJjNZIaGHxK=known&vvHefJ=heartfelt&t4tsdfsg4=PAVMb_q6p3EiEnR6U0pGB_xyNZgITqZucEbg_2l",
          "%3fNDk4MTE5&tmCVgJMQbeHjv&znbcjFaUOmZy=vest&aTijcut=blackmail&kBgQawTJSFlOAu=difference&NCThQKrrQh=blackmail&lvQmqFyq=constitution&zCrDVEX=known&wLBVVjhJGAWC=detonator&PLFPhyyqZCa=known&lfJYgkH=perpetual&t4tsdfsg4=YPAVwb_q6p3EaEnRGU0p6B_x2NZgMTqZWcEbk_2lv"
        ],
        "transfers": [
          {
            "url": "http://37.46.135.170/?MzU4NjA0&kaZDWzI&AkwenzFXp=perpetual&EIDOXmpaHLIMQ=blackmail&PmNkusRzUKjdxi=known&embBMhXHEVqMM=already&nvQgwJI=community&PtVAedNAUU=difference&jDCoPDPCLNkpJ=heartfelt&SJjNZIaGHxK=known&vvHefJ=heartfelt&t4tsdfsg4=PAVMb_q6p3EiEnR6U0pGB_xyNZgITqZucEbg_2lT3ybZGJsJ1kx_R6GcBxewtW10Z6AwalanCH6fAnUctFEsxYQ&IJbAFjBSlWY=heartfelt&hyYviEG=criticized&ff5sdfds=xHjQMrnYbRbFFYTfKPPEUKNEMUjWA0-KwYmZhafVF5mxFDHGpbX1FxXspVSdCFSEmvRvdLUHIwSh1U3ASwNizYk&SfDdcBJQLntZc=everyone&ZwddKCJISaTB=blackmail&IqnFgRnJ=known&WWmEHUqy=vest&niUheyKPRbLYEdyNjEwOTgy",
            "client_ip": "10.0.76.109",
            "server_ip": "37.46.135.170",
            "tcp_stream": 207,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 3893,
            "response_frame": 4397
          },
          {
            "url": "http://37.46.135.170/?NDk4MTE5&tmCVgJMQbeHjv&znbcjFaUOmZy=vest&aTijcut=blackmail&kBgQawTJSFlOAu=difference&NCThQKrrQh=blackmail&lvQmqFyq=constitution&zCrDVEX=known&wLBVVjhJGAWC=detonator&PLFPhyyqZCa=known&lfJYgkH=perpetual&t4tsdfsg4=YPAVwb_q6p3EaEnRGU0p6B_x2NZgMTqZWcEbk_2lv3ybhGJs11kx_R6GYBxewtUFMT4wMWmKjKHqj58EgwV0sC&nVJnyJYij=vest&eZvTJjAeJ=professional&ISzjHlO=strategy&tAMbBJnq=referred&bwgDFqD=strategy&kdPRkesmuQ=heartfelt&ff5sdfds=xHjQMrbYbRfFFYvfKPzEUKxEMUbWA0GKwYeZhajVF5exFD7Gpbr1FxXspVWdCFWEmvtvdLUHIwuh1UPASwJizY&kxbRJWYrNpZbNlVMzU3NDAz",
            "client_ip": "10.0.76.109",
            "server_ip": "37.46.135.170",
            "tcp_stream": 210,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4417,
            "response_frame": 4881
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 584192,
        "artifact_id": "artifact-fb26f120a8145d416bc13970",
        "occurrences": 2,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": true,
          "identities": [],
          "inspected_bytes": 262144,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 262144,
          "inspection_truncated": true
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "94951087f4fbd935efc4f0ed5e46331f",
        "sha1": "2d499c384d002ee0bd7e0388fff0774cdc92d330",
        "type": "http-exported-object",
        "sha256": "13163ed737fd61106e44f7078caebe16df4549bc45b39c8928a956f987690fee",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6313,
            "display_filter": "frame.number == 6313",
            "timestamp_epoch": "1561247391.480847000"
          }
        ],
        "filename": "markets",
        "filenames": [
          "markets"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/markets",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 227,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6268,
            "response_frame": 6313
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 203254,
        "artifact_id": "artifact-078942d1d3444dd9cc3b7313",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 203254,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 203254,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "f80f55813b04817d9984e7a5527531ca",
        "sha1": "e644217d26c526b926d8a13471b49bf5f11fdbcc",
        "type": "http-exported-object",
        "sha256": "6a77c8ea3af1cd0853993af5fa4724dee868e2c9a285eed61f8d0de3753b40ba",
        "evidence": [
          {
            "tcp_stream": 234,
            "frame_number": 6807,
            "display_filter": "frame.number == 6807",
            "timestamp_epoch": "1561247393.120096000"
          }
        ],
        "filename": "amcharts.js",
        "filenames": [
          "amcharts.js"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/scripts/amcharts/amcharts.js",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 234,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6432,
            "response_frame": 6807
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "text/javascript",
        "size_bytes": 196326,
        "artifact_id": "artifact-293fb56d3b89fa16e22008a4",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 196326,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 196326,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "e611411ad7ea052b8507cf1f34185e04",
        "sha1": "e0ea0914223407e4b5109e0301f7515c4f60dca0",
        "type": "http-exported-object",
        "sha256": "c1f5379165637b2d8c5dea37642242e5aae279d5e2b4b2a00bc2a1f6463f02de",
        "evidence": [
          {
            "tcp_stream": 169,
            "frame_number": 2787,
            "display_filter": "frame.number == 2787",
            "timestamp_epoch": "1561247263.967936000"
          }
        ],
        "filename": "async-ads.js",
        "filenames": [
          "async-ads.js"
        ],
        "transfers": [
          {
            "url": "http://cse.google.com/adsense/search/async-ads.js",
            "client_ip": "10.0.76.193",
            "server_ip": "74.125.136.102",
            "tcp_stream": 169,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2649,
            "response_frame": 2787
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "text/javascript",
        "size_bytes": 170211,
        "artifact_id": "artifact-9513453de3863caf851d60ae",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 170211,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 170211,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "3c26f9d32bf489799f4730d58c6ddf7d",
        "sha1": "f28789fa0dff9d1c3e920fb2de2d447c7077b834",
        "type": "http-exported-object",
        "sha256": "ca5a37a5c3401ffcd1b7c98c3a22a921c013d1121fe33122e94dd81c382bf9b0",
        "evidence": [
          {
            "tcp_stream": 202,
            "frame_number": 3840,
            "display_filter": "frame.number == 3840",
            "timestamp_epoch": "1561247286.918023000"
          }
        ],
        "filename": "%3fMTQwMjg3&ZqHoAiAzR&ff5sdfds=xXjQMvWUbRXQDJ3EKvPcT6NMMVHRFUCL2YedmrHZefjac1WkzrvFTF_7ozKATQSG6_ptdfJ&ZJull=known&ClGaW=known&PETxiFG=community&sMRo=wrapped&HuUMPiKpj=heartfelt&LfBYp=criticized&trlQvmgW=wrapped&t4tsdfsg4=WDQCwhBfTcwJom9xbAw4b8futjEnVzkCb",
        "filenames": [
          "%3fMTQwMjg3&ZqHoAiAzR&ff5sdfds=xXjQMvWUbRXQDJ3EKvPcT6NMMVHRFUCL2YedmrHZefjac1WkzrvFTF_7ozKATQSG6_ptdfJ&ZJull=known&ClGaW=known&PETxiFG=community&sMRo=wrapped&HuUMPiKpj=heartfelt&LfBYp=criticized&trlQvmgW=wrapped&t4tsdfsg4=WDQCwhBfTcwJom9xbAw4b8futjEnVzkCb"
        ],
        "transfers": [
          {
            "url": "http://37.46.135.170/?MTQwMjg3&ZqHoAiAzR&ff5sdfds=xXjQMvWUbRXQDJ3EKvPcT6NMMVHRFUCL2YedmrHZefjac1WkzrvFTF_7ozKATQSG6_ptdfJ&ZJull=known&ClGaW=known&PETxiFG=community&sMRo=wrapped&HuUMPiKpj=heartfelt&LfBYp=criticized&trlQvmgW=wrapped&t4tsdfsg4=WDQCwhBfTcwJom9xbAw4b8futjEnVzkCb1p6H-hGPYwNDrcSdRuVo31ykxrkkQPshg1TH4GI&QVQi=detonator&scUJaJdNW=golfer&eaqBiV=referred&eunX=heartfelt&lTfNSvPso=wrapped&cuxKdC=constitution&TGbNZdI=known&YAVpMLL=difference&KcBDoegcFMTU1OTU1",
            "client_ip": "10.0.76.109",
            "server_ip": "37.46.135.170",
            "tcp_stream": 202,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 3761,
            "response_frame": 3840
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 136566,
        "artifact_id": "artifact-43619bbb20e43b147d798d4a",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 136566,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 136566,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "4f252523d4af0b478c810c2547a63e19",
        "sha1": "5a9dcfbef655a2668e78baebeaa8dc6f41d8dabb",
        "type": "http-exported-object",
        "sha256": "668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404",
        "evidence": [
          {
            "tcp_stream": 140,
            "frame_number": 1524,
            "display_filter": "frame.number == 1524",
            "timestamp_epoch": "1561247261.424777000"
          }
        ],
        "filename": "jquery.min.js",
        "filenames": [
          "jquery.min.js"
        ],
        "transfers": [
          {
            "url": "http://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js",
            "client_ip": "10.0.76.193",
            "server_ip": "172.217.164.74",
            "tcp_stream": 140,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 1462,
            "response_frame": 1524
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "text/javascript",
        "size_bytes": 97163,
        "artifact_id": "artifact-9ee269962e1308e41456b70d",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 97163,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 97163,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "4b3178a05eb4409547c69b1ba2d91ebe",
        "sha1": "7da7214a24bb216ea0af7e681cf6ce47b004fe5c",
        "type": "http-exported-object",
        "sha256": "9bb35e2cb32e2507d2294fda6265966fe617d567b20845d53d2667a150b34311",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6470,
            "display_filter": "frame.number == 6470",
            "timestamp_epoch": "1561247392.063687000"
          }
        ],
        "filename": "bootstrap.js",
        "filenames": [
          "bootstrap.js"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/scripts/bootstrap.js",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 227,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6343,
            "response_frame": 6470
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "text/javascript",
        "size_bytes": 60543,
        "artifact_id": "artifact-d848e4ab570618862acab94f",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 60543,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 60543,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "e9372f0ebbcf71f851e3d321ef2a8e5a",
        "sha1": "2c7d19d1af7d97085c977d1b69dcb8b84483d87c",
        "type": "http-exported-object",
        "sha256": "1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f",
        "evidence": [
          {
            "tcp_stream": 152,
            "frame_number": 1809,
            "display_filter": "frame.number == 1809",
            "timestamp_epoch": "1561247262.362620000"
          }
        ],
        "filename": "ga.js",
        "filenames": [
          "ga.js"
        ],
        "transfers": [
          {
            "url": "http://www.google-analytics.com/ga.js",
            "client_ip": "10.0.76.193",
            "server_ip": "74.125.138.138",
            "tcp_stream": 152,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 1781,
            "response_frame": 1809
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "text/javascript",
        "size_bytes": 46274,
        "artifact_id": "artifact-ed340c9912db63ab0579d21c",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 46274,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 46274,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "d01adfedd3b9213acff9aa48bee9b80c",
        "sha1": "3fb950502b08e96dcb73266ac2ba6b87128495b4",
        "type": "http-exported-object",
        "sha256": "78bcd250cc75ff96fd3f96452b04875ebc3e990f0982f8cb2053c2897a3fde4c",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6560,
            "display_filter": "frame.number == 6560",
            "timestamp_epoch": "1561247392.522006000"
          }
        ],
        "filename": "serial.js",
        "filenames": [
          "serial.js"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/scripts/amcharts/serial.js",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 227,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6475,
            "response_frame": 6560
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "text/javascript",
        "size_bytes": 29452,
        "artifact_id": "artifact-7ca9ad386c26504e01d153ac",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 29452,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 29452,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "c25b36731d52c094ce3491405c06c5dc",
        "sha1": "9dd42fc32af368e3bd0558d071aaa465baadac93",
        "type": "http-exported-object",
        "sha256": "dd4da68f83df075213351c713fa2067594e9ff7a402de406d3fe20f0c2a2f47e",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6363,
            "display_filter": "frame.number == 6363",
            "timestamp_epoch": "1561247391.997255000"
          }
        ],
        "filename": "marketsResponsiveNoSidebar.css",
        "filenames": [
          "marketsResponsiveNoSidebar.css"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/style/marketsResponsiveNoSidebar.css",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 228,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6317,
            "response_frame": 6363
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "text/css",
        "size_bytes": 27596,
        "artifact_id": "artifact-4e8640ffe495b921bea386e4",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 27596,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 27596,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "f96dcfac5f448a5c2dc1048e018658d2",
        "sha1": "16ab4d6f91adf712015d9d9f026582335f431de2",
        "type": "http-exported-object",
        "sha256": "cc900a14f6b6e17c5299c3f619b98ac2048780932d3b409cc9c5be79db70d15a",
        "evidence": [
          {
            "tcp_stream": 148,
            "frame_number": 1734,
            "display_filter": "frame.number == 1734",
            "timestamp_epoch": "1561247261.913335000"
          }
        ],
        "filename": "conversion_async.js",
        "filenames": [
          "conversion_async.js"
        ],
        "transfers": [
          {
            "url": "http://www.googleadservices.com/pagead/conversion_async.js",
            "client_ip": "10.0.76.193",
            "server_ip": "172.217.2.34",
            "tcp_stream": 148,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 1720,
            "response_frame": 1734
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "text/javascript",
        "size_bytes": 23681,
        "artifact_id": "artifact-90055cc96adbf4980921bd4a",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 23681,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23681,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "21067d64142f462995b41bed5ccdf88b",
        "sha1": "df3651cc4299958b13998788bdeac30a022389c4",
        "type": "http-exported-object",
        "sha256": "9a392fadea3ef641a75223fba61b5bc5c4d21c231360fe25d12218288d65ef0d",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6358,
            "display_filter": "frame.number == 6358",
            "timestamp_epoch": "1561247391.997128000"
          }
        ],
        "filename": "markets.css%3fv=1",
        "filenames": [
          "markets.css%3fv=1"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/style/templates/page/markets.css?v=1",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 226,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6286,
            "response_frame": 6358
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23171,
        "artifact_id": "artifact-9360a973f9bd2cbca3b96292",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 23171,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23171,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "601d78b19306deaad10a952262acb9af",
        "sha1": "9da7bb059331f243d319233b11dbd1d0cd565c7b",
        "type": "http-exported-object",
        "sha256": "afa93c8baeaf1c28d1c5646ccdc701c636109bbc765549777a6417fa41fb5d6d",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6514,
            "display_filter": "frame.number == 6514",
            "timestamp_epoch": "1561247392.084851000"
          }
        ],
        "filename": "jquery.selectbox-0.2.js",
        "filenames": [
          "jquery.selectbox-0.2.js"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/scripts/jquery.selectbox-0.2.js",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 226,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6367,
            "response_frame": 6514
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "text/javascript",
        "size_bytes": 15200,
        "artifact_id": "artifact-59493b636033bb38d7f47c2a",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 15200,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 15200,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "4fbe475a6d26f20e2a3f4c8becc0b14f",
        "sha1": "2bb089210e1b25b2823ad69ffedf6c41bbc46e47",
        "type": "http-exported-object",
        "sha256": "39bf8220d772efc49f7a8f0709ac8607af17997d38525eacec1448d5317dcf38",
        "evidence": [
          {
            "tcp_stream": 201,
            "frame_number": 3856,
            "display_filter": "frame.number == 3856",
            "timestamp_epoch": "1561247287.843953000"
          }
        ],
        "filename": "%3fMTg0MzEy&UOViokhlz&aposAqGuAYQhGJO=difference&JhdAxqxZHPMIkeK=difference&dsWGIXdorJRe=detonator&qIHWsvSKCKW=referred&zoZXprPP=known&lbepukXxCTe=vest&WQLDTkVC=heartfelt&hziRqmWCrsMaus=constitution&evkJcGbq=referred&ff5sdfds=w3bQMvXcJxjQFYbGMvzDSKNbNknWH",
        "filenames": [
          "%3fMTg0MzEy&UOViokhlz&aposAqGuAYQhGJO=difference&JhdAxqxZHPMIkeK=difference&dsWGIXdorJRe=detonator&qIHWsvSKCKW=referred&zoZXprPP=known&lbepukXxCTe=vest&WQLDTkVC=heartfelt&hziRqmWCrsMaus=constitution&evkJcGbq=referred&ff5sdfds=w3bQMvXcJxjQFYbGMvzDSKNbNknWH"
        ],
        "transfers": [
          {
            "url": "http://37.46.135.170/?MTg0MzEy&UOViokhlz&aposAqGuAYQhGJO=difference&JhdAxqxZHPMIkeK=difference&dsWGIXdorJRe=detonator&qIHWsvSKCKW=referred&zoZXprPP=known&lbepukXxCTe=vest&WQLDTkVC=heartfelt&hziRqmWCrsMaus=constitution&evkJcGbq=referred&ff5sdfds=w3bQMvXcJxjQFYbGMvzDSKNbNknWHViPxomG9MildZeqZGX_k7vDfF-qoVXcCgWRxfQ&sIusXJLxas=community&DFWEKmZUkxxeB=golfer&t4tsdfsg4=ufOADNQToihfRLwJpzo1fUlIUof-ni0nRyxSa0p7Ur0HeYAMU9qKcELk82VzFjLdTJvs&gSlEAaKzG=criticized&sXTxIOfYGsZL=golfer&qSnbemVoJtsl=criticized&UjrvHHTG=blackmail&bpiAMNrElSNjI0OTM5",
            "client_ip": "10.0.76.109",
            "server_ip": "37.46.135.170",
            "tcp_stream": 201,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 3842,
            "response_frame": 3856
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 9207,
        "artifact_id": "artifact-3f44ba046c1ec869f12ac7b1",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 9207,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 9207,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "3b9f0ae5d1c1a2eb4583c26a7d8be234",
        "sha1": "c9b2961eadf70e89b74c3b6d7433c79110988f39",
        "type": "http-exported-object",
        "sha256": "5d3e3d13333f572afe8df9cd7079c23b1049802e277d2cabce0221e2eaddc807",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6495,
            "display_filter": "frame.number == 6495",
            "timestamp_epoch": "1561247392.074770000"
          }
        ],
        "filename": "tabbedQuotesResponsive.css%3fv=2",
        "filenames": [
          "tabbedQuotesResponsive.css%3fv=2"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/style/templates/controls/tabbedQuotesResponsive.css?v=2",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 228,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6369,
            "response_frame": 6495
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 8436,
        "artifact_id": "artifact-3702932957892b4e90743793",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 8436,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 8436,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "a1b3887a86cf1791f23c0b53b4d3585f",
        "sha1": "692a53cad7f748bc7b691b98b9116ce3269cd22b",
        "type": "http-exported-object",
        "sha256": "3b1ac036763d3a59c88578486ae698d22a37dd2d46a553485e1eabb9fe255b3f",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 7037,
            "display_filter": "frame.number == 7037",
            "timestamp_epoch": "1561247393.928875000"
          }
        ],
        "filename": "ui-icons_222222_256x240.png",
        "filenames": [
          "ui-icons_222222_256x240.png"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/scripts/jquery-ui/images/ui-icons_222222_256x240.png",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 228,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6996,
            "response_frame": 7037
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "image/png",
        "size_bytes": 6922,
        "artifact_id": "artifact-3d0c946d8dfcea9ef7de1fb9",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 6922,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 6922,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "917bc6e18c28339b4b37cdc82e081aa0",
        "sha1": "910e8b22b7b72ce8c88f06e3f6dfe58d2d39a214",
        "type": "http-exported-object",
        "sha256": "9bf59058c99ed3af3b2568fa61791e9b31ca2f85a1a0b630e78449f3598fae33",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6582,
            "display_filter": "frame.number == 6582",
            "timestamp_epoch": "1561247392.522478000"
          }
        ],
        "filename": "options.png",
        "filenames": [
          "options.png"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/images/options.png",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 226,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6520,
            "response_frame": 6582
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "image/png",
        "size_bytes": 5529,
        "artifact_id": "artifact-d081c46b6cb736dd892dd094",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 5529,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 5529,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "8c44f1aeb278b446a54e3f0633b21a6e",
        "sha1": "5d0029490e6f588d9a2573f9e50ef12c85f9f456",
        "type": "http-exported-object",
        "sha256": "a22fdaf4fdff6850730248a8c81a482e2c10bf0f1a5cfb5861dc5893442cf279",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6562,
            "display_filter": "frame.number == 6562",
            "timestamp_epoch": "1561247392.522037000"
          }
        ],
        "filename": "light.js",
        "filenames": [
          "light.js"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/scripts/amcharts/themes/light.js",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 228,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 6497,
            "response_frame": 6562
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "text/javascript",
        "size_bytes": 4148,
        "artifact_id": "artifact-1bff964b5efa1159982dca64",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 4148,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 4148,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "7b57777fcb9e7ff1e92210e10234d229",
        "sha1": "1e86b2bc4fe3a0125a17aad61c47101efdda0ad3",
        "type": "http-exported-object",
        "sha256": "63386b64f7d940f3864917cd9dc6443500ae82f0c717e7a82bec5b7b80361393",
        "evidence": [
          {
            "tcp_stream": 156,
            "frame_number": 1851,
            "display_filter": "frame.number == 1851",
            "timestamp_epoch": "1561247262.733092000"
          }
        ],
        "filename": "all.js",
        "filenames": [
          "all.js"
        ],
        "transfers": [
          {
            "url": "http://connect.facebook.net/en_US/all.js",
            "client_ip": "10.0.76.193",
            "server_ip": "31.13.65.7",
            "tcp_stream": 156,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 1836,
            "response_frame": 1851
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "text/javascript",
        "size_bytes": 3224,
        "artifact_id": "artifact-1596f6c8faa59bdb2bf6ba35",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 3224,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 3224,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "47a8a2fc33e074d4fa87a87f554e52b8",
        "sha1": "82fcd25af93476b243720ab3ef6ee891987b7d32",
        "type": "http-exported-object",
        "sha256": "be7a8e1f7fddc3fd63f2540ea7103ba91c47d55c340504f69b286a64823678a0",
        "evidence": [
          {
            "tcp_stream": 237,
            "frame_number": 6567,
            "display_filter": "frame.number == 6567",
            "timestamp_epoch": "1561247392.522149000"
          }
        ],
        "filename": "arrow-down-large.png",
        "filenames": [
          "arrow-down-large.png"
        ],
        "transfers": [
          {
            "url": "http://portal.farmcentric.com/images/arrow-down-large.png",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 237,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6442,
            "response_frame": 6567
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "image/png",
        "size_bytes": 1251,
        "artifact_id": "artifact-f976540f3de27490134b3a8f",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 1251,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 1251,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "fdf70590e40bca3b6ffbafc3cc43c3cc",
        "sha1": "3c903642f2eca9a59d76a31738ef6b1bc0b5c237",
        "type": "http-exported-object",
        "sha256": "5ce99a897720a7b57ff1da615b9d99b4eb5035ffcfd036e1de93536b507d4089",
        "evidence": [
          {
            "tcp_stream": 236,
            "frame_number": 6565,
            "display_filter": "frame.number == 6565",
            "timestamp_epoch": "1561247392.522118000"
          }
        ],
        "filename": "pointerup.png",
        "filenames": [
          "pointerup.png"
        ],
        "transfers": [
          {
            "url": "http://portal.farmcentric.com/images/pointerup.png",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 236,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6434,
            "response_frame": 6565
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "image/png",
        "size_bytes": 1134,
        "artifact_id": "artifact-53aa6ff3ccd98a7ee0b83fdd",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 1134,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 1134,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "1304e47ee146ad1ccc25aa974d08b2bb",
        "sha1": "33b20577d9526aa2e002bda4e7b0dd623716f9b4",
        "type": "http-exported-object",
        "sha256": "9ed561402e41c753f32f30917a1b1e50ea12c272f203fae74d1cfee3d091da3a",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6983,
            "display_filter": "frame.number == 6983",
            "timestamp_epoch": "1561247393.643447000"
          }
        ],
        "filename": "selectbox-sprite.png",
        "filenames": [
          "selectbox-sprite.png"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/images/selectbox-sprite.png",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 226,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6860,
            "response_frame": 6983
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "image/png",
        "size_bytes": 656,
        "artifact_id": "artifact-1c09fc87aa45983391e360cb",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 656,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 656,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "0ac321c65470aaf896bc1876311feac1",
        "sha1": "ed3a6357e68e3885ccf33c72bbc4bed5040e5815",
        "type": "http-exported-object",
        "sha256": "6d4ae7517a2914b5de787ebe33efc2915d5872f4d0c5839a0f84149adedb306e",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6985,
            "display_filter": "frame.number == 6985",
            "timestamp_epoch": "1561247393.643474000"
          }
        ],
        "filename": "chgUpArrow.png",
        "filenames": [
          "chgUpArrow.png"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/style/templates/images/chgUpArrow.png",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 227,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6854,
            "response_frame": 6985
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "image/png",
        "size_bytes": 652,
        "artifact_id": "artifact-3a15f2a55d87b2b35385a137",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 652,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 652,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "d5bb0e3566d122a3603d7cb05404bd58",
        "sha1": "a8e3b135807d5fd51fa7b280f2df9adfa8ac8143",
        "type": "http-exported-object",
        "sha256": "d428b93962535e52f3631fe647be46828868b6a88e2ecb203c706a86919502a0",
        "evidence": [
          {
            "tcp_stream": 234,
            "frame_number": 6988,
            "display_filter": "frame.number == 6988",
            "timestamp_epoch": "1561247393.643548000"
          }
        ],
        "filename": "chgDnArrow.png",
        "filenames": [
          "chgDnArrow.png"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/style/templates/images/chgDnArrow.png",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 234,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6852,
            "response_frame": 6988
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "image/png",
        "size_bytes": 636,
        "artifact_id": "artifact-4e74bf9d9a5390877a29f752",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 636,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 636,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "c625f8d2e4186d71288c0d0a8256b013",
        "sha1": "1a432047dcfb568db5cbaa3ee2be97d4020bf4a5",
        "type": "http-exported-object",
        "sha256": "96d61a66fda99897f47232a1f3d15fe711fee6726c2e976eed42011948d87049",
        "evidence": [
          {
            "tcp_stream": 211,
            "frame_number": 4896,
            "display_filter": "frame.number == 4896",
            "timestamp_epoch": "1561247303.511633000"
          },
          {
            "tcp_stream": 212,
            "frame_number": 4909,
            "display_filter": "frame.number == 4909",
            "timestamp_epoch": "1561247308.195361000"
          }
        ],
        "filename": "gate(1).php",
        "filenames": [
          "gate(1).php",
          "gate.php"
        ],
        "transfers": [
          {
            "url": "http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php",
            "client_ip": "10.0.76.109",
            "server_ip": "8.209.83.76",
            "tcp_stream": 211,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 4893,
            "response_frame": 4896
          },
          {
            "url": "http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php",
            "client_ip": "10.0.76.109",
            "server_ip": "8.209.83.76",
            "tcp_stream": 212,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 4907,
            "response_frame": 4909
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 340,
        "artifact_id": "artifact-ada0cb60ed4b27d6a996723a",
        "occurrences": 2,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 340,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 340,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "e9d07947ff17487e3d602395bac7fcce",
        "sha1": "56539786a832d295600ea915173fe64c480c7f22",
        "type": "http-exported-object",
        "sha256": "4cfe13f4450dd2250c80995a84e11eff6c3300a17ff3d6518362a2a0696d51da",
        "evidence": [
          {
            "tcp_stream": 256,
            "frame_number": 7026,
            "display_filter": "frame.number == 7026",
            "timestamp_epoch": "1561247393.684728000"
          }
        ],
        "filename": "ui-bg_highlight-soft_75_cccccc_1x100.png",
        "filenames": [
          "ui-bg_highlight-soft_75_cccccc_1x100.png"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/scripts/jquery-ui/images/ui-bg_highlight-soft_75_cccccc_1x100.png",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 256,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6979,
            "response_frame": 7026
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "image/png",
        "size_bytes": 280,
        "artifact_id": "artifact-2dd91157ff265c04e3b706ff",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 280,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 280,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "da3dfa9e609b29a0e29bb75af39cebec",
        "sha1": "bdc92d1acdd555d1542d040bcc5aae52348c6094",
        "type": "http-exported-object",
        "sha256": "4bbea1dbbdc058cc976c290bc9c0f506c6d175011da6fed42a499db1d2377af3",
        "evidence": [
          {
            "tcp_stream": 257,
            "frame_number": 7028,
            "display_filter": "frame.number == 7028",
            "timestamp_epoch": "1561247393.686279000"
          }
        ],
        "filename": "ui-bg_glass_75_e6e6e6_1x400.png",
        "filenames": [
          "ui-bg_glass_75_e6e6e6_1x400.png"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/scripts/jquery-ui/images/ui-bg_glass_75_e6e6e6_1x400.png",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 257,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6998,
            "response_frame": 7028
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "image/png",
        "size_bytes": 262,
        "artifact_id": "artifact-8f2038463fe16d056e955a54",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 262,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 262,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "9fb559a691078558e77d6848202f6541",
        "sha1": "ea13848d33c2c7f4f4baa39348aeb1dbfad3df31",
        "type": "http-exported-object",
        "sha256": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914",
        "evidence": [
          {
            "tcp_stream": 183,
            "frame_number": 3190,
            "display_filter": "frame.number == 3190",
            "timestamp_epoch": "1561247265.507280000"
          },
          {
            "tcp_stream": 205,
            "frame_number": 3883,
            "display_filter": "frame.number == 3883",
            "timestamp_epoch": "1561247289.446572000"
          }
        ],
        "filename": "favicon(1).ico",
        "filenames": [
          "favicon(1).ico",
          "favicon.ico"
        ],
        "transfers": [
          {
            "url": "http://www.bing.com/favicon.ico",
            "client_ip": "10.0.76.193",
            "server_ip": "13.107.21.200",
            "tcp_stream": 183,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 3186,
            "response_frame": 3190
          },
          {
            "url": "http://www.bing.com/favicon.ico",
            "client_ip": "10.0.76.109",
            "server_ip": "13.107.21.200",
            "tcp_stream": 205,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 3879,
            "response_frame": 3883
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "image/vnd.microsoft.icon",
        "size_bytes": 237,
        "artifact_id": "artifact-71f010d9207b4a4535926316",
        "occurrences": 2,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 237,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 237,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "2e084c534bd4a2df7088eef4be117b0a",
        "sha1": "911c2981c458857ec55cf77362a1773808199c68",
        "type": "http-exported-object",
        "sha256": "502de2a45dc07ff1b837e168cbe37ca77056804aff81a5a510cecb199fbde654",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6986,
            "display_filter": "frame.number == 6986",
            "timestamp_epoch": "1561247393.643496000"
          }
        ],
        "filename": "ui-bg_flat_75_ffffff_40x100.png",
        "filenames": [
          "ui-bg_flat_75_ffffff_40x100.png"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/scripts/jquery-ui/images/ui-bg_flat_75_ffffff_40x100.png",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 228,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6862,
            "response_frame": 6986
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "image/png",
        "size_bytes": 208,
        "artifact_id": "artifact-05a6a4e6207e9e2faab94732",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 208,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 208,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "c2db45a8f494c4b40095f4fd38d613fd",
        "sha1": "211639854b03d88502835b2649d42066016fa452",
        "type": "http-exported-object",
        "sha256": "09d46019c7a75b96187202c3c8412182f27c413a9c3661857923dc8e94e91b7b",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6692,
            "display_filter": "frame.number == 6692",
            "timestamp_epoch": "1561247392.627546000"
          }
        ],
        "filename": "clear.gif",
        "filenames": [
          "clear.gif"
        ],
        "transfers": [
          {
            "url": "http://beef2live.com/images/clear.gif",
            "client_ip": "10.0.76.193",
            "server_ip": "35.226.156.55",
            "tcp_stream": 227,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6600,
            "response_frame": 6692
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "image/gif",
        "size_bytes": 67,
        "artifact_id": "artifact-c404cef040cef88c8953ce95",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 67,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 67,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "28d6814f309ea289f847c69cf91194c6",
        "sha1": "0f4e929dd5bb2564f7ab9c76338e04e292a42ace",
        "type": "http-exported-object",
        "sha256": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015",
        "evidence": [
          {
            "tcp_stream": 152,
            "frame_number": 1815,
            "display_filter": "frame.number == 1815",
            "timestamp_epoch": "1561247262.652951000"
          },
          {
            "tcp_stream": 153,
            "frame_number": 1817,
            "display_filter": "frame.number == 1817",
            "timestamp_epoch": "1561247262.654993000"
          },
          {
            "tcp_stream": 232,
            "frame_number": 6389,
            "display_filter": "frame.number == 6389",
            "timestamp_epoch": "1561247392.017412000"
          },
          {
            "tcp_stream": 231,
            "frame_number": 6394,
            "display_filter": "frame.number == 6394",
            "timestamp_epoch": "1561247392.019387000"
          }
        ],
        "filename": "__utm.gif%3futmwv=5.7.2&utms=3&utmn=2054411788&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
        "filenames": [
          "__utm.gif%3futmwv=5.7.2&utms=3&utmn=2054411788&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
          "__utm.gif%3futmwv=5.7.2&utms=4&utmn=1186798248&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
          "__utm.gif%3futmwv=5.7.2&utms=5&utmn=1173868244&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
          "__utm.gif%3futmwv=5.7.2&utms=6&utmn=1716294095&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~"
        ],
        "transfers": [
          {
            "url": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=3&utmn=2054411788&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853867&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
            "client_ip": "10.0.76.193",
            "server_ip": "74.125.138.138",
            "tcp_stream": 152,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 1811,
            "response_frame": 1815
          },
          {
            "url": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=4&utmn=1186798248&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853872&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
            "client_ip": "10.0.76.193",
            "server_ip": "74.125.138.138",
            "tcp_stream": 153,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 1813,
            "response_frame": 1817
          },
          {
            "url": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=5&utmn=1173868244&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982849&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
            "client_ip": "10.0.76.193",
            "server_ip": "74.125.138.138",
            "tcp_stream": 232,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6375,
            "response_frame": 6389
          },
          {
            "url": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=6&utmn=1716294095&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982853&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
            "client_ip": "10.0.76.193",
            "server_ip": "74.125.138.138",
            "tcp_stream": 231,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6379,
            "response_frame": 6394
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 35,
        "artifact_id": "artifact-0de34d07b91296714ae6cd6b",
        "occurrences": 4,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 35,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 35,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "cd5a4d3fdd5bffc16bf959ef75cf37bc",
        "sha1": "33bf88d5b82df3723d5863c7d23445e345828904",
        "type": "http-exported-object",
        "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 433,
            "display_filter": "frame.number == 433",
            "timestamp_epoch": "1561247198.049981000"
          },
          {
            "tcp_stream": 80,
            "frame_number": 961,
            "display_filter": "frame.number == 961",
            "timestamp_epoch": "1561247230.201225000"
          }
        ],
        "filename": "ncsi(1).txt",
        "filenames": [
          "ncsi(1).txt",
          "ncsi.txt"
        ],
        "transfers": [
          {
            "url": "http://www.msftncsi.com/ncsi.txt",
            "client_ip": "10.0.76.193",
            "server_ip": "23.63.249.186",
            "tcp_stream": 30,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 431,
            "response_frame": 433
          },
          {
            "url": "http://www.msftncsi.com/ncsi.txt",
            "client_ip": "10.0.76.109",
            "server_ip": "23.63.249.144",
            "tcp_stream": 80,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 959,
            "response_frame": 961
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "text/plain",
        "size_bytes": 14,
        "artifact_id": "artifact-2dfde564c15965ded8387002",
        "occurrences": 2,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 14,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 14,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "e0aa021e21dddbd6d8cecec71e9cf564",
        "sha1": "9ce3bd4224c8c1780db56b4125ecf3f24bf748b7",
        "type": "http-exported-object",
        "sha256": "565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3",
        "evidence": [
          {
            "tcp_stream": 213,
            "frame_number": 5898,
            "display_filter": "frame.number == 5898",
            "timestamp_epoch": "1561247311.114840000"
          },
          {
            "tcp_stream": 214,
            "frame_number": 5908,
            "display_filter": "frame.number == 5908",
            "timestamp_epoch": "1561247311.862856000"
          }
        ],
        "filename": "gate(2).php",
        "filenames": [
          "gate(2).php",
          "gate(3).php"
        ],
        "transfers": [
          {
            "url": "http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php",
            "client_ip": "10.0.76.109",
            "server_ip": "8.209.83.76",
            "tcp_stream": 213,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 5364,
            "response_frame": 5898
          },
          {
            "url": "http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php",
            "client_ip": "10.0.76.109",
            "server_ip": "8.209.83.76",
            "tcp_stream": 214,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 5852,
            "response_frame": 5908
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 2,
        "artifact_id": "artifact-15b90af1b24b9585837d716a",
        "occurrences": 2,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 2,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 2,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      }
    ],
    "endpoints": [
      {
        "ip": "10.0.76.109",
        "bytes_sent": 837595,
        "ip_version": 4,
        "is_private": true,
        "endpoint_id": "endpoint-6faf994ac3c9aaa478f91c88",
        "packets_sent": 1128,
        "mac_addresses": [
          "78:2b:cb:d4:a5:fe"
        ],
        "bytes_received": 1441998,
        "evidence_frames": [
          511,
          512,
          513,
          514,
          515
        ],
        "last_seen_epoch": "1561247343.457764",
        "first_seen_epoch": "1561247204.640775",
        "packets_received": 1769
      },
      {
        "ip": "10.0.76.193",
        "bytes_sent": 266211,
        "ip_version": 4,
        "is_private": true,
        "endpoint_id": "endpoint-46f78b9de6f8f381ab0123d9",
        "packets_sent": 1889,
        "mac_addresses": [
          "00:1f:cf:61:19:64"
        ],
        "bytes_received": 2034572,
        "evidence_frames": [
          1,
          2,
          3,
          4,
          5
        ],
        "last_seen_epoch": "1561247422.558507",
        "first_seen_epoch": "1561247190.373494",
        "packets_received": 2317
      },
      {
        "ip": "10.0.76.255",
        "bytes_sent": 0,
        "ip_version": 4,
        "is_private": true,
        "endpoint_id": "endpoint-7739119726731513455273e2",
        "packets_sent": 0,
        "mac_addresses": [
          "ff:ff:ff:ff:ff:ff"
        ],
        "bytes_received": 4848,
        "evidence_frames": [
          1,
          2,
          197,
          217,
          218
        ],
        "last_seen_epoch": "1561247309.150698",
        "first_seen_epoch": "1561247190.373494",
        "packets_received": 48
      },
      {
        "ip": "10.0.76.6",
        "bytes_sent": 167583,
        "ip_version": 4,
        "is_private": true,
        "endpoint_id": "endpoint-333a5452e64e989f36bb7a24",
        "packets_sent": 679,
        "mac_addresses": [
          "00:26:b9:30:5c:aa"
        ],
        "bytes_received": 190991,
        "evidence_frames": [
          3,
          4,
          5,
          6,
          7
        ],
        "last_seen_epoch": "1561247392.082847",
        "first_seen_epoch": "1561247190.413389",
        "packets_received": 750
      },
      {
        "ip": "104.244.42.8",
        "bytes_sent": 10344,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-183699010328157e69c885a0",
        "packets_sent": 23,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 3540,
        "evidence_frames": [
          2896,
          2897,
          2934,
          2935,
          2936
        ],
        "last_seen_epoch": "1561247380.621388",
        "first_seen_epoch": "1561247264.158519",
        "packets_received": 26
      },
      {
        "ip": "13.107.21.200",
        "bytes_sent": 1774,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-80ec976c07c0d8284085ec97",
        "packets_sent": 11,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 1314,
        "evidence_frames": [
          3182,
          3183,
          3184,
          3185,
          3186
        ],
        "last_seen_epoch": "1561247385.428514",
        "first_seen_epoch": "1561247265.476066",
        "packets_received": 15
      },
      {
        "ip": "172.217.0.67",
        "bytes_sent": 108,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-046cb4ac0734aeea4876c93b",
        "packets_sent": 2,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 0,
        "evidence_frames": [
          1383,
          1387
        ],
        "last_seen_epoch": "1561247256.944076",
        "first_seen_epoch": "1561247256.8016",
        "packets_received": 0
      },
      {
        "ip": "172.217.0.74",
        "bytes_sent": 9636,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-4d4fb08aed8098bac303d4e1",
        "packets_sent": 30,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 3625,
        "evidence_frames": [
          2643,
          2644,
          2651,
          2652,
          2653
        ],
        "last_seen_epoch": "1561247393.674188",
        "first_seen_epoch": "1561247263.803014",
        "packets_received": 33
      },
      {
        "ip": "172.217.12.110",
        "bytes_sent": 108,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-ddf110b9d127d1ff63033004",
        "packets_sent": 2,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 0,
        "evidence_frames": [
          1211,
          1213
        ],
        "last_seen_epoch": "1561247252.92832",
        "first_seen_epoch": "1561247252.849886",
        "packets_received": 0
      },
      {
        "ip": "172.217.164.66",
        "bytes_sent": 108,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-3a3343b48a966ca99cb3e22a",
        "packets_sent": 2,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 0,
        "evidence_frames": [
          1202,
          1203
        ],
        "last_seen_epoch": "1561247250.240027",
        "first_seen_epoch": "1561247250.209685",
        "packets_received": 0
      },
      {
        "ip": "172.217.164.74",
        "bytes_sent": 36286,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-559a1cf7189ebc21aa806f79",
        "packets_sent": 34,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 2223,
        "evidence_frames": [
          1198,
          1199,
          1455,
          1456,
          1458
        ],
        "last_seen_epoch": "1561247380.640407",
        "first_seen_epoch": "1561247248.84761",
        "packets_received": 34
      },
      {
        "ip": "172.217.2.34",
        "bytes_sent": 10214,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-469a3d7fcdd94f6b9f10da77",
        "packets_sent": 14,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 1137,
        "evidence_frames": [
          1713,
          1714,
          1718,
          1719,
          1720
        ],
        "last_seen_epoch": "1561247380.630543",
        "first_seen_epoch": "1561247261.871722",
        "packets_received": 14
      },
      {
        "ip": "172.217.2.35",
        "bytes_sent": 8651,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-61ea7cd704cecc49adc19240",
        "packets_sent": 20,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 2199,
        "evidence_frames": [
          3101,
          3103,
          3104,
          3105,
          3106
        ],
        "last_seen_epoch": "1561247380.621298",
        "first_seen_epoch": "1561247264.567434",
        "packets_received": 22
      },
      {
        "ip": "173.194.219.154",
        "bytes_sent": 108,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-24dc6f44814026519bb11d72",
        "packets_sent": 2,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 0,
        "evidence_frames": [
          1209,
          1210
        ],
        "last_seen_epoch": "1561247252.526333",
        "first_seen_epoch": "1561247252.470336",
        "packets_received": 0
      },
      {
        "ip": "173.194.219.156",
        "bytes_sent": 11124,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-f96622ee3e00341548d3a842",
        "packets_sent": 30,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 4547,
        "evidence_frames": [
          1739,
          1740,
          1741,
          1742,
          1743
        ],
        "last_seen_epoch": "1561247391.997261",
        "first_seen_epoch": "1561247262.210029",
        "packets_received": 33
      },
      {
        "ip": "173.194.219.94",
        "bytes_sent": 108,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-61d27d2c6e560efa56bcb684",
        "packets_sent": 2,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 0,
        "evidence_frames": [
          1206,
          1374
        ],
        "last_seen_epoch": "1561247255.194635",
        "first_seen_epoch": "1561247250.8215",
        "packets_received": 0
      },
      {
        "ip": "173.194.219.97",
        "bytes_sent": 28797,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-123a9b9034111336d6fba96b",
        "packets_sent": 34,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 2789,
        "evidence_frames": [
          1579,
          1580,
          1581,
          1582,
          1583
        ],
        "last_seen_epoch": "1561247380.633077",
        "first_seen_epoch": "1561247261.62259",
        "packets_received": 32
      },
      {
        "ip": "185.254.190.200",
        "bytes_sent": 54,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-a356b2a05373b17dccf7b1e2",
        "packets_sent": 1,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 0,
        "evidence_frames": [
          6056
        ],
        "last_seen_epoch": "1561247332.777711",
        "first_seen_epoch": "1561247332.777711",
        "packets_received": 0
      },
      {
        "ip": "216.58.193.163",
        "bytes_sent": 78459,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-fea02601c8143c659f3da1bd",
        "packets_sent": 75,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 5825,
        "evidence_frames": [
          2830,
          2831,
          2832,
          2833,
          2834
        ],
        "last_seen_epoch": "1561247380.624478",
        "first_seen_epoch": "1561247264.073453",
        "packets_received": 62
      },
      {
        "ip": "224.0.0.22",
        "bytes_sent": 0,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-97e5a2c3ed8f8af54cd2d957",
        "packets_sent": 0,
        "mac_addresses": [
          "01:00:5e:00:00:16"
        ],
        "bytes_received": 810,
        "evidence_frames": [
          225,
          226,
          237,
          241,
          243
        ],
        "last_seen_epoch": "1561247311.289355",
        "first_seen_epoch": "1561247192.78458",
        "packets_received": 15
      },
      {
        "ip": "224.0.0.252",
        "bytes_sent": 0,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-83b70f0f8e2cd5c4987f2fb0",
        "packets_sent": 0,
        "mac_addresses": [
          "01:00:5e:00:00:fc"
        ],
        "bytes_received": 984,
        "evidence_frames": [
          227,
          232,
          233,
          234,
          245
        ],
        "last_seen_epoch": "1561247227.676289",
        "first_seen_epoch": "1561247192.786579",
        "packets_received": 14
      },
      {
        "ip": "23.63.249.144",
        "bytes_sent": 453,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-e178d464e683232531656b94",
        "packets_sent": 5,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 379,
        "evidence_frames": [
          956,
          957,
          958,
          959,
          960
        ],
        "last_seen_epoch": "1561247230.202477",
        "first_seen_epoch": "1561247230.174944",
        "packets_received": 5
      },
      {
        "ip": "23.63.249.186",
        "bytes_sent": 399,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-37802b0783790c1d1cfb391e",
        "packets_sent": 4,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 379,
        "evidence_frames": [
          428,
          429,
          430,
          431,
          432
        ],
        "last_seen_epoch": "1561247198.050414",
        "first_seen_epoch": "1561247198.02439",
        "packets_received": 5
      },
      {
        "ip": "239.255.255.250",
        "bytes_sent": 0,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-9179b3dc21e94c6ecd9d98af",
        "packets_sent": 0,
        "mac_addresses": [
          "01:00:5e:7f:ff:fa"
        ],
        "bytes_received": 1050,
        "evidence_frames": [
          5905,
          5907,
          5989,
          6002,
          6003
        ],
        "last_seen_epoch": "1561247317.564933",
        "first_seen_epoch": "1561247311.213862",
        "packets_received": 6
      },
      {
        "ip": "255.255.255.255",
        "bytes_sent": 0,
        "ip_version": 4,
        "is_private": true,
        "endpoint_id": "endpoint-bfda0fa2278b3f75245f7960",
        "packets_sent": 0,
        "mac_addresses": [
          "ff:ff:ff:ff:ff:ff"
        ],
        "bytes_received": 1368,
        "evidence_frames": [
          228,
          934,
          1395,
          4887
        ],
        "last_seen_epoch": "1561247302.516656",
        "first_seen_epoch": "1561247192.794459",
        "packets_received": 4
      },
      {
        "ip": "31.13.65.36",
        "bytes_sent": 56540,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-1ceaf9a2ee938eac31f400c1",
        "packets_sent": 102,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 17609,
        "evidence_frames": [
          440,
          441,
          442,
          515,
          516
        ],
        "last_seen_epoch": "1561247395.335609",
        "first_seen_epoch": "1561247200.147469",
        "packets_received": 94
      },
      {
        "ip": "31.13.65.7",
        "bytes_sent": 571430,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-5b04cad9ebb93eaf6364c619",
        "packets_sent": 494,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 26704,
        "evidence_frames": [
          298,
          299,
          418,
          437,
          438
        ],
        "last_seen_epoch": "1561247393.643473",
        "first_seen_epoch": "1561247195.705642",
        "packets_received": 315
      },
      {
        "ip": "35.226.156.55",
        "bytes_sent": 319255,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-a980ac817db7f808437c0e51",
        "packets_sent": 327,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 35100,
        "evidence_frames": [
          1397,
          1398,
          1399,
          1400,
          1401
        ],
        "last_seen_epoch": "1561247393.929204",
        "first_seen_epoch": "1561247260.747036",
        "packets_received": 253
      },
      {
        "ip": "37.46.135.170",
        "bytes_sent": 1276950,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-5e44d2a31ded74e3b058220d",
        "packets_sent": 864,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 12197,
        "evidence_frames": [
          3754,
          3755,
          3757,
          3758,
          3759
        ],
        "last_seen_epoch": "1561247322.572976",
        "first_seen_epoch": "1561247284.940238",
        "packets_received": 167
      },
      {
        "ip": "54.192.207.126",
        "bytes_sent": 136135,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-caa7db3a5cf183f417ff91ae",
        "packets_sent": 121,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 6788,
        "evidence_frames": [
          6510,
          6511,
          6512,
          6513,
          6572
        ],
        "last_seen_epoch": "1561247422.558507",
        "first_seen_epoch": "1561247392.083499",
        "packets_received": 64
      },
      {
        "ip": "64.233.185.101",
        "bytes_sent": 162,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-1f44dceecfb2f7c0a2cd84c9",
        "packets_sent": 3,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 0,
        "evidence_frames": [
          1204,
          1205,
          1212
        ],
        "last_seen_epoch": "1561247252.909391",
        "first_seen_epoch": "1561247250.753254",
        "packets_received": 0
      },
      {
        "ip": "64.233.185.102",
        "bytes_sent": 108,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-4fdda1ad13c7f266faecabbc",
        "packets_sent": 2,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 0,
        "evidence_frames": [
          1207,
          1208
        ],
        "last_seen_epoch": "1561247250.861503",
        "first_seen_epoch": "1561247250.854511",
        "packets_received": 0
      },
      {
        "ip": "64.233.185.103",
        "bytes_sent": 162455,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-23c0c2d5c7a10a91153be1a9",
        "packets_sent": 162,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 17503,
        "evidence_frames": [
          1486,
          1487,
          1520,
          1521,
          1522
        ],
        "last_seen_epoch": "1561247402.128098",
        "first_seen_epoch": "1561247261.393496",
        "packets_received": 107
      },
      {
        "ip": "64.233.185.155",
        "bytes_sent": 7023,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-efaa1b3d4e279f16eb3e5d61",
        "packets_sent": 18,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 2099,
        "evidence_frames": [
          3138,
          3139,
          3140,
          3141,
          3142
        ],
        "last_seen_epoch": "1561247380.621425",
        "first_seen_epoch": "1561247264.726161",
        "packets_received": 20
      },
      {
        "ip": "64.233.185.94",
        "bytes_sent": 205056,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-6c551d834eee4748f51765a5",
        "packets_sent": 153,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 5735,
        "evidence_frames": [
          1384,
          1386,
          1389,
          2108,
          2109
        ],
        "last_seen_epoch": "1561247263.71087",
        "first_seen_epoch": "1561247256.801617",
        "packets_received": 76
      },
      {
        "ip": "64.233.185.95",
        "bytes_sent": 9672,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-282f4df69737c176ae583f67",
        "packets_sent": 16,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 1985,
        "evidence_frames": [
          6392,
          6393,
          6406,
          6407,
          6408
        ],
        "last_seen_epoch": "1561247392.549513",
        "first_seen_epoch": "1561247392.018763",
        "packets_received": 17
      },
      {
        "ip": "72.21.81.200",
        "bytes_sent": 66676,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-b8d164de8dd257a8dacacbde",
        "packets_sent": 71,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 5554,
        "evidence_frames": [
          3897,
          3898,
          3899,
          3900,
          3901
        ],
        "last_seen_epoch": "1561247385.426711",
        "first_seen_epoch": "1561247290.404627",
        "packets_received": 64
      },
      {
        "ip": "72.21.91.66",
        "bytes_sent": 167040,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-8dad8ae9375d6dfe1c8268c4",
        "packets_sent": 130,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 7120,
        "evidence_frames": [
          1858,
          1859,
          1864,
          1865,
          1866
        ],
        "last_seen_epoch": "1561247380.626387",
        "first_seen_epoch": "1561247262.736339",
        "packets_received": 86
      },
      {
        "ip": "74.125.136.101",
        "bytes_sent": 830,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-d86508cc030c471d4feaf1b1",
        "packets_sent": 12,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 1993,
        "evidence_frames": [
          2751,
          2753,
          2776,
          2777,
          2781
        ],
        "last_seen_epoch": "1561247393.617358",
        "first_seen_epoch": "1561247263.910532",
        "packets_received": 16
      },
      {
        "ip": "74.125.136.102",
        "bytes_sent": 80954,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-37b09ef165531314de54fe09",
        "packets_sent": 83,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 6787,
        "evidence_frames": [
          1856,
          1857,
          1867,
          1868,
          1870
        ],
        "last_seen_epoch": "1561247393.068668",
        "first_seen_epoch": "1561247262.734489",
        "packets_received": 77
      },
      {
        "ip": "74.125.136.106",
        "bytes_sent": 216,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-23345234046bb34ac7e6efd4",
        "packets_sent": 4,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 0,
        "evidence_frames": [
          1381,
          1382,
          1385,
          1388
        ],
        "last_seen_epoch": "1561247257.016835",
        "first_seen_epoch": "1561247256.199452",
        "packets_received": 0
      },
      {
        "ip": "74.125.136.95",
        "bytes_sent": 108,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-786de5c7d89decbab1ba5813",
        "packets_sent": 2,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 0,
        "evidence_frames": [
          1214,
          1215
        ],
        "last_seen_epoch": "1561247253.024329",
        "first_seen_epoch": "1561247253.024289",
        "packets_received": 0
      },
      {
        "ip": "74.125.138.138",
        "bytes_sent": 20765,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-46be27ec33541ab099ce17bd",
        "packets_sent": 30,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 5712,
        "evidence_frames": [
          1777,
          1778,
          1779,
          1780,
          1781
        ],
        "last_seen_epoch": "1561247392.019458",
        "first_seen_epoch": "1561247262.317018",
        "packets_received": 34
      },
      {
        "ip": "74.125.138.97",
        "bytes_sent": 108,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-eed5779d5d017a0e35cf7a32",
        "packets_sent": 2,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 0,
        "evidence_frames": [
          1200,
          1201
        ],
        "last_seen_epoch": "1561247249.455782",
        "first_seen_epoch": "1561247249.452518",
        "packets_received": 0
      },
      {
        "ip": "74.125.21.95",
        "bytes_sent": 108,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-5227407747870244cba02e04",
        "packets_sent": 2,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 0,
        "evidence_frames": [
          1390,
          1391
        ],
        "last_seen_epoch": "1561247257.961687",
        "first_seen_epoch": "1561247257.641446",
        "packets_received": 0
      },
      {
        "ip": "8.209.83.76",
        "bytes_sent": 29208,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-4409f2b18502e9826c630b43",
        "packets_sent": 514,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 722195,
        "evidence_frames": [
          4890,
          4891,
          4892,
          4893,
          4894
        ],
        "last_seen_epoch": "1561247311.901045",
        "first_seen_epoch": "1561247302.959767",
        "packets_received": 501
      },
      {
        "ip": "91.235.129.60",
        "bytes_sent": 1457,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-4ce5afcedb4259a21a4b25b1",
        "packets_sent": 4,
        "mac_addresses": [
          "00:0c:31:ec:67:98"
        ],
        "bytes_received": 717,
        "evidence_frames": [
          3744,
          3745,
          3746,
          3747,
          3748
        ],
        "last_seen_epoch": "1561247322.571972",
        "first_seen_epoch": "1561247284.508474",
        "packets_received": 8
      }
    ],
    "identities": [
      {
        "type": "account",
        "value": "bangkok-8ac2-pc$",
        "bindings": [
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 596,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 604,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 606,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 618,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 645,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 653,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 655,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 667,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 679,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 735,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 787,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 831,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 860,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 887,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 899,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 1008,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 1016,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 1018,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 1030,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          }
        ],
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 596,
            "display_filter": "frame.number == 596",
            "timestamp_epoch": "1561247225.272842000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 604,
            "display_filter": "frame.number == 604",
            "timestamp_epoch": "1561247225.296771000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 606,
            "display_filter": "frame.number == 606",
            "timestamp_epoch": "1561247225.297437000"
          },
          {
            "tcp_stream": 58,
            "frame_number": 618,
            "display_filter": "frame.number == 618",
            "timestamp_epoch": "1561247225.301723000"
          },
          {
            "tcp_stream": 60,
            "frame_number": 645,
            "display_filter": "frame.number == 645",
            "timestamp_epoch": "1561247225.351272000"
          },
          {
            "tcp_stream": 61,
            "frame_number": 653,
            "display_filter": "frame.number == 653",
            "timestamp_epoch": "1561247225.369277000"
          },
          {
            "tcp_stream": 61,
            "frame_number": 655,
            "display_filter": "frame.number == 655",
            "timestamp_epoch": "1561247225.369945000"
          },
          {
            "tcp_stream": 62,
            "frame_number": 667,
            "display_filter": "frame.number == 667",
            "timestamp_epoch": "1561247225.373388000"
          },
          {
            "tcp_stream": 63,
            "frame_number": 679,
            "display_filter": "frame.number == 679",
            "timestamp_epoch": "1561247225.376028000"
          },
          {
            "tcp_stream": 67,
            "frame_number": 735,
            "display_filter": "frame.number == 735",
            "timestamp_epoch": "1561247225.616711000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 787,
            "display_filter": "frame.number == 787",
            "timestamp_epoch": "1561247225.992199000"
          },
          {
            "tcp_stream": 73,
            "frame_number": 831,
            "display_filter": "frame.number == 831",
            "timestamp_epoch": "1561247226.554495000"
          },
          {
            "tcp_stream": 75,
            "frame_number": 860,
            "display_filter": "frame.number == 860",
            "timestamp_epoch": "1561247226.567206000"
          },
          {
            "tcp_stream": 78,
            "frame_number": 887,
            "display_filter": "frame.number == 887",
            "timestamp_epoch": "1561247226.570982000"
          },
          {
            "tcp_stream": 79,
            "frame_number": 899,
            "display_filter": "frame.number == 899",
            "timestamp_epoch": "1561247226.571957000"
          },
          {
            "tcp_stream": 83,
            "frame_number": 1008,
            "display_filter": "frame.number == 1008",
            "timestamp_epoch": "1561247235.814031000"
          },
          {
            "tcp_stream": 84,
            "frame_number": 1016,
            "display_filter": "frame.number == 1016",
            "timestamp_epoch": "1561247235.830429000"
          },
          {
            "tcp_stream": 84,
            "frame_number": 1018,
            "display_filter": "frame.number == 1018",
            "timestamp_epoch": "1561247235.830943000"
          },
          {
            "tcp_stream": 85,
            "frame_number": 1030,
            "display_filter": "frame.number == 1030",
            "timestamp_epoch": "1561247235.834929000"
          }
        ],
        "raw_values": [
          "BANGKOK-8AC2-PC$",
          "bangkok-8ac2-pc$"
        ],
        "identity_id": "identity-3b4e0e1f69626a2e1a544253",
        "ip_addresses": [
          "10.0.76.109"
        ],
        "mac_addresses": [
          "78:2b:cb:d4:a5:fe"
        ]
      },
      {
        "type": "account",
        "value": "bristol-c71f-pc$",
        "bindings": [
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 58,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 60,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 72,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 74,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 86,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 94,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 99,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 116,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 146,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 158,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 268,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 322,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 353,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 376,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 388,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 478,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 486,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 488,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 500,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          }
        ],
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 58,
            "display_filter": "frame.number == 58",
            "timestamp_epoch": "1561247190.654488000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 60,
            "display_filter": "frame.number == 60",
            "timestamp_epoch": "1561247190.654791000"
          },
          {
            "tcp_stream": 6,
            "frame_number": 72,
            "display_filter": "frame.number == 72",
            "timestamp_epoch": "1561247190.679536000"
          },
          {
            "tcp_stream": 6,
            "frame_number": 74,
            "display_filter": "frame.number == 74",
            "timestamp_epoch": "1561247190.680344000"
          },
          {
            "tcp_stream": 7,
            "frame_number": 86,
            "display_filter": "frame.number == 86",
            "timestamp_epoch": "1561247190.684221000"
          },
          {
            "tcp_stream": 8,
            "frame_number": 94,
            "display_filter": "frame.number == 94",
            "timestamp_epoch": "1561247190.684817000"
          },
          {
            "tcp_stream": 8,
            "frame_number": 99,
            "display_filter": "frame.number == 99",
            "timestamp_epoch": "1561247190.685721000"
          },
          {
            "tcp_stream": 9,
            "frame_number": 116,
            "display_filter": "frame.number == 116",
            "timestamp_epoch": "1561247190.690029000"
          },
          {
            "tcp_stream": 11,
            "frame_number": 146,
            "display_filter": "frame.number == 146",
            "timestamp_epoch": "1561247190.705390000"
          },
          {
            "tcp_stream": 12,
            "frame_number": 158,
            "display_filter": "frame.number == 158",
            "timestamp_epoch": "1561247190.707948000"
          },
          {
            "tcp_stream": 18,
            "frame_number": 268,
            "display_filter": "frame.number == 268",
            "timestamp_epoch": "1561247195.375306000"
          },
          {
            "tcp_stream": 22,
            "frame_number": 322,
            "display_filter": "frame.number == 322",
            "timestamp_epoch": "1561247195.975858000"
          },
          {
            "tcp_stream": 24,
            "frame_number": 353,
            "display_filter": "frame.number == 353",
            "timestamp_epoch": "1561247195.988468000"
          },
          {
            "tcp_stream": 27,
            "frame_number": 376,
            "display_filter": "frame.number == 376",
            "timestamp_epoch": "1561247195.993262000"
          },
          {
            "tcp_stream": 28,
            "frame_number": 388,
            "display_filter": "frame.number == 388",
            "timestamp_epoch": "1561247195.994851000"
          },
          {
            "tcp_stream": 43,
            "frame_number": 478,
            "display_filter": "frame.number == 478",
            "timestamp_epoch": "1561247201.242454000"
          },
          {
            "tcp_stream": 44,
            "frame_number": 486,
            "display_filter": "frame.number == 486",
            "timestamp_epoch": "1561247201.259385000"
          },
          {
            "tcp_stream": 44,
            "frame_number": 488,
            "display_filter": "frame.number == 488",
            "timestamp_epoch": "1561247201.260143000"
          },
          {
            "tcp_stream": 45,
            "frame_number": 500,
            "display_filter": "frame.number == 500",
            "timestamp_epoch": "1561247201.262387000"
          }
        ],
        "raw_values": [
          "BRISTOL-C71F-PC$",
          "bristol-c71f-pc$"
        ],
        "identity_id": "identity-c756b40bf52b1ffeb5965832",
        "ip_addresses": [
          "10.0.76.193"
        ],
        "mac_addresses": [
          "00:1f:cf:61:19:64"
        ]
      },
      {
        "type": "account",
        "value": "edris.haight",
        "bindings": [
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 1229,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 1237,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 1239,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 1251,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 1271,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 1306,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 1342,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 1354,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.109",
            "conversation_src": "10.0.76.6"
          }
        ],
        "evidence": [
          {
            "tcp_stream": 115,
            "frame_number": 1229,
            "display_filter": "frame.number == 1229",
            "timestamp_epoch": "1561247254.087189000"
          },
          {
            "tcp_stream": 116,
            "frame_number": 1237,
            "display_filter": "frame.number == 1237",
            "timestamp_epoch": "1561247254.107001000"
          },
          {
            "tcp_stream": 116,
            "frame_number": 1239,
            "display_filter": "frame.number == 1239",
            "timestamp_epoch": "1561247254.107597000"
          },
          {
            "tcp_stream": 117,
            "frame_number": 1251,
            "display_filter": "frame.number == 1251",
            "timestamp_epoch": "1561247254.109244000"
          },
          {
            "tcp_stream": 119,
            "frame_number": 1271,
            "display_filter": "frame.number == 1271",
            "timestamp_epoch": "1561247254.199605000"
          },
          {
            "tcp_stream": 121,
            "frame_number": 1306,
            "display_filter": "frame.number == 1306",
            "timestamp_epoch": "1561247254.752212000"
          },
          {
            "tcp_stream": 124,
            "frame_number": 1342,
            "display_filter": "frame.number == 1342",
            "timestamp_epoch": "1561247254.766861000"
          },
          {
            "tcp_stream": 125,
            "frame_number": 1354,
            "display_filter": "frame.number == 1354",
            "timestamp_epoch": "1561247254.767747000"
          }
        ],
        "raw_values": [
          "edris.haight"
        ],
        "identity_id": "identity-46bdca4babd07929ae2ad400",
        "ip_addresses": [
          "10.0.76.109"
        ],
        "mac_addresses": [
          "78:2b:cb:d4:a5:fe"
        ]
      },
      {
        "type": "account",
        "value": "setsuko.overton",
        "bindings": [
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 1044,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 1052,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.6",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 1054,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 1066,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 1085,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 1116,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 1151,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 1163,
            "relationship": "kerberos-client-principal",
            "source_field": "kerberos.CNameString",
            "conversation_dst": "10.0.76.193",
            "conversation_src": "10.0.76.6"
          }
        ],
        "evidence": [
          {
            "tcp_stream": 86,
            "frame_number": 1044,
            "display_filter": "frame.number == 1044",
            "timestamp_epoch": "1561247238.237684000"
          },
          {
            "tcp_stream": 87,
            "frame_number": 1052,
            "display_filter": "frame.number == 1052",
            "timestamp_epoch": "1561247238.251383000"
          },
          {
            "tcp_stream": 87,
            "frame_number": 1054,
            "display_filter": "frame.number == 1054",
            "timestamp_epoch": "1561247238.252081000"
          },
          {
            "tcp_stream": 88,
            "frame_number": 1066,
            "display_filter": "frame.number == 1066",
            "timestamp_epoch": "1561247238.253912000"
          },
          {
            "tcp_stream": 90,
            "frame_number": 1085,
            "display_filter": "frame.number == 1085",
            "timestamp_epoch": "1561247238.403843000"
          },
          {
            "tcp_stream": 92,
            "frame_number": 1116,
            "display_filter": "frame.number == 1116",
            "timestamp_epoch": "1561247238.938637000"
          },
          {
            "tcp_stream": 95,
            "frame_number": 1151,
            "display_filter": "frame.number == 1151",
            "timestamp_epoch": "1561247238.951856000"
          },
          {
            "tcp_stream": 96,
            "frame_number": 1163,
            "display_filter": "frame.number == 1163",
            "timestamp_epoch": "1561247238.952735000"
          }
        ],
        "raw_values": [
          "setsuko.overton"
        ],
        "identity_id": "identity-399638787d1f99cbcf80727c",
        "ip_addresses": [
          "10.0.76.193"
        ],
        "mac_addresses": [
          "00:1f:cf:61:19:64"
        ]
      },
      {
        "type": "hostname",
        "value": "Bangkok-8ac2-PC",
        "bindings": [
          {
            "account": "",
            "owner_ip": "0.0.0.0",
            "frame_number": 934,
            "relationship": "dhcp-client-assertion",
            "source_field": "dhcp.option.hostname",
            "conversation_dst": "255.255.255.255",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "0.0.0.0",
            "frame_number": 4887,
            "relationship": "dhcp-client-assertion",
            "source_field": "dhcp.option.hostname",
            "conversation_dst": "255.255.255.255",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 552,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 771,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 772,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 851,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 923,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 929,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 930,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.109",
            "frame_number": 943,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.109"
          }
        ],
        "evidence": [
          {
            "udp_stream": 49,
            "frame_number": 934,
            "display_filter": "frame.number == 934",
            "timestamp_epoch": "1561247227.558291000"
          },
          {
            "udp_stream": 49,
            "frame_number": 4887,
            "display_filter": "frame.number == 4887",
            "timestamp_epoch": "1561247302.516656000"
          },
          {
            "udp_stream": 33,
            "frame_number": 552,
            "display_filter": "frame.number == 552",
            "timestamp_epoch": "1561247225.057759000"
          },
          {
            "udp_stream": 33,
            "frame_number": 771,
            "display_filter": "frame.number == 771",
            "timestamp_epoch": "1561247225.807661000"
          },
          {
            "udp_stream": 33,
            "frame_number": 772,
            "display_filter": "frame.number == 772",
            "timestamp_epoch": "1561247225.838873000"
          },
          {
            "udp_stream": 33,
            "frame_number": 851,
            "display_filter": "frame.number == 851",
            "timestamp_epoch": "1561247226.565540000"
          },
          {
            "udp_stream": 33,
            "frame_number": 923,
            "display_filter": "frame.number == 923",
            "timestamp_epoch": "1561247226.585875000"
          },
          {
            "udp_stream": 33,
            "frame_number": 929,
            "display_filter": "frame.number == 929",
            "timestamp_epoch": "1561247227.316009000"
          },
          {
            "udp_stream": 33,
            "frame_number": 930,
            "display_filter": "frame.number == 930",
            "timestamp_epoch": "1561247227.336649000"
          },
          {
            "udp_stream": 33,
            "frame_number": 943,
            "display_filter": "frame.number == 943",
            "timestamp_epoch": "1561247228.086314000"
          }
        ],
        "raw_values": [
          "BANGKOK-8AC2-PC<00>,BANGKOK-8AC2-PC<00> (Workstation/Redirector)",
          "BANGKOK-8AC2-PC<20>,BANGKOK-8AC2-PC<20> (Server service)",
          "Bangkok-8ac2-PC"
        ],
        "identity_id": "identity-8c40bbfdca199d9772d479f5",
        "ip_addresses": [
          "10.0.76.109"
        ],
        "mac_addresses": [
          "78:2b:cb:d4:a5:fe",
          "78:2b:cb:d4:a5:fe,78:2b:cb:d4:a5:fe"
        ]
      },
      {
        "type": "hostname",
        "value": "Bristol-c71f-PC",
        "bindings": [
          {
            "account": "",
            "owner_ip": "0.0.0.0",
            "frame_number": 228,
            "relationship": "dhcp-client-assertion",
            "source_field": "dhcp.option.hostname",
            "conversation_dst": "255.255.255.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "0.0.0.0",
            "frame_number": 1395,
            "relationship": "dhcp-client-assertion",
            "source_field": "dhcp.option.hostname",
            "conversation_dst": "255.255.255.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 1,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 197,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 217,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 219,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 221,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 222,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 223,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": "10.0.76.193",
            "frame_number": 236,
            "relationship": "netbios-registration",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.193"
          }
        ],
        "evidence": [
          {
            "udp_stream": 13,
            "frame_number": 228,
            "display_filter": "frame.number == 228",
            "timestamp_epoch": "1561247192.794459000"
          },
          {
            "udp_stream": 13,
            "frame_number": 1395,
            "display_filter": "frame.number == 1395",
            "timestamp_epoch": "1561247260.593550000"
          },
          {
            "udp_stream": 0,
            "frame_number": 1,
            "display_filter": "frame.number == 1",
            "timestamp_epoch": "1561247190.373494000"
          },
          {
            "udp_stream": 0,
            "frame_number": 197,
            "display_filter": "frame.number == 197",
            "timestamp_epoch": "1561247190.909525000"
          },
          {
            "udp_stream": 0,
            "frame_number": 217,
            "display_filter": "frame.number == 217",
            "timestamp_epoch": "1561247191.123489000"
          },
          {
            "udp_stream": 0,
            "frame_number": 219,
            "display_filter": "frame.number == 219",
            "timestamp_epoch": "1561247191.661248000"
          },
          {
            "udp_stream": 0,
            "frame_number": 221,
            "display_filter": "frame.number == 221",
            "timestamp_epoch": "1561247191.880883000"
          },
          {
            "udp_stream": 0,
            "frame_number": 222,
            "display_filter": "frame.number == 222",
            "timestamp_epoch": "1561247192.410617000"
          },
          {
            "udp_stream": 0,
            "frame_number": 223,
            "display_filter": "frame.number == 223",
            "timestamp_epoch": "1561247192.630737000"
          },
          {
            "udp_stream": 0,
            "frame_number": 236,
            "display_filter": "frame.number == 236",
            "timestamp_epoch": "1561247193.161396000"
          }
        ],
        "raw_values": [
          "BRISTOL-C71F-PC<00>,BRISTOL-C71F-PC<00> (Workstation/Redirector)",
          "BRISTOL-C71F-PC<20>,BRISTOL-C71F-PC<20> (Server service)",
          "Bristol-c71f-PC"
        ],
        "identity_id": "identity-3628d47980bcdb97bfc5c6f9",
        "ip_addresses": [
          "10.0.76.193"
        ],
        "mac_addresses": [
          "00:1f:cf:61:19:64",
          "00:1f:cf:61:19:64,00:1f:cf:61:19:64"
        ]
      },
      {
        "type": "netbios-group",
        "value": "PHENOMENOC",
        "bindings": [
          {
            "account": "",
            "owner_ip": null,
            "frame_number": 2,
            "relationship": "group-membership-not-hostname",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": null,
            "frame_number": 218,
            "relationship": "group-membership-not-hostname",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": null,
            "frame_number": 220,
            "relationship": "group-membership-not-hostname",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": null,
            "frame_number": 224,
            "relationship": "group-membership-not-hostname",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.193"
          },
          {
            "account": "",
            "owner_ip": null,
            "frame_number": 553,
            "relationship": "group-membership-not-hostname",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": null,
            "frame_number": 770,
            "relationship": "group-membership-not-hostname",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": null,
            "frame_number": 852,
            "relationship": "group-membership-not-hostname",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.109"
          },
          {
            "account": "",
            "owner_ip": null,
            "frame_number": 928,
            "relationship": "group-membership-not-hostname",
            "source_field": "nbns.name",
            "conversation_dst": "10.0.76.255",
            "conversation_src": "10.0.76.109"
          }
        ],
        "evidence": [
          {
            "udp_stream": 0,
            "frame_number": 2,
            "display_filter": "frame.number == 2",
            "timestamp_epoch": "1561247190.373818000"
          },
          {
            "udp_stream": 0,
            "frame_number": 218,
            "display_filter": "frame.number == 218",
            "timestamp_epoch": "1561247191.123628000"
          },
          {
            "udp_stream": 0,
            "frame_number": 220,
            "display_filter": "frame.number == 220",
            "timestamp_epoch": "1561247191.880698000"
          },
          {
            "udp_stream": 0,
            "frame_number": 224,
            "display_filter": "frame.number == 224",
            "timestamp_epoch": "1561247192.630916000"
          },
          {
            "udp_stream": 33,
            "frame_number": 553,
            "display_filter": "frame.number == 553",
            "timestamp_epoch": "1561247225.058070000"
          },
          {
            "udp_stream": 33,
            "frame_number": 770,
            "display_filter": "frame.number == 770",
            "timestamp_epoch": "1561247225.807529000"
          },
          {
            "udp_stream": 33,
            "frame_number": 852,
            "display_filter": "frame.number == 852",
            "timestamp_epoch": "1561247226.565664000"
          },
          {
            "udp_stream": 33,
            "frame_number": 928,
            "display_filter": "frame.number == 928",
            "timestamp_epoch": "1561247227.315803000"
          }
        ],
        "raw_values": [
          "PHENOMENOC<00>,PHENOMENOC<00> (Workstation/Redirector)"
        ],
        "identity_id": "identity-3de69a19e29de8a8a20d5d66",
        "ip_addresses": [],
        "mac_addresses": []
      }
    ],
    "actor_leads": [],
    "observables": [
      {
        "type": "domain",
        "roles": [
          "dns-cname"
        ],
        "value": "ads-bid.l.doubleclick.net",
        "evidence": [
          {
            "udp_stream": 90,
            "frame_number": 3137,
            "display_filter": "frame.number == 3137",
            "timestamp_epoch": "1561247264.725563000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c3494f4f4cb500cb66a8c46f",
        "last_seen_epoch": "1561247264.725563000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.725563000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "http-host"
        ],
        "value": "ajax.googleapis.com",
        "evidence": [
          {
            "udp_stream": 66,
            "frame_number": 1453,
            "display_filter": "frame.number == 1453",
            "timestamp_epoch": "1561247261.331542000"
          },
          {
            "udp_stream": 66,
            "frame_number": 1454,
            "display_filter": "frame.number == 1454",
            "timestamp_epoch": "1561247261.347284000"
          },
          {
            "tcp_stream": 140,
            "frame_number": 1462,
            "display_filter": "frame.number == 1462",
            "timestamp_epoch": "1561247261.361127000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-12ed60e6c9870ec935eebcb9",
        "last_seen_epoch": "1561247261.361127000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.331542000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query"
        ],
        "value": "api.bing.com",
        "evidence": [
          {
            "udp_stream": 83,
            "frame_number": 2991,
            "display_filter": "frame.number == 2991",
            "timestamp_epoch": "1561247264.369133000"
          },
          {
            "udp_stream": 86,
            "frame_number": 2994,
            "display_filter": "frame.number == 2994",
            "timestamp_epoch": "1561247264.375828000"
          },
          {
            "udp_stream": 86,
            "frame_number": 2997,
            "display_filter": "frame.number == 2997",
            "timestamp_epoch": "1561247264.383906000"
          },
          {
            "udp_stream": 83,
            "frame_number": 2998,
            "display_filter": "frame.number == 2998",
            "timestamp_epoch": "1561247264.383975000"
          },
          {
            "udp_stream": 95,
            "frame_number": 3858,
            "display_filter": "frame.number == 3858",
            "timestamp_epoch": "1561247287.950762000"
          },
          {
            "udp_stream": 95,
            "frame_number": 3859,
            "display_filter": "frame.number == 3859",
            "timestamp_epoch": "1561247287.951071000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-505f30ee3a72798cf9fc57b8",
        "last_seen_epoch": "1561247287.951071000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.369133000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query"
        ],
        "value": "bangkok-8ac2-pc.phenomenoc.com",
        "evidence": [
          {
            "udp_stream": 59,
            "frame_number": 973,
            "display_filter": "frame.number == 973",
            "timestamp_epoch": "1561247232.559801000"
          },
          {
            "udp_stream": 59,
            "frame_number": 974,
            "display_filter": "frame.number == 974",
            "timestamp_epoch": "1561247232.560080000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5e2b1acdbc83afde7ba3247a",
        "last_seen_epoch": "1561247232.560080000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247232.559801000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "http-host",
          "tls-sni"
        ],
        "value": "beef2live.com",
        "evidence": [
          {
            "udp_stream": 65,
            "frame_number": 1392,
            "display_filter": "frame.number == 1392",
            "timestamp_epoch": "1561247260.170668000"
          },
          {
            "udp_stream": 65,
            "frame_number": 1393,
            "display_filter": "frame.number == 1393",
            "timestamp_epoch": "1561247260.170954000"
          },
          {
            "tcp_stream": 138,
            "frame_number": 1403,
            "display_filter": "frame.number == 1403",
            "timestamp_epoch": "1561247260.782613000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6268,
            "display_filter": "frame.number == 6268",
            "timestamp_epoch": "1561247390.600547000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6286,
            "display_filter": "frame.number == 6286",
            "timestamp_epoch": "1561247391.280854000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6317,
            "display_filter": "frame.number == 6317",
            "timestamp_epoch": "1561247391.481400000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6343,
            "display_filter": "frame.number == 6343",
            "timestamp_epoch": "1561247391.619220000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6367,
            "display_filter": "frame.number == 6367",
            "timestamp_epoch": "1561247391.999359000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6369,
            "display_filter": "frame.number == 6369",
            "timestamp_epoch": "1561247391.999939000"
          },
          {
            "tcp_stream": 234,
            "frame_number": 6432,
            "display_filter": "frame.number == 6432",
            "timestamp_epoch": "1561247392.034702000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6475,
            "display_filter": "frame.number == 6475",
            "timestamp_epoch": "1561247392.064267000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6497,
            "display_filter": "frame.number == 6497",
            "timestamp_epoch": "1561247392.075452000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6520,
            "display_filter": "frame.number == 6520",
            "timestamp_epoch": "1561247392.085467000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6600,
            "display_filter": "frame.number == 6600",
            "timestamp_epoch": "1561247392.525706000"
          },
          {
            "tcp_stream": 234,
            "frame_number": 6852,
            "display_filter": "frame.number == 6852",
            "timestamp_epoch": "1561247393.347532000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6854,
            "display_filter": "frame.number == 6854",
            "timestamp_epoch": "1561247393.347726000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6860,
            "display_filter": "frame.number == 6860",
            "timestamp_epoch": "1561247393.479635000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6862,
            "display_filter": "frame.number == 6862",
            "timestamp_epoch": "1561247393.479843000"
          },
          {
            "tcp_stream": 256,
            "frame_number": 6979,
            "display_filter": "frame.number == 6979",
            "timestamp_epoch": "1561247393.631042000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6996,
            "display_filter": "frame.number == 6996",
            "timestamp_epoch": "1561247393.644758000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2ceb202905d8c84afec748bd",
        "last_seen_epoch": "1561247393.644968000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247260.170668000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "bid.g.doubleclick.net",
        "evidence": [
          {
            "udp_stream": 90,
            "frame_number": 3136,
            "display_filter": "frame.number == 3136",
            "timestamp_epoch": "1561247264.705292000"
          },
          {
            "udp_stream": 90,
            "frame_number": 3137,
            "display_filter": "frame.number == 3137",
            "timestamp_epoch": "1561247264.725563000"
          },
          {
            "tcp_stream": 182,
            "frame_number": 3144,
            "display_filter": "frame.number == 3144",
            "timestamp_epoch": "1561247264.740324000"
          },
          {
            "tcp_stream": 181,
            "frame_number": 3146,
            "display_filter": "frame.number == 3146",
            "timestamp_epoch": "1561247264.740416000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-50914840d6b1bc1796be8afb",
        "last_seen_epoch": "1561247264.740416000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.705292000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query"
        ],
        "value": "bristol-c71f-pc.phenomenoc.com",
        "evidence": [
          {
            "udp_stream": 28,
            "frame_number": 420,
            "display_filter": "frame.number == 420",
            "timestamp_epoch": "1561247197.797419000"
          },
          {
            "udp_stream": 28,
            "frame_number": 421,
            "display_filter": "frame.number == 421",
            "timestamp_epoch": "1561247197.797726000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c000a650dcfc46195bc77c9d",
        "last_seen_epoch": "1561247197.797726000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247197.797419000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-cname"
        ],
        "value": "clients.l.google.com",
        "evidence": [
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0dd77ca23ed494a56d67cde3",
        "last_seen_epoch": "1561247263.907326000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247263.907326000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "http-host"
        ],
        "value": "clients1.google.com",
        "evidence": [
          {
            "udp_stream": 80,
            "frame_number": 2692,
            "display_filter": "frame.number == 2692",
            "timestamp_epoch": "1561247263.856760000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          },
          {
            "tcp_stream": 172,
            "frame_number": 2789,
            "display_filter": "frame.number == 2789",
            "timestamp_epoch": "1561247263.972756000"
          },
          {
            "tcp_stream": 254,
            "frame_number": 6941,
            "display_filter": "frame.number == 6941",
            "timestamp_epoch": "1561247393.604635000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b4d36cf7392725e3031efc72",
        "last_seen_epoch": "1561247393.604635000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247263.856760000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "http-host",
          "tls-sni"
        ],
        "value": "connect.facebook.net",
        "evidence": [
          {
            "udp_stream": 73,
            "frame_number": 1819,
            "display_filter": "frame.number == 1819",
            "timestamp_epoch": "1561247262.674584000"
          },
          {
            "udp_stream": 73,
            "frame_number": 1820,
            "display_filter": "frame.number == 1820",
            "timestamp_epoch": "1561247262.695760000"
          },
          {
            "tcp_stream": 156,
            "frame_number": 1836,
            "display_filter": "frame.number == 1836",
            "timestamp_epoch": "1561247262.717994000"
          },
          {
            "tcp_stream": 154,
            "frame_number": 1827,
            "display_filter": "frame.number == 1827",
            "timestamp_epoch": "1561247262.707143000"
          },
          {
            "tcp_stream": 155,
            "frame_number": 1832,
            "display_filter": "frame.number == 1832",
            "timestamp_epoch": "1561247262.712948000"
          },
          {
            "tcp_stream": 161,
            "frame_number": 1920,
            "display_filter": "frame.number == 1920",
            "timestamp_epoch": "1561247262.787382000"
          },
          {
            "tcp_stream": 250,
            "frame_number": 6626,
            "display_filter": "frame.number == 6626",
            "timestamp_epoch": "1561247392.535623000"
          },
          {
            "tcp_stream": 251,
            "frame_number": 6628,
            "display_filter": "frame.number == 6628",
            "timestamp_epoch": "1561247392.535837000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-dd364fb4a11e13825ed77f3f",
        "last_seen_epoch": "1561247392.535837000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.674584000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "http-host",
          "tls-sni"
        ],
        "value": "cse.google.com",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1823,
            "display_filter": "frame.number == 1823",
            "timestamp_epoch": "1561247262.703159000"
          },
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "tcp_stream": 169,
            "frame_number": 2649,
            "display_filter": "frame.number == 2649",
            "timestamp_epoch": "1561247263.809346000"
          },
          {
            "tcp_stream": 157,
            "frame_number": 1878,
            "display_filter": "frame.number == 1878",
            "timestamp_epoch": "1561247262.747786000"
          },
          {
            "tcp_stream": 158,
            "frame_number": 1880,
            "display_filter": "frame.number == 1880",
            "timestamp_epoch": "1561247262.747896000"
          },
          {
            "tcp_stream": 244,
            "frame_number": 6476,
            "display_filter": "frame.number == 6476",
            "timestamp_epoch": "1561247392.064329000"
          },
          {
            "tcp_stream": 245,
            "frame_number": 6481,
            "display_filter": "frame.number == 6481",
            "timestamp_epoch": "1561247392.064892000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-336cfaab65d7dea44104ce02",
        "last_seen_epoch": "1561247392.064892000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.703159000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-cname"
        ],
        "value": "d3569ngd5kwbnf.cloudfront.net",
        "evidence": [
          {
            "udp_stream": 105,
            "frame_number": 6509,
            "display_filter": "frame.number == 6509",
            "timestamp_epoch": "1561247392.082847000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ffcb46a0250fa3bca72c2a13",
        "last_seen_epoch": "1561247392.082847000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.082847000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query"
        ],
        "value": "dns.msftncsi.com",
        "evidence": [
          {
            "udp_stream": 63,
            "frame_number": 1377,
            "display_filter": "frame.number == 1377",
            "timestamp_epoch": "1561247255.291829000"
          },
          {
            "udp_stream": 63,
            "frame_number": 1378,
            "display_filter": "frame.number == 1378",
            "timestamp_epoch": "1561247255.327697000"
          },
          {
            "udp_stream": 64,
            "frame_number": 1379,
            "display_filter": "frame.number == 1379",
            "timestamp_epoch": "1561247255.328144000"
          },
          {
            "udp_stream": 64,
            "frame_number": 1380,
            "display_filter": "frame.number == 1380",
            "timestamp_epoch": "1561247255.328332000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6030d24916c4a3d9b0702da3",
        "last_seen_epoch": "1561247255.328332000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247255.291829000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "http-host"
        ],
        "value": "fghjkmgru34.site",
        "evidence": [
          {
            "udp_stream": 102,
            "frame_number": 4886,
            "display_filter": "frame.number == 4886",
            "timestamp_epoch": "1561247302.513902000"
          },
          {
            "udp_stream": 102,
            "frame_number": 4889,
            "display_filter": "frame.number == 4889",
            "timestamp_epoch": "1561247302.953345000"
          },
          {
            "tcp_stream": 211,
            "frame_number": 4893,
            "display_filter": "frame.number == 4893",
            "timestamp_epoch": "1561247303.076396000"
          },
          {
            "tcp_stream": 212,
            "frame_number": 4907,
            "display_filter": "frame.number == 4907",
            "timestamp_epoch": "1561247307.815439000"
          },
          {
            "tcp_stream": 213,
            "frame_number": 5364,
            "display_filter": "frame.number == 5364",
            "timestamp_epoch": "1561247309.386333000"
          },
          {
            "tcp_stream": 214,
            "frame_number": 5852,
            "display_filter": "frame.number == 5852",
            "timestamp_epoch": "1561247310.208061000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ec14a2b1d76ecd1680d002c9",
        "last_seen_epoch": "1561247310.208061000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247302.513902000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "fonts.googleapis.com",
        "evidence": [
          {
            "udp_stream": 106,
            "frame_number": 6350,
            "display_filter": "frame.number == 6350",
            "timestamp_epoch": "1561247391.626791000"
          },
          {
            "udp_stream": 106,
            "frame_number": 6390,
            "display_filter": "frame.number == 6390",
            "timestamp_epoch": "1561247392.017533000"
          },
          {
            "tcp_stream": 243,
            "frame_number": 6408,
            "display_filter": "frame.number == 6408",
            "timestamp_epoch": "1561247392.030188000"
          },
          {
            "tcp_stream": 242,
            "frame_number": 6416,
            "display_filter": "frame.number == 6416",
            "timestamp_epoch": "1561247392.031356000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1242d7b6dd2587a54dff78a2",
        "last_seen_epoch": "1561247392.031356000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247391.626791000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "fonts.gstatic.com",
        "evidence": [
          {
            "udp_stream": 81,
            "frame_number": 2828,
            "display_filter": "frame.number == 2828",
            "timestamp_epoch": "1561247264.057758000"
          },
          {
            "udp_stream": 81,
            "frame_number": 2829,
            "display_filter": "frame.number == 2829",
            "timestamp_epoch": "1561247264.072915000"
          },
          {
            "tcp_stream": 175,
            "frame_number": 2839,
            "display_filter": "frame.number == 2839",
            "timestamp_epoch": "1561247264.090457000"
          },
          {
            "tcp_stream": 176,
            "frame_number": 2841,
            "display_filter": "frame.number == 2841",
            "timestamp_epoch": "1561247264.090692000"
          },
          {
            "tcp_stream": 174,
            "frame_number": 2843,
            "display_filter": "frame.number == 2843",
            "timestamp_epoch": "1561247264.092729000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-57ffe4ac402911a8768028a2",
        "last_seen_epoch": "1561247264.092729000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.057758000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-cname"
        ],
        "value": "googleadapis.l.google.com",
        "evidence": [
          {
            "udp_stream": 106,
            "frame_number": 6390,
            "display_filter": "frame.number == 6390",
            "timestamp_epoch": "1561247392.017533000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-06d3fdaa42a1a49b9d37f8c7",
        "last_seen_epoch": "1561247392.017533000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.017533000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "googleads.g.doubleclick.net",
        "evidence": [
          {
            "udp_stream": 71,
            "frame_number": 1737,
            "display_filter": "frame.number == 1737",
            "timestamp_epoch": "1561247262.191255000"
          },
          {
            "udp_stream": 71,
            "frame_number": 1738,
            "display_filter": "frame.number == 1738",
            "timestamp_epoch": "1561247262.208719000"
          },
          {
            "tcp_stream": 150,
            "frame_number": 1743,
            "display_filter": "frame.number == 1743",
            "timestamp_epoch": "1561247262.221483000"
          },
          {
            "tcp_stream": 151,
            "frame_number": 1747,
            "display_filter": "frame.number == 1747",
            "timestamp_epoch": "1561247262.222981000"
          },
          {
            "tcp_stream": 229,
            "frame_number": 6325,
            "display_filter": "frame.number == 6325",
            "timestamp_epoch": "1561247391.533388000"
          },
          {
            "tcp_stream": 230,
            "frame_number": 6327,
            "display_filter": "frame.number == 6327",
            "timestamp_epoch": "1561247391.533584000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8a9f7c208658d6d4255f5d9a",
        "last_seen_epoch": "1561247391.533584000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.191255000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-cname"
        ],
        "value": "googleapis.l.google.com",
        "evidence": [
          {
            "udp_stream": 66,
            "frame_number": 1454,
            "display_filter": "frame.number == 1454",
            "timestamp_epoch": "1561247261.347284000"
          },
          {
            "udp_stream": 79,
            "frame_number": 2642,
            "display_filter": "frame.number == 2642",
            "timestamp_epoch": "1561247263.800132000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-dda87fe98c7eaf869d2378c0",
        "last_seen_epoch": "1561247263.800132000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.347284000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-cname"
        ],
        "value": "gstaticadssl.l.google.com",
        "evidence": [
          {
            "udp_stream": 81,
            "frame_number": 2829,
            "display_filter": "frame.number == 2829",
            "timestamp_epoch": "1561247264.072915000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4fd4e6e5b0ad17bad2ddcf0e",
        "last_seen_epoch": "1561247264.072915000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.072915000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "iecvlist.microsoft.com",
        "evidence": [
          {
            "udp_stream": 101,
            "frame_number": 3895,
            "display_filter": "frame.number == 3895",
            "timestamp_epoch": "1561247290.403822000"
          },
          {
            "udp_stream": 101,
            "frame_number": 3896,
            "display_filter": "frame.number == 3896",
            "timestamp_epoch": "1561247290.404107000"
          },
          {
            "udp_stream": 104,
            "frame_number": 5918,
            "display_filter": "frame.number == 5918",
            "timestamp_epoch": "1561247314.083341000"
          },
          {
            "udp_stream": 104,
            "frame_number": 5919,
            "display_filter": "frame.number == 5919",
            "timestamp_epoch": "1561247314.083666000"
          },
          {
            "tcp_stream": 209,
            "frame_number": 3903,
            "display_filter": "frame.number == 3903",
            "timestamp_epoch": "1561247290.450381000"
          },
          {
            "tcp_stream": 208,
            "frame_number": 3905,
            "display_filter": "frame.number == 3905",
            "timestamp_epoch": "1561247290.450632000"
          },
          {
            "tcp_stream": 216,
            "frame_number": 5926,
            "display_filter": "frame.number == 5926",
            "timestamp_epoch": "1561247314.104889000"
          },
          {
            "tcp_stream": 215,
            "frame_number": 5927,
            "display_filter": "frame.number == 5927",
            "timestamp_epoch": "1561247314.104969000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e2c6c44c607f1cc20130b094",
        "last_seen_epoch": "1561247314.104969000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247290.403822000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query"
        ],
        "value": "isatap.localdomain",
        "evidence": [
          {
            "udp_stream": 25,
            "frame_number": 291,
            "display_filter": "frame.number == 291",
            "timestamp_epoch": "1561247195.455927000"
          },
          {
            "udp_stream": 25,
            "frame_number": 292,
            "display_filter": "frame.number == 292",
            "timestamp_epoch": "1561247195.456212000"
          },
          {
            "udp_stream": 55,
            "frame_number": 949,
            "display_filter": "frame.number == 949",
            "timestamp_epoch": "1561247229.003302000"
          },
          {
            "udp_stream": 55,
            "frame_number": 950,
            "display_filter": "frame.number == 950",
            "timestamp_epoch": "1561247229.003560000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f9ec368af37831f934cdd4da",
        "last_seen_epoch": "1561247229.003560000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247195.455927000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query"
        ],
        "value": "isatap.phenomenoc.com",
        "evidence": [
          {
            "udp_stream": 18,
            "frame_number": 242,
            "display_filter": "frame.number == 242",
            "timestamp_epoch": "1561247193.927451000"
          },
          {
            "udp_stream": 18,
            "frame_number": 244,
            "display_filter": "frame.number == 244",
            "timestamp_epoch": "1561247193.927737000"
          },
          {
            "udp_stream": 53,
            "frame_number": 945,
            "display_filter": "frame.number == 945",
            "timestamp_epoch": "1561247228.852283000"
          },
          {
            "udp_stream": 53,
            "frame_number": 946,
            "display_filter": "frame.number == 946",
            "timestamp_epoch": "1561247228.852537000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ac4ccf754406e23ad79ba82d",
        "last_seen_epoch": "1561247228.852537000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247193.927451000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "http-host"
        ],
        "value": "letsdoitquick.site",
        "evidence": [
          {
            "udp_stream": 94,
            "frame_number": 3741,
            "display_filter": "frame.number == 3741",
            "timestamp_epoch": "1561247283.724891000"
          },
          {
            "udp_stream": 94,
            "frame_number": 3742,
            "display_filter": "frame.number == 3742",
            "timestamp_epoch": "1561247283.743525000"
          },
          {
            "tcp_stream": 199,
            "frame_number": 3750,
            "display_filter": "frame.number == 3750",
            "timestamp_epoch": "1561247284.617933000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9bd36e23ee49c9080a9fc85e",
        "last_seen_epoch": "1561247284.617933000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247283.724891000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-cname"
        ],
        "value": "pagead.l.doubleclick.net",
        "evidence": [
          {
            "udp_stream": 70,
            "frame_number": 1711,
            "display_filter": "frame.number == 1711",
            "timestamp_epoch": "1561247261.871130000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-684832355e6dc8201fd6b876",
        "last_seen_epoch": "1561247261.871130000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.871130000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-cname"
        ],
        "value": "pagead46.l.doubleclick.net",
        "evidence": [
          {
            "udp_stream": 71,
            "frame_number": 1738,
            "display_filter": "frame.number == 1738",
            "timestamp_epoch": "1561247262.208719000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-411f70024c6db02ea41b7e39",
        "last_seen_epoch": "1561247262.208719000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.208719000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query"
        ],
        "value": "phenomenoc-dc.phenomenoc.com",
        "evidence": [
          {
            "udp_stream": 2,
            "frame_number": 5,
            "display_filter": "frame.number == 5",
            "timestamp_epoch": "1561247190.433077000"
          },
          {
            "udp_stream": 2,
            "frame_number": 6,
            "display_filter": "frame.number == 6",
            "timestamp_epoch": "1561247190.433338000"
          },
          {
            "udp_stream": 17,
            "frame_number": 239,
            "display_filter": "frame.number == 239",
            "timestamp_epoch": "1561247193.918939000"
          },
          {
            "udp_stream": 17,
            "frame_number": 240,
            "display_filter": "frame.number == 240",
            "timestamp_epoch": "1561247193.919255000"
          },
          {
            "udp_stream": 22,
            "frame_number": 256,
            "display_filter": "frame.number == 256",
            "timestamp_epoch": "1561247195.372409000"
          },
          {
            "udp_stream": 22,
            "frame_number": 257,
            "display_filter": "frame.number == 257",
            "timestamp_epoch": "1561247195.372677000"
          },
          {
            "udp_stream": 36,
            "frame_number": 558,
            "display_filter": "frame.number == 558",
            "timestamp_epoch": "1561247225.116361000"
          },
          {
            "udp_stream": 36,
            "frame_number": 559,
            "display_filter": "frame.number == 559",
            "timestamp_epoch": "1561247225.116693000"
          },
          {
            "udp_stream": 54,
            "frame_number": 947,
            "display_filter": "frame.number == 947",
            "timestamp_epoch": "1561247228.852987000"
          },
          {
            "udp_stream": 54,
            "frame_number": 948,
            "display_filter": "frame.number == 948",
            "timestamp_epoch": "1561247228.853164000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c7ab7b5aa56a3f3a089af1fd",
        "last_seen_epoch": "1561247228.853164000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247190.433077000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query"
        ],
        "value": "phenomenoc.com",
        "evidence": [
          {
            "udp_stream": 29,
            "frame_number": 422,
            "display_filter": "frame.number == 422",
            "timestamp_epoch": "1561247197.798498000"
          },
          {
            "udp_stream": 29,
            "frame_number": 423,
            "display_filter": "frame.number == 423",
            "timestamp_epoch": "1561247197.799092000"
          },
          {
            "udp_stream": 60,
            "frame_number": 975,
            "display_filter": "frame.number == 975",
            "timestamp_epoch": "1561247232.560966000"
          },
          {
            "udp_stream": 60,
            "frame_number": 976,
            "display_filter": "frame.number == 976",
            "timestamp_epoch": "1561247232.561538000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8e49d761240c204e6af8703b",
        "last_seen_epoch": "1561247232.561538000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247197.798498000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "platform.twitter.com",
        "evidence": [
          {
            "udp_stream": 75,
            "frame_number": 1829,
            "display_filter": "frame.number == 1829",
            "timestamp_epoch": "1561247262.710024000"
          },
          {
            "udp_stream": 75,
            "frame_number": 1855,
            "display_filter": "frame.number == 1855",
            "timestamp_epoch": "1561247262.734217000"
          },
          {
            "tcp_stream": 159,
            "frame_number": 1872,
            "display_filter": "frame.number == 1872",
            "timestamp_epoch": "1561247262.746928000"
          },
          {
            "tcp_stream": 160,
            "frame_number": 1875,
            "display_filter": "frame.number == 1875",
            "timestamp_epoch": "1561247262.747182000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7aaa62709fedf9b1f805f872",
        "last_seen_epoch": "1561247262.747182000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.710024000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "http-host",
          "tls-sni"
        ],
        "value": "portal.farmcentric.com",
        "evidence": [
          {
            "udp_stream": 68,
            "frame_number": 1510,
            "display_filter": "frame.number == 1510",
            "timestamp_epoch": "1561247261.417408000"
          },
          {
            "udp_stream": 68,
            "frame_number": 1511,
            "display_filter": "frame.number == 1511",
            "timestamp_epoch": "1561247261.417763000"
          },
          {
            "tcp_stream": 236,
            "frame_number": 6434,
            "display_filter": "frame.number == 6434",
            "timestamp_epoch": "1561247392.034821000"
          },
          {
            "tcp_stream": 237,
            "frame_number": 6442,
            "display_filter": "frame.number == 6442",
            "timestamp_epoch": "1561247392.036635000"
          },
          {
            "tcp_stream": 144,
            "frame_number": 1530,
            "display_filter": "frame.number == 1530",
            "timestamp_epoch": "1561247261.495740000"
          },
          {
            "tcp_stream": 145,
            "frame_number": 1536,
            "display_filter": "frame.number == 1536",
            "timestamp_epoch": "1561247261.496614000"
          },
          {
            "tcp_stream": 238,
            "frame_number": 6422,
            "display_filter": "frame.number == 6422",
            "timestamp_epoch": "1561247392.032145000"
          },
          {
            "tcp_stream": 239,
            "frame_number": 6438,
            "display_filter": "frame.number == 6438",
            "timestamp_epoch": "1561247392.035174000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a1f1511a10bcc4826c1f015d",
        "last_seen_epoch": "1561247392.036635000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.417408000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-cname"
        ],
        "value": "scontent.xx.fbcdn.net",
        "evidence": [
          {
            "udp_stream": 73,
            "frame_number": 1820,
            "display_filter": "frame.number == 1820",
            "timestamp_epoch": "1561247262.695760000"
          },
          {
            "udp_stream": 77,
            "frame_number": 2369,
            "display_filter": "frame.number == 2369",
            "timestamp_epoch": "1561247263.378913000"
          },
          {
            "udp_stream": 93,
            "frame_number": 3309,
            "display_filter": "frame.number == 3309",
            "timestamp_epoch": "1561247270.428911000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-08f912818278a2042e9f225b",
        "last_seen_epoch": "1561247270.428911000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.695760000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "ssl.gstatic.com",
        "evidence": [
          {
            "udp_stream": 89,
            "frame_number": 3092,
            "display_filter": "frame.number == 3092",
            "timestamp_epoch": "1561247264.551377000"
          },
          {
            "udp_stream": 89,
            "frame_number": 3099,
            "display_filter": "frame.number == 3099",
            "timestamp_epoch": "1561247264.566187000"
          },
          {
            "tcp_stream": 179,
            "frame_number": 3108,
            "display_filter": "frame.number == 3108",
            "timestamp_epoch": "1561247264.582974000"
          },
          {
            "tcp_stream": 180,
            "frame_number": 3110,
            "display_filter": "frame.number == 3110",
            "timestamp_epoch": "1561247264.583905000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-49c3e0b75c93b65d2059a325",
        "last_seen_epoch": "1561247264.583905000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.551377000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-cname"
        ],
        "value": "star-mini.c10r.facebook.com",
        "evidence": [
          {
            "udp_stream": 92,
            "frame_number": 3210,
            "display_filter": "frame.number == 3210",
            "timestamp_epoch": "1561247270.199357000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-fa648015342403ba8ff0a02d",
        "last_seen_epoch": "1561247270.199357000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247270.199357000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "static.xx.fbcdn.net",
        "evidence": [
          {
            "udp_stream": 93,
            "frame_number": 3308,
            "display_filter": "frame.number == 3308",
            "timestamp_epoch": "1561247270.428637000"
          },
          {
            "udp_stream": 93,
            "frame_number": 3309,
            "display_filter": "frame.number == 3309",
            "timestamp_epoch": "1561247270.428911000"
          },
          {
            "tcp_stream": 194,
            "frame_number": 3351,
            "display_filter": "frame.number == 3351",
            "timestamp_epoch": "1561247270.468082000"
          },
          {
            "tcp_stream": 197,
            "frame_number": 3712,
            "display_filter": "frame.number == 3712",
            "timestamp_epoch": "1561247273.454412000"
          },
          {
            "tcp_stream": 198,
            "frame_number": 3713,
            "display_filter": "frame.number == 3713",
            "timestamp_epoch": "1561247273.454524000"
          },
          {
            "tcp_stream": 196,
            "frame_number": 3715,
            "display_filter": "frame.number == 3715",
            "timestamp_epoch": "1561247273.454705000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f53cb88e0f287afca2727cbe",
        "last_seen_epoch": "1561247273.454705000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247270.428637000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "staticxx.facebook.com",
        "evidence": [
          {
            "udp_stream": 77,
            "frame_number": 2368,
            "display_filter": "frame.number == 2368",
            "timestamp_epoch": "1561247263.378660000"
          },
          {
            "udp_stream": 77,
            "frame_number": 2369,
            "display_filter": "frame.number == 2369",
            "timestamp_epoch": "1561247263.378913000"
          },
          {
            "tcp_stream": 167,
            "frame_number": 3049,
            "display_filter": "frame.number == 3049",
            "timestamp_epoch": "1561247264.452287000"
          },
          {
            "tcp_stream": 185,
            "frame_number": 3201,
            "display_filter": "frame.number == 3201",
            "timestamp_epoch": "1561247266.398278000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f1d2c97a7177fd6b7088dae8",
        "last_seen_epoch": "1561247266.398278000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247263.378660000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "syndication.twitter.com",
        "evidence": [
          {
            "udp_stream": 82,
            "frame_number": 2894,
            "display_filter": "frame.number == 2894",
            "timestamp_epoch": "1561247264.157893000"
          },
          {
            "udp_stream": 82,
            "frame_number": 2895,
            "display_filter": "frame.number == 2895",
            "timestamp_epoch": "1561247264.158140000"
          },
          {
            "tcp_stream": 178,
            "frame_number": 2963,
            "display_filter": "frame.number == 2963",
            "timestamp_epoch": "1561247264.272189000"
          },
          {
            "tcp_stream": 177,
            "frame_number": 2965,
            "display_filter": "frame.number == 2965",
            "timestamp_epoch": "1561247264.272415000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a8f99ff977c4f409ba97d115",
        "last_seen_epoch": "1561247264.272415000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.157893000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query"
        ],
        "value": "wpad.localdomain",
        "evidence": [
          {
            "udp_stream": 21,
            "frame_number": 255,
            "display_filter": "frame.number == 255",
            "timestamp_epoch": "1561247195.371989000"
          },
          {
            "udp_stream": 21,
            "frame_number": 287,
            "display_filter": "frame.number == 287",
            "timestamp_epoch": "1561247195.395072000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4d0aeb5e2f6db5d9e98fccca",
        "last_seen_epoch": "1561247195.395072000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247195.371989000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query"
        ],
        "value": "wpad.phenomenoc.com",
        "evidence": [
          {
            "udp_stream": 15,
            "frame_number": 230,
            "display_filter": "frame.number == 230",
            "timestamp_epoch": "1561247192.798982000"
          },
          {
            "udp_stream": 15,
            "frame_number": 231,
            "display_filter": "frame.number == 231",
            "timestamp_epoch": "1561247192.799167000"
          },
          {
            "udp_stream": 20,
            "frame_number": 251,
            "display_filter": "frame.number == 251",
            "timestamp_epoch": "1561247195.371302000"
          },
          {
            "udp_stream": 20,
            "frame_number": 253,
            "display_filter": "frame.number == 253",
            "timestamp_epoch": "1561247195.371564000"
          },
          {
            "udp_stream": 51,
            "frame_number": 936,
            "display_filter": "frame.number == 936",
            "timestamp_epoch": "1561247227.565048000"
          },
          {
            "udp_stream": 51,
            "frame_number": 937,
            "display_filter": "frame.number == 937",
            "timestamp_epoch": "1561247227.565241000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c8ed365eb82ae8505eb49d08",
        "last_seen_epoch": "1561247227.565241000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247192.798982000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-cname"
        ],
        "value": "www-google-analytics.l.google.com",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8924766a99421667cea60a8f",
        "last_seen_epoch": "1561247262.316189000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.316189000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-cname"
        ],
        "value": "www-googletagmanager.l.google.com",
        "evidence": [
          {
            "udp_stream": 69,
            "frame_number": 1578,
            "display_filter": "frame.number == 1578",
            "timestamp_epoch": "1561247261.621737000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-62b120eae41d9e2bab3bf8b7",
        "last_seen_epoch": "1561247261.621737000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.621737000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "http-host"
        ],
        "value": "www.bing.com",
        "evidence": [
          {
            "udp_stream": 84,
            "frame_number": 2992,
            "display_filter": "frame.number == 2992",
            "timestamp_epoch": "1561247264.372990000"
          },
          {
            "udp_stream": 85,
            "frame_number": 2993,
            "display_filter": "frame.number == 2993",
            "timestamp_epoch": "1561247264.374122000"
          },
          {
            "udp_stream": 87,
            "frame_number": 2995,
            "display_filter": "frame.number == 2995",
            "timestamp_epoch": "1561247264.376745000"
          },
          {
            "udp_stream": 88,
            "frame_number": 2996,
            "display_filter": "frame.number == 2996",
            "timestamp_epoch": "1561247264.377965000"
          },
          {
            "udp_stream": 85,
            "frame_number": 3036,
            "display_filter": "frame.number == 3036",
            "timestamp_epoch": "1561247264.439549000"
          },
          {
            "udp_stream": 87,
            "frame_number": 3037,
            "display_filter": "frame.number == 3037",
            "timestamp_epoch": "1561247264.439629000"
          },
          {
            "udp_stream": 88,
            "frame_number": 3038,
            "display_filter": "frame.number == 3038",
            "timestamp_epoch": "1561247264.439693000"
          },
          {
            "udp_stream": 84,
            "frame_number": 3039,
            "display_filter": "frame.number == 3039",
            "timestamp_epoch": "1561247264.439764000"
          },
          {
            "udp_stream": 91,
            "frame_number": 3180,
            "display_filter": "frame.number == 3180",
            "timestamp_epoch": "1561247265.431804000"
          },
          {
            "udp_stream": 91,
            "frame_number": 3181,
            "display_filter": "frame.number == 3181",
            "timestamp_epoch": "1561247265.473452000"
          },
          {
            "udp_stream": 96,
            "frame_number": 3860,
            "display_filter": "frame.number == 3860",
            "timestamp_epoch": "1561247287.954342000"
          },
          {
            "udp_stream": 97,
            "frame_number": 3861,
            "display_filter": "frame.number == 3861",
            "timestamp_epoch": "1561247287.954812000"
          },
          {
            "udp_stream": 98,
            "frame_number": 3862,
            "display_filter": "frame.number == 3862",
            "timestamp_epoch": "1561247287.956352000"
          },
          {
            "udp_stream": 99,
            "frame_number": 3863,
            "display_filter": "frame.number == 3863",
            "timestamp_epoch": "1561247287.957364000"
          },
          {
            "udp_stream": 97,
            "frame_number": 3865,
            "display_filter": "frame.number == 3865",
            "timestamp_epoch": "1561247288.316485000"
          },
          {
            "udp_stream": 98,
            "frame_number": 3866,
            "display_filter": "frame.number == 3866",
            "timestamp_epoch": "1561247288.316682000"
          },
          {
            "udp_stream": 99,
            "frame_number": 3867,
            "display_filter": "frame.number == 3867",
            "timestamp_epoch": "1561247288.316802000"
          },
          {
            "udp_stream": 96,
            "frame_number": 3868,
            "display_filter": "frame.number == 3868",
            "timestamp_epoch": "1561247288.316915000"
          },
          {
            "udp_stream": 100,
            "frame_number": 3871,
            "display_filter": "frame.number == 3871",
            "timestamp_epoch": "1561247289.198960000"
          },
          {
            "udp_stream": 100,
            "frame_number": 3874,
            "display_filter": "frame.number == 3874",
            "timestamp_epoch": "1561247289.399319000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-67aeec17c77d6c3acb0a47e3",
        "last_seen_epoch": "1561247289.412234000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.372990000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "www.facebook.com",
        "evidence": [
          {
            "udp_stream": 78,
            "frame_number": 2473,
            "display_filter": "frame.number == 2473",
            "timestamp_epoch": "1561247263.513314000"
          },
          {
            "udp_stream": 78,
            "frame_number": 3065,
            "display_filter": "frame.number == 3065",
            "timestamp_epoch": "1561247264.503993000"
          },
          {
            "udp_stream": 78,
            "frame_number": 3192,
            "display_filter": "frame.number == 3192",
            "timestamp_epoch": "1561247265.512123000"
          },
          {
            "udp_stream": 78,
            "frame_number": 3207,
            "display_filter": "frame.number == 3207",
            "timestamp_epoch": "1561247267.524486000"
          },
          {
            "udp_stream": 78,
            "frame_number": 3208,
            "display_filter": "frame.number == 3208",
            "timestamp_epoch": "1561247270.164049000"
          },
          {
            "udp_stream": 92,
            "frame_number": 3209,
            "display_filter": "frame.number == 3209",
            "timestamp_epoch": "1561247270.166321000"
          },
          {
            "udp_stream": 92,
            "frame_number": 3210,
            "display_filter": "frame.number == 3210",
            "timestamp_epoch": "1561247270.199357000"
          },
          {
            "tcp_stream": 186,
            "frame_number": 3225,
            "display_filter": "frame.number == 3225",
            "timestamp_epoch": "1561247270.223580000"
          },
          {
            "tcp_stream": 190,
            "frame_number": 3227,
            "display_filter": "frame.number == 3227",
            "timestamp_epoch": "1561247270.223785000"
          },
          {
            "tcp_stream": 188,
            "frame_number": 3230,
            "display_filter": "frame.number == 3230",
            "timestamp_epoch": "1561247270.224180000"
          },
          {
            "tcp_stream": 187,
            "frame_number": 3231,
            "display_filter": "frame.number == 3231",
            "timestamp_epoch": "1561247270.224254000"
          },
          {
            "tcp_stream": 195,
            "frame_number": 3697,
            "display_filter": "frame.number == 3697",
            "timestamp_epoch": "1561247273.219467000"
          },
          {
            "tcp_stream": 259,
            "frame_number": 7010,
            "display_filter": "frame.number == 7010",
            "timestamp_epoch": "1561247393.665953000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 7011,
            "display_filter": "frame.number == 7011",
            "timestamp_epoch": "1561247393.666065000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2685e049a88c8636c938ff9a",
        "last_seen_epoch": "1561247393.666065000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247263.513314000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "www.farmprogress.com",
        "evidence": [
          {
            "udp_stream": 105,
            "frame_number": 6347,
            "display_filter": "frame.number == 6347",
            "timestamp_epoch": "1561247391.622604000"
          },
          {
            "udp_stream": 105,
            "frame_number": 6509,
            "display_filter": "frame.number == 6509",
            "timestamp_epoch": "1561247392.082847000"
          },
          {
            "tcp_stream": 246,
            "frame_number": 6610,
            "display_filter": "frame.number == 6610",
            "timestamp_epoch": "1561247392.529697000"
          },
          {
            "tcp_stream": 247,
            "frame_number": 6618,
            "display_filter": "frame.number == 6618",
            "timestamp_epoch": "1561247392.533958000"
          },
          {
            "tcp_stream": 248,
            "frame_number": 6622,
            "display_filter": "frame.number == 6622",
            "timestamp_epoch": "1561247392.534881000"
          },
          {
            "tcp_stream": 249,
            "frame_number": 6624,
            "display_filter": "frame.number == 6624",
            "timestamp_epoch": "1561247392.535330000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e4af5e4947b0823ba1a1c300",
        "last_seen_epoch": "1561247392.535330000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247391.622604000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "http-host"
        ],
        "value": "www.google-analytics.com",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1773,
            "display_filter": "frame.number == 1773",
            "timestamp_epoch": "1561247262.297156000"
          },
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          },
          {
            "tcp_stream": 152,
            "frame_number": 1781,
            "display_filter": "frame.number == 1781",
            "timestamp_epoch": "1561247262.327050000"
          },
          {
            "tcp_stream": 152,
            "frame_number": 1811,
            "display_filter": "frame.number == 1811",
            "timestamp_epoch": "1561247262.637770000"
          },
          {
            "tcp_stream": 153,
            "frame_number": 1813,
            "display_filter": "frame.number == 1813",
            "timestamp_epoch": "1561247262.641599000"
          },
          {
            "tcp_stream": 232,
            "frame_number": 6375,
            "display_filter": "frame.number == 6375",
            "timestamp_epoch": "1561247392.006900000"
          },
          {
            "tcp_stream": 231,
            "frame_number": 6379,
            "display_filter": "frame.number == 6379",
            "timestamp_epoch": "1561247392.007298000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-285e869b296e4a7d8dc5e798",
        "last_seen_epoch": "1561247392.007298000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.297156000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "www.google.com",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1464,
            "display_filter": "frame.number == 1464",
            "timestamp_epoch": "1561247261.365825000"
          },
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          },
          {
            "tcp_stream": 143,
            "frame_number": 1532,
            "display_filter": "frame.number == 1532",
            "timestamp_epoch": "1561247261.496133000"
          },
          {
            "tcp_stream": 142,
            "frame_number": 1534,
            "display_filter": "frame.number == 1534",
            "timestamp_epoch": "1561247261.496408000"
          },
          {
            "tcp_stream": 165,
            "frame_number": 2344,
            "display_filter": "frame.number == 2344",
            "timestamp_epoch": "1561247263.333716000"
          },
          {
            "tcp_stream": 240,
            "frame_number": 6383,
            "display_filter": "frame.number == 6383",
            "timestamp_epoch": "1561247392.014828000"
          },
          {
            "tcp_stream": 241,
            "frame_number": 6387,
            "display_filter": "frame.number == 6387",
            "timestamp_epoch": "1561247392.015511000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ba49b256dcaf07616bcfa300",
        "last_seen_epoch": "1561247392.015511000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.365825000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "http-host"
        ],
        "value": "www.googleadservices.com",
        "evidence": [
          {
            "udp_stream": 70,
            "frame_number": 1691,
            "display_filter": "frame.number == 1691",
            "timestamp_epoch": "1561247261.849626000"
          },
          {
            "udp_stream": 70,
            "frame_number": 1711,
            "display_filter": "frame.number == 1711",
            "timestamp_epoch": "1561247261.871130000"
          },
          {
            "tcp_stream": 148,
            "frame_number": 1720,
            "display_filter": "frame.number == 1720",
            "timestamp_epoch": "1561247261.881869000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b0707daf41e5ddb7bf39fa52",
        "last_seen_epoch": "1561247261.881869000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.849626000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "www.googleapis.com",
        "evidence": [
          {
            "udp_stream": 79,
            "frame_number": 2641,
            "display_filter": "frame.number == 2641",
            "timestamp_epoch": "1561247263.799834000"
          },
          {
            "udp_stream": 79,
            "frame_number": 2642,
            "display_filter": "frame.number == 2642",
            "timestamp_epoch": "1561247263.800132000"
          },
          {
            "tcp_stream": 170,
            "frame_number": 2653,
            "display_filter": "frame.number == 2653",
            "timestamp_epoch": "1561247263.816326000"
          },
          {
            "tcp_stream": 171,
            "frame_number": 2657,
            "display_filter": "frame.number == 2657",
            "timestamp_epoch": "1561247263.817502000"
          },
          {
            "tcp_stream": 253,
            "frame_number": 6931,
            "display_filter": "frame.number == 6931",
            "timestamp_epoch": "1561247393.601016000"
          },
          {
            "tcp_stream": 252,
            "frame_number": 6935,
            "display_filter": "frame.number == 6935",
            "timestamp_epoch": "1561247393.603282000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-81688930e836c77ef0eb146e",
        "last_seen_epoch": "1561247393.603282000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247263.799834000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "www.googletagmanager.com",
        "evidence": [
          {
            "udp_stream": 69,
            "frame_number": 1569,
            "display_filter": "frame.number == 1569",
            "timestamp_epoch": "1561247261.588306000"
          },
          {
            "udp_stream": 69,
            "frame_number": 1578,
            "display_filter": "frame.number == 1578",
            "timestamp_epoch": "1561247261.621737000"
          },
          {
            "tcp_stream": 147,
            "frame_number": 1583,
            "display_filter": "frame.number == 1583",
            "timestamp_epoch": "1561247261.634636000"
          },
          {
            "tcp_stream": 146,
            "frame_number": 1587,
            "display_filter": "frame.number == 1587",
            "timestamp_epoch": "1561247261.636357000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-309c90c59f32eb132460fd24",
        "last_seen_epoch": "1561247261.636357000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.588306000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "value": "www.gstatic.com",
        "evidence": [
          {
            "udp_stream": 76,
            "frame_number": 2056,
            "display_filter": "frame.number == 2056",
            "timestamp_epoch": "1561247262.918987000"
          },
          {
            "udp_stream": 76,
            "frame_number": 2105,
            "display_filter": "frame.number == 2105",
            "timestamp_epoch": "1561247263.069502000"
          },
          {
            "tcp_stream": 163,
            "frame_number": 2155,
            "display_filter": "frame.number == 2155",
            "timestamp_epoch": "1561247263.133155000"
          },
          {
            "tcp_stream": 164,
            "frame_number": 2157,
            "display_filter": "frame.number == 2157",
            "timestamp_epoch": "1561247263.133344000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b95d340f4665e3ea51ebda09",
        "last_seen_epoch": "1561247263.133344000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.918987000"
      },
      {
        "type": "domain",
        "roles": [
          "dns-query",
          "http-host"
        ],
        "value": "www.msftncsi.com",
        "evidence": [
          {
            "udp_stream": 30,
            "frame_number": 424,
            "display_filter": "frame.number == 424",
            "timestamp_epoch": "1561247198.002372000"
          },
          {
            "udp_stream": 30,
            "frame_number": 425,
            "display_filter": "frame.number == 425",
            "timestamp_epoch": "1561247198.020798000"
          },
          {
            "udp_stream": 31,
            "frame_number": 426,
            "display_filter": "frame.number == 426",
            "timestamp_epoch": "1561247198.022340000"
          },
          {
            "udp_stream": 31,
            "frame_number": 427,
            "display_filter": "frame.number == 427",
            "timestamp_epoch": "1561247198.022718000"
          },
          {
            "udp_stream": 56,
            "frame_number": 952,
            "display_filter": "frame.number == 952",
            "timestamp_epoch": "1561247230.144568000"
          },
          {
            "udp_stream": 56,
            "frame_number": 953,
            "display_filter": "frame.number == 953",
            "timestamp_epoch": "1561247230.169089000"
          },
          {
            "udp_stream": 57,
            "frame_number": 954,
            "display_filter": "frame.number == 954",
            "timestamp_epoch": "1561247230.170740000"
          },
          {
            "udp_stream": 57,
            "frame_number": 955,
            "display_filter": "frame.number == 955",
            "timestamp_epoch": "1561247230.171042000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 431,
            "display_filter": "frame.number == 431",
            "timestamp_epoch": "1561247198.038003000"
          },
          {
            "tcp_stream": 80,
            "frame_number": 959,
            "display_filter": "frame.number == 959",
            "timestamp_epoch": "1561247230.191542000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-855f170573ea1612af9e27f7",
        "last_seen_epoch": "1561247230.191542000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247198.002372000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "10.0.76.109",
        "evidence": [
          {
            "udp_stream": 60,
            "frame_number": 975,
            "display_filter": "frame.number == 975",
            "timestamp_epoch": "1561247232.560966000"
          },
          {
            "udp_stream": 60,
            "frame_number": 976,
            "display_filter": "frame.number == 976",
            "timestamp_epoch": "1561247232.561538000"
          }
        ],
        "is_private": true,
        "observable_id": "observable-2f613bd40b97a9cc576b10a4",
        "last_seen_epoch": "1561247232.561538000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247232.560966000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "10.0.76.193",
        "evidence": [
          {
            "udp_stream": 29,
            "frame_number": 422,
            "display_filter": "frame.number == 422",
            "timestamp_epoch": "1561247197.798498000"
          },
          {
            "udp_stream": 29,
            "frame_number": 423,
            "display_filter": "frame.number == 423",
            "timestamp_epoch": "1561247197.799092000"
          }
        ],
        "is_private": true,
        "observable_id": "observable-250720872b841a4155f09927",
        "last_seen_epoch": "1561247197.799092000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247197.798498000"
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "10.0.76.255",
        "evidence": [],
        "is_private": true,
        "observable_id": "observable-95b80acedf96e7d8faa472c3",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "10.0.76.6",
        "evidence": [
          {
            "udp_stream": 1,
            "frame_number": 4,
            "display_filter": "frame.number == 4",
            "timestamp_epoch": "1561247190.414558000"
          },
          {
            "udp_stream": 2,
            "frame_number": 6,
            "display_filter": "frame.number == 6",
            "timestamp_epoch": "1561247190.433338000"
          },
          {
            "udp_stream": 3,
            "frame_number": 8,
            "display_filter": "frame.number == 8",
            "timestamp_epoch": "1561247190.436697000"
          },
          {
            "udp_stream": 6,
            "frame_number": 36,
            "display_filter": "frame.number == 36",
            "timestamp_epoch": "1561247190.633924000"
          },
          {
            "udp_stream": 8,
            "frame_number": 125,
            "display_filter": "frame.number == 125",
            "timestamp_epoch": "1561247190.691526000"
          },
          {
            "udp_stream": 10,
            "frame_number": 181,
            "display_filter": "frame.number == 181",
            "timestamp_epoch": "1561247190.801337000"
          },
          {
            "udp_stream": 17,
            "frame_number": 240,
            "display_filter": "frame.number == 240",
            "timestamp_epoch": "1561247193.919255000"
          },
          {
            "udp_stream": 22,
            "frame_number": 257,
            "display_filter": "frame.number == 257",
            "timestamp_epoch": "1561247195.372677000"
          },
          {
            "udp_stream": 28,
            "frame_number": 421,
            "display_filter": "frame.number == 421",
            "timestamp_epoch": "1561247197.797726000"
          },
          {
            "udp_stream": 34,
            "frame_number": 555,
            "display_filter": "frame.number == 555",
            "timestamp_epoch": "1561247225.092523000"
          },
          {
            "udp_stream": 35,
            "frame_number": 557,
            "display_filter": "frame.number == 557",
            "timestamp_epoch": "1561247225.100838000"
          },
          {
            "udp_stream": 36,
            "frame_number": 559,
            "display_filter": "frame.number == 559",
            "timestamp_epoch": "1561247225.116693000"
          },
          {
            "udp_stream": 39,
            "frame_number": 632,
            "display_filter": "frame.number == 632",
            "timestamp_epoch": "1561247225.319824000"
          },
          {
            "udp_stream": 41,
            "frame_number": 702,
            "display_filter": "frame.number == 702",
            "timestamp_epoch": "1561247225.429056000"
          },
          {
            "udp_stream": 43,
            "frame_number": 707,
            "display_filter": "frame.number == 707",
            "timestamp_epoch": "1561247225.506478000"
          },
          {
            "udp_stream": 54,
            "frame_number": 948,
            "display_filter": "frame.number == 948",
            "timestamp_epoch": "1561247228.853164000"
          },
          {
            "udp_stream": 59,
            "frame_number": 974,
            "display_filter": "frame.number == 974",
            "timestamp_epoch": "1561247232.560080000"
          }
        ],
        "is_private": true,
        "observable_id": "observable-d4fb199313c937359e623fef",
        "last_seen_epoch": "1561247232.560080000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247190.414558000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "104.244.42.136",
        "evidence": [
          {
            "udp_stream": 82,
            "frame_number": 2895,
            "display_filter": "frame.number == 2895",
            "timestamp_epoch": "1561247264.158140000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-e4edc0d41865f92ad88c4d57",
        "last_seen_epoch": "1561247264.158140000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.158140000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "104.244.42.200",
        "evidence": [
          {
            "udp_stream": 82,
            "frame_number": 2895,
            "display_filter": "frame.number == 2895",
            "timestamp_epoch": "1561247264.158140000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-8970ebcb6cb4bc6e6ed5a3cb",
        "last_seen_epoch": "1561247264.158140000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.158140000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "104.244.42.72",
        "evidence": [
          {
            "udp_stream": 82,
            "frame_number": 2895,
            "display_filter": "frame.number == 2895",
            "timestamp_epoch": "1561247264.158140000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-9d844231759becb137c2913c",
        "last_seen_epoch": "1561247264.158140000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.158140000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "104.244.42.8",
        "evidence": [
          {
            "udp_stream": 82,
            "frame_number": 2895,
            "display_filter": "frame.number == 2895",
            "timestamp_epoch": "1561247264.158140000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-e12331fd71415f4758ad0d7d",
        "last_seen_epoch": "1561247264.158140000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.158140000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "13.107.21.200",
        "evidence": [
          {
            "udp_stream": 85,
            "frame_number": 3036,
            "display_filter": "frame.number == 3036",
            "timestamp_epoch": "1561247264.439549000"
          },
          {
            "udp_stream": 87,
            "frame_number": 3037,
            "display_filter": "frame.number == 3037",
            "timestamp_epoch": "1561247264.439629000"
          },
          {
            "udp_stream": 88,
            "frame_number": 3038,
            "display_filter": "frame.number == 3038",
            "timestamp_epoch": "1561247264.439693000"
          },
          {
            "udp_stream": 84,
            "frame_number": 3039,
            "display_filter": "frame.number == 3039",
            "timestamp_epoch": "1561247264.439764000"
          },
          {
            "udp_stream": 91,
            "frame_number": 3181,
            "display_filter": "frame.number == 3181",
            "timestamp_epoch": "1561247265.473452000"
          },
          {
            "udp_stream": 97,
            "frame_number": 3865,
            "display_filter": "frame.number == 3865",
            "timestamp_epoch": "1561247288.316485000"
          },
          {
            "udp_stream": 98,
            "frame_number": 3866,
            "display_filter": "frame.number == 3866",
            "timestamp_epoch": "1561247288.316682000"
          },
          {
            "udp_stream": 99,
            "frame_number": 3867,
            "display_filter": "frame.number == 3867",
            "timestamp_epoch": "1561247288.316802000"
          },
          {
            "udp_stream": 96,
            "frame_number": 3868,
            "display_filter": "frame.number == 3868",
            "timestamp_epoch": "1561247288.316915000"
          },
          {
            "udp_stream": 100,
            "frame_number": 3874,
            "display_filter": "frame.number == 3874",
            "timestamp_epoch": "1561247289.399319000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-a1a235aa902ab85d7d66f8c3",
        "last_seen_epoch": "1561247289.399319000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.439549000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "13.107.5.80",
        "evidence": [
          {
            "udp_stream": 86,
            "frame_number": 2997,
            "display_filter": "frame.number == 2997",
            "timestamp_epoch": "1561247264.383906000"
          },
          {
            "udp_stream": 83,
            "frame_number": 2998,
            "display_filter": "frame.number == 2998",
            "timestamp_epoch": "1561247264.383975000"
          },
          {
            "udp_stream": 95,
            "frame_number": 3859,
            "display_filter": "frame.number == 3859",
            "timestamp_epoch": "1561247287.951071000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-4ce11a602be6d7c6eebb78af",
        "last_seen_epoch": "1561247287.951071000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.383906000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "131.107.255.255",
        "evidence": [
          {
            "udp_stream": 63,
            "frame_number": 1378,
            "display_filter": "frame.number == 1378",
            "timestamp_epoch": "1561247255.327697000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-f54ada418582a7bd05c9e922",
        "last_seen_epoch": "1561247255.327697000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247255.327697000"
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "172.217.0.67",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-02f7a8bf73eabd0d4169654e",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "172.217.0.74",
        "evidence": [
          {
            "udp_stream": 66,
            "frame_number": 1454,
            "display_filter": "frame.number == 1454",
            "timestamp_epoch": "1561247261.347284000"
          },
          {
            "udp_stream": 79,
            "frame_number": 2642,
            "display_filter": "frame.number == 2642",
            "timestamp_epoch": "1561247263.800132000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-7bd2554e0e68554d0ae18d9c",
        "last_seen_epoch": "1561247263.800132000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.347284000"
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "172.217.12.110",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-e050dffae565135ae7b5164f",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "172.217.164.66",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-d285fdd6f44dbc1d4593c433",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "172.217.164.74",
        "evidence": [
          {
            "udp_stream": 66,
            "frame_number": 1454,
            "display_filter": "frame.number == 1454",
            "timestamp_epoch": "1561247261.347284000"
          },
          {
            "udp_stream": 79,
            "frame_number": 2642,
            "display_filter": "frame.number == 2642",
            "timestamp_epoch": "1561247263.800132000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-73e6b1e9de6e4939155395f3",
        "last_seen_epoch": "1561247263.800132000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.347284000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "172.217.2.34",
        "evidence": [
          {
            "udp_stream": 70,
            "frame_number": 1711,
            "display_filter": "frame.number == 1711",
            "timestamp_epoch": "1561247261.871130000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-015cff4abbd5d8bac9e3a1b9",
        "last_seen_epoch": "1561247261.871130000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.871130000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "172.217.2.35",
        "evidence": [
          {
            "udp_stream": 89,
            "frame_number": 3099,
            "display_filter": "frame.number == 3099",
            "timestamp_epoch": "1561247264.566187000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-4947e9e289ddeb373fb67dff",
        "last_seen_epoch": "1561247264.566187000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.566187000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "173.194.219.154",
        "evidence": [
          {
            "udp_stream": 71,
            "frame_number": 1738,
            "display_filter": "frame.number == 1738",
            "timestamp_epoch": "1561247262.208719000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-ed0652efa5fb107a88f981a8",
        "last_seen_epoch": "1561247262.208719000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.208719000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "173.194.219.155",
        "evidence": [
          {
            "udp_stream": 71,
            "frame_number": 1738,
            "display_filter": "frame.number == 1738",
            "timestamp_epoch": "1561247262.208719000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-97b4231bac08845857f46185",
        "last_seen_epoch": "1561247262.208719000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.208719000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "173.194.219.156",
        "evidence": [
          {
            "udp_stream": 71,
            "frame_number": 1738,
            "display_filter": "frame.number == 1738",
            "timestamp_epoch": "1561247262.208719000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-2aff663d8599034d8bcdcfc3",
        "last_seen_epoch": "1561247262.208719000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.208719000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "173.194.219.157",
        "evidence": [
          {
            "udp_stream": 71,
            "frame_number": 1738,
            "display_filter": "frame.number == 1738",
            "timestamp_epoch": "1561247262.208719000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-6506a14e497b96bdb05a12e0",
        "last_seen_epoch": "1561247262.208719000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.208719000"
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "173.194.219.94",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-9e0873f672cab11212a7a9bf",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "173.194.219.97",
        "evidence": [
          {
            "udp_stream": 69,
            "frame_number": 1578,
            "display_filter": "frame.number == 1578",
            "timestamp_epoch": "1561247261.621737000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-3ce740464a71c68839d880b5",
        "last_seen_epoch": "1561247261.621737000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.621737000"
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "185.254.190.200",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-fc13ad79b08b90c74371fb96",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "204.79.197.200",
        "evidence": [
          {
            "udp_stream": 85,
            "frame_number": 3036,
            "display_filter": "frame.number == 3036",
            "timestamp_epoch": "1561247264.439549000"
          },
          {
            "udp_stream": 87,
            "frame_number": 3037,
            "display_filter": "frame.number == 3037",
            "timestamp_epoch": "1561247264.439629000"
          },
          {
            "udp_stream": 88,
            "frame_number": 3038,
            "display_filter": "frame.number == 3038",
            "timestamp_epoch": "1561247264.439693000"
          },
          {
            "udp_stream": 84,
            "frame_number": 3039,
            "display_filter": "frame.number == 3039",
            "timestamp_epoch": "1561247264.439764000"
          },
          {
            "udp_stream": 91,
            "frame_number": 3181,
            "display_filter": "frame.number == 3181",
            "timestamp_epoch": "1561247265.473452000"
          },
          {
            "udp_stream": 97,
            "frame_number": 3865,
            "display_filter": "frame.number == 3865",
            "timestamp_epoch": "1561247288.316485000"
          },
          {
            "udp_stream": 98,
            "frame_number": 3866,
            "display_filter": "frame.number == 3866",
            "timestamp_epoch": "1561247288.316682000"
          },
          {
            "udp_stream": 99,
            "frame_number": 3867,
            "display_filter": "frame.number == 3867",
            "timestamp_epoch": "1561247288.316802000"
          },
          {
            "udp_stream": 96,
            "frame_number": 3868,
            "display_filter": "frame.number == 3868",
            "timestamp_epoch": "1561247288.316915000"
          },
          {
            "udp_stream": 100,
            "frame_number": 3874,
            "display_filter": "frame.number == 3874",
            "timestamp_epoch": "1561247289.399319000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-2e9b32e266b6eacba6321c91",
        "last_seen_epoch": "1561247289.399319000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.439549000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "216.58.193.163",
        "evidence": [
          {
            "udp_stream": 81,
            "frame_number": 2829,
            "display_filter": "frame.number == 2829",
            "timestamp_epoch": "1561247264.072915000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-14534480428ec180df7714e0",
        "last_seen_epoch": "1561247264.072915000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.072915000"
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "224.0.0.22",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-cb85a3adf3b11154a83ba691",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "224.0.0.252",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-f91778d83b6ecef4d9aebd6e",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "23.63.249.144",
        "evidence": [
          {
            "udp_stream": 56,
            "frame_number": 953,
            "display_filter": "frame.number == 953",
            "timestamp_epoch": "1561247230.169089000"
          },
          {
            "udp_stream": 57,
            "frame_number": 955,
            "display_filter": "frame.number == 955",
            "timestamp_epoch": "1561247230.171042000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-1d67f8156f9fc5460f88ca85",
        "last_seen_epoch": "1561247230.171042000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247230.169089000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "23.63.249.186",
        "evidence": [
          {
            "udp_stream": 30,
            "frame_number": 425,
            "display_filter": "frame.number == 425",
            "timestamp_epoch": "1561247198.020798000"
          },
          {
            "udp_stream": 31,
            "frame_number": 427,
            "display_filter": "frame.number == 427",
            "timestamp_epoch": "1561247198.022718000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-929110509317e5717fc802f7",
        "last_seen_epoch": "1561247198.022718000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247198.020798000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "23.63.249.194",
        "evidence": [
          {
            "udp_stream": 30,
            "frame_number": 425,
            "display_filter": "frame.number == 425",
            "timestamp_epoch": "1561247198.020798000"
          },
          {
            "udp_stream": 31,
            "frame_number": 427,
            "display_filter": "frame.number == 427",
            "timestamp_epoch": "1561247198.022718000"
          },
          {
            "udp_stream": 56,
            "frame_number": 953,
            "display_filter": "frame.number == 953",
            "timestamp_epoch": "1561247230.169089000"
          },
          {
            "udp_stream": 57,
            "frame_number": 955,
            "display_filter": "frame.number == 955",
            "timestamp_epoch": "1561247230.171042000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-2d083180fef914e1dfeb8355",
        "last_seen_epoch": "1561247230.171042000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247198.020798000"
      },
      {
        "type": "ipv4",
        "roles": [
          "http-host",
          "network-endpoint"
        ],
        "value": "239.255.255.250",
        "evidence": [
          {
            "frame_number": 5905,
            "display_filter": "frame.number == 5905",
            "timestamp_epoch": "1561247311.213862000"
          },
          {
            "frame_number": 5907,
            "display_filter": "frame.number == 5907",
            "timestamp_epoch": "1561247311.549851000"
          },
          {
            "frame_number": 5989,
            "display_filter": "frame.number == 5989",
            "timestamp_epoch": "1561247314.225235000"
          },
          {
            "frame_number": 6002,
            "display_filter": "frame.number == 6002",
            "timestamp_epoch": "1561247314.553386000"
          },
          {
            "frame_number": 6003,
            "display_filter": "frame.number == 6003",
            "timestamp_epoch": "1561247317.235836000"
          },
          {
            "frame_number": 6004,
            "display_filter": "frame.number == 6004",
            "timestamp_epoch": "1561247317.564933000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-e01575654632c5ca81b44cb1",
        "last_seen_epoch": "1561247317.564933000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247311.213862000"
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "255.255.255.255",
        "evidence": [],
        "is_private": true,
        "observable_id": "observable-9b2b5b097f236be762204ba3",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "31.13.65.36",
        "evidence": [
          {
            "udp_stream": 92,
            "frame_number": 3210,
            "display_filter": "frame.number == 3210",
            "timestamp_epoch": "1561247270.199357000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-357c7aa9f32edaf5e5031a3c",
        "last_seen_epoch": "1561247270.199357000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247270.199357000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "31.13.65.7",
        "evidence": [
          {
            "udp_stream": 73,
            "frame_number": 1820,
            "display_filter": "frame.number == 1820",
            "timestamp_epoch": "1561247262.695760000"
          },
          {
            "udp_stream": 77,
            "frame_number": 2369,
            "display_filter": "frame.number == 2369",
            "timestamp_epoch": "1561247263.378913000"
          },
          {
            "udp_stream": 93,
            "frame_number": 3309,
            "display_filter": "frame.number == 3309",
            "timestamp_epoch": "1561247270.428911000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-c8a684c5f730782f1c750e3d",
        "last_seen_epoch": "1561247270.428911000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.695760000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "35.226.156.55",
        "evidence": [
          {
            "udp_stream": 65,
            "frame_number": 1393,
            "display_filter": "frame.number == 1393",
            "timestamp_epoch": "1561247260.170954000"
          },
          {
            "udp_stream": 68,
            "frame_number": 1511,
            "display_filter": "frame.number == 1511",
            "timestamp_epoch": "1561247261.417763000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-c7ae4f5e6f88e259d292bbb7",
        "last_seen_epoch": "1561247261.417763000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247260.170954000"
      },
      {
        "type": "ipv4",
        "roles": [
          "http-host",
          "network-endpoint"
        ],
        "value": "37.46.135.170",
        "evidence": [
          {
            "tcp_stream": 202,
            "frame_number": 3761,
            "display_filter": "frame.number == 3761",
            "timestamp_epoch": "1561247285.237383000"
          },
          {
            "tcp_stream": 201,
            "frame_number": 3842,
            "display_filter": "frame.number == 3842",
            "timestamp_epoch": "1561247287.553767000"
          },
          {
            "tcp_stream": 201,
            "frame_number": 3869,
            "display_filter": "frame.number == 3869",
            "timestamp_epoch": "1561247288.688439000"
          },
          {
            "tcp_stream": 207,
            "frame_number": 3893,
            "display_filter": "frame.number == 3893",
            "timestamp_epoch": "1561247290.335491000"
          },
          {
            "tcp_stream": 210,
            "frame_number": 4417,
            "display_filter": "frame.number == 4417",
            "timestamp_epoch": "1561247296.354584000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-f9caab36b295876e73eaf13c",
        "last_seen_epoch": "1561247296.354584000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247285.237383000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "54.192.207.126",
        "evidence": [
          {
            "udp_stream": 105,
            "frame_number": 6509,
            "display_filter": "frame.number == 6509",
            "timestamp_epoch": "1561247392.082847000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-9b2e5973357c70273d26e447",
        "last_seen_epoch": "1561247392.082847000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.082847000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "54.192.207.150",
        "evidence": [
          {
            "udp_stream": 105,
            "frame_number": 6509,
            "display_filter": "frame.number == 6509",
            "timestamp_epoch": "1561247392.082847000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-05cbbb0947c2d223cf400e31",
        "last_seen_epoch": "1561247392.082847000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.082847000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "54.192.207.51",
        "evidence": [
          {
            "udp_stream": 105,
            "frame_number": 6509,
            "display_filter": "frame.number == 6509",
            "timestamp_epoch": "1561247392.082847000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-8fc4f83414bbb3ee28eb3de8",
        "last_seen_epoch": "1561247392.082847000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.082847000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "54.192.207.79",
        "evidence": [
          {
            "udp_stream": 105,
            "frame_number": 6509,
            "display_filter": "frame.number == 6509",
            "timestamp_epoch": "1561247392.082847000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-514e7c4bdab2747e025b69fe",
        "last_seen_epoch": "1561247392.082847000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.082847000"
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "64.233.185.101",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-b6f388a7270bd32a1ef7174e",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "64.233.185.102",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-6e9c24bdc0d16ed0209b01d5",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "64.233.185.103",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-24e5fffe18dfd0adf6fade62",
        "last_seen_epoch": "1561247261.392793000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.392793000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "64.233.185.104",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-874de5290bc693d62407d71c",
        "last_seen_epoch": "1561247261.392793000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.392793000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "64.233.185.105",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-f7f35cc366bf564c1973cedf",
        "last_seen_epoch": "1561247261.392793000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.392793000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "64.233.185.106",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-7ccd6de2536e396b0370fec1",
        "last_seen_epoch": "1561247261.392793000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.392793000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "64.233.185.147",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-a774a510fd7b408de9b28949",
        "last_seen_epoch": "1561247261.392793000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.392793000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "64.233.185.154",
        "evidence": [
          {
            "udp_stream": 90,
            "frame_number": 3137,
            "display_filter": "frame.number == 3137",
            "timestamp_epoch": "1561247264.725563000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-875fc8bd2dd02fd1063a0581",
        "last_seen_epoch": "1561247264.725563000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.725563000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "64.233.185.155",
        "evidence": [
          {
            "udp_stream": 90,
            "frame_number": 3137,
            "display_filter": "frame.number == 3137",
            "timestamp_epoch": "1561247264.725563000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-1bb20a860ffe5378aaf2f5bc",
        "last_seen_epoch": "1561247264.725563000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.725563000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "64.233.185.156",
        "evidence": [
          {
            "udp_stream": 90,
            "frame_number": 3137,
            "display_filter": "frame.number == 3137",
            "timestamp_epoch": "1561247264.725563000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-9fe31247d21a48189d37d890",
        "last_seen_epoch": "1561247264.725563000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.725563000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "64.233.185.157",
        "evidence": [
          {
            "udp_stream": 90,
            "frame_number": 3137,
            "display_filter": "frame.number == 3137",
            "timestamp_epoch": "1561247264.725563000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-14ddf5c712e50ec46e5e9202",
        "last_seen_epoch": "1561247264.725563000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247264.725563000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "64.233.185.94",
        "evidence": [
          {
            "udp_stream": 76,
            "frame_number": 2105,
            "display_filter": "frame.number == 2105",
            "timestamp_epoch": "1561247263.069502000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-0359865ac7acecf13a55a911",
        "last_seen_epoch": "1561247263.069502000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247263.069502000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "64.233.185.95",
        "evidence": [
          {
            "udp_stream": 66,
            "frame_number": 1454,
            "display_filter": "frame.number == 1454",
            "timestamp_epoch": "1561247261.347284000"
          },
          {
            "udp_stream": 79,
            "frame_number": 2642,
            "display_filter": "frame.number == 2642",
            "timestamp_epoch": "1561247263.800132000"
          },
          {
            "udp_stream": 106,
            "frame_number": 6390,
            "display_filter": "frame.number == 6390",
            "timestamp_epoch": "1561247392.017533000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-b7dc4639fc754303031a0b8a",
        "last_seen_epoch": "1561247392.017533000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.347284000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "64.233.185.99",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-c4dfbb521eadf6280a511ede",
        "last_seen_epoch": "1561247261.392793000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.392793000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "72.21.81.200",
        "evidence": [
          {
            "udp_stream": 101,
            "frame_number": 3896,
            "display_filter": "frame.number == 3896",
            "timestamp_epoch": "1561247290.404107000"
          },
          {
            "udp_stream": 104,
            "frame_number": 5919,
            "display_filter": "frame.number == 5919",
            "timestamp_epoch": "1561247314.083666000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-0b9972b1d21f8ccaff80eb6a",
        "last_seen_epoch": "1561247314.083666000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247290.404107000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "72.21.91.66",
        "evidence": [
          {
            "udp_stream": 75,
            "frame_number": 1855,
            "display_filter": "frame.number == 1855",
            "timestamp_epoch": "1561247262.734217000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-5b1d4d021241dcdb0a15ed4e",
        "last_seen_epoch": "1561247262.734217000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.734217000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "74.125.136.100",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-6ce05fe400793115119bb610",
        "last_seen_epoch": "1561247263.907326000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.729830000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "74.125.136.101",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-23aaa6f3e412eeead34ec3e4",
        "last_seen_epoch": "1561247263.907326000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.729830000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "74.125.136.102",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-0c2be4245f3922f5c26ece09",
        "last_seen_epoch": "1561247263.907326000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.729830000"
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "74.125.136.106",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-2c8519d2463ddd8099826035",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "74.125.136.113",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-a915248bce88b13949d6ab06",
        "last_seen_epoch": "1561247263.907326000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.729830000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "74.125.136.138",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-cd16de5cf9d73acc68eb4e62",
        "last_seen_epoch": "1561247263.907326000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.729830000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "74.125.136.139",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-60db58aa193777d7a01d0b62",
        "last_seen_epoch": "1561247263.907326000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.729830000"
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "74.125.136.95",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-7dde82bc35da99adb2b4f2ae",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "74.125.138.100",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-32335094a0eadc0b2d4d3ec7",
        "last_seen_epoch": "1561247262.316189000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.316189000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "74.125.138.101",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-bcb27d635b5b0169b7c7ad59",
        "last_seen_epoch": "1561247262.316189000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.316189000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "74.125.138.102",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-c3beb9d9eb08e786f89fa3c6",
        "last_seen_epoch": "1561247262.316189000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.316189000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "74.125.138.113",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-2a0418fbd782e833d7efc199",
        "last_seen_epoch": "1561247262.316189000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.316189000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "74.125.138.138",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-94b60df33482de05fc570f75",
        "last_seen_epoch": "1561247262.316189000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.316189000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer"
        ],
        "value": "74.125.138.139",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-370ee327a1ea89fded8a7666",
        "last_seen_epoch": "1561247262.316189000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.316189000"
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "74.125.138.97",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-423b613c0328bdc5bab765aa",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "74.125.21.95",
        "evidence": [
          {
            "udp_stream": 66,
            "frame_number": 1454,
            "display_filter": "frame.number == 1454",
            "timestamp_epoch": "1561247261.347284000"
          },
          {
            "udp_stream": 79,
            "frame_number": 2642,
            "display_filter": "frame.number == 2642",
            "timestamp_epoch": "1561247263.800132000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-87eccc826622783004a9067f",
        "last_seen_epoch": "1561247263.800132000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.347284000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "8.209.83.76",
        "evidence": [
          {
            "udp_stream": 102,
            "frame_number": 4889,
            "display_filter": "frame.number == 4889",
            "timestamp_epoch": "1561247302.953345000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-b4c4fa5f6a16e7c8d87b3740",
        "last_seen_epoch": "1561247302.953345000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247302.953345000"
      },
      {
        "type": "ipv4",
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "value": "91.235.129.60",
        "evidence": [
          {
            "udp_stream": 94,
            "frame_number": 3742,
            "display_filter": "frame.number == 3742",
            "timestamp_epoch": "1561247283.743525000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-6f3b10f19ea885a057e0ec2e",
        "last_seen_epoch": "1561247283.743525000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247283.743525000"
      },
      {
        "type": "ipv6",
        "roles": [
          "dns-answer"
        ],
        "value": "fd3e:4f5a:5b81::1",
        "evidence": [
          {
            "udp_stream": 64,
            "frame_number": 1380,
            "display_filter": "frame.number == 1380",
            "timestamp_epoch": "1561247255.328332000"
          }
        ],
        "is_private": true,
        "observable_id": "observable-15ba53c73130ee689a4cb606",
        "last_seen_epoch": "1561247255.328332000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247255.328332000"
      },
      {
        "type": "ja3",
        "roles": [
          "tls-client-fingerprint"
        ],
        "value": "4d7a28d6f2263ed61de88ca66eb011e3",
        "evidence": [
          {
            "tcp_stream": 144,
            "frame_number": 1530,
            "display_filter": "frame.number == 1530",
            "timestamp_epoch": "1561247261.495740000"
          },
          {
            "tcp_stream": 143,
            "frame_number": 1532,
            "display_filter": "frame.number == 1532",
            "timestamp_epoch": "1561247261.496133000"
          },
          {
            "tcp_stream": 142,
            "frame_number": 1534,
            "display_filter": "frame.number == 1534",
            "timestamp_epoch": "1561247261.496408000"
          },
          {
            "tcp_stream": 145,
            "frame_number": 1536,
            "display_filter": "frame.number == 1536",
            "timestamp_epoch": "1561247261.496614000"
          },
          {
            "tcp_stream": 147,
            "frame_number": 1583,
            "display_filter": "frame.number == 1583",
            "timestamp_epoch": "1561247261.634636000"
          },
          {
            "tcp_stream": 146,
            "frame_number": 1587,
            "display_filter": "frame.number == 1587",
            "timestamp_epoch": "1561247261.636357000"
          },
          {
            "tcp_stream": 150,
            "frame_number": 1743,
            "display_filter": "frame.number == 1743",
            "timestamp_epoch": "1561247262.221483000"
          },
          {
            "tcp_stream": 151,
            "frame_number": 1747,
            "display_filter": "frame.number == 1747",
            "timestamp_epoch": "1561247262.222981000"
          },
          {
            "tcp_stream": 154,
            "frame_number": 1827,
            "display_filter": "frame.number == 1827",
            "timestamp_epoch": "1561247262.707143000"
          },
          {
            "tcp_stream": 155,
            "frame_number": 1832,
            "display_filter": "frame.number == 1832",
            "timestamp_epoch": "1561247262.712948000"
          },
          {
            "tcp_stream": 159,
            "frame_number": 1872,
            "display_filter": "frame.number == 1872",
            "timestamp_epoch": "1561247262.746928000"
          },
          {
            "tcp_stream": 160,
            "frame_number": 1875,
            "display_filter": "frame.number == 1875",
            "timestamp_epoch": "1561247262.747182000"
          },
          {
            "tcp_stream": 157,
            "frame_number": 1878,
            "display_filter": "frame.number == 1878",
            "timestamp_epoch": "1561247262.747786000"
          },
          {
            "tcp_stream": 158,
            "frame_number": 1880,
            "display_filter": "frame.number == 1880",
            "timestamp_epoch": "1561247262.747896000"
          },
          {
            "tcp_stream": 161,
            "frame_number": 1920,
            "display_filter": "frame.number == 1920",
            "timestamp_epoch": "1561247262.787382000"
          },
          {
            "tcp_stream": 162,
            "frame_number": 2035,
            "display_filter": "frame.number == 2035",
            "timestamp_epoch": "1561247262.900779000"
          },
          {
            "tcp_stream": 163,
            "frame_number": 2155,
            "display_filter": "frame.number == 2155",
            "timestamp_epoch": "1561247263.133155000"
          },
          {
            "tcp_stream": 164,
            "frame_number": 2157,
            "display_filter": "frame.number == 2157",
            "timestamp_epoch": "1561247263.133344000"
          },
          {
            "tcp_stream": 165,
            "frame_number": 2344,
            "display_filter": "frame.number == 2344",
            "timestamp_epoch": "1561247263.333716000"
          },
          {
            "tcp_stream": 170,
            "frame_number": 2653,
            "display_filter": "frame.number == 2653",
            "timestamp_epoch": "1561247263.816326000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-efe458e0bde515ed6aeaacac",
        "last_seen_epoch": "1561247393.666065000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.495740000"
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "09d46019c7a75b96187202c3c8412182f27c413a9c3661857923dc8e94e91b7b",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-6abbc94132a7e57e69e2ca48",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-9a3479853f96c17532699bb8",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "13163ed737fd61106e44f7078caebe16df4549bc45b39c8928a956f987690fee",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-2c15c5b4134712b14c4e22e5",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "3103a01f90e95eef3300a895ab3411575325e0d2a1a4807e2fb5ae8e6f110f99",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-664e2a779b2a993a3c9c0a94",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "39bf8220d772efc49f7a8f0709ac8607af17997d38525eacec1448d5317dcf38",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-67b23ac28e9b7c8dd9833b23",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "3b1ac036763d3a59c88578486ae698d22a37dd2d46a553485e1eabb9fe255b3f",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-b1f8f35062a845758bd23cb5",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "4bbea1dbbdc058cc976c290bc9c0f506c6d175011da6fed42a499db1d2377af3",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-366e5aaa0d30328279f2cf95",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "4cfe13f4450dd2250c80995a84e11eff6c3300a17ff3d6518362a2a0696d51da",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-56d17166ea19e22a3275c97c",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "4fe572e7d49282f6bb5dde888b8e5d06e8264add26b8aebd6b706b79f11d0893",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-fc0e535172760fba14aed47d",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "502de2a45dc07ff1b837e168cbe37ca77056804aff81a5a510cecb199fbde654",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-0940d0897a5e182dc883562e",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-fb56dd78ecc9956b2abcc7b7",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "5ce99a897720a7b57ff1da615b9d99b4eb5035ffcfd036e1de93536b507d4089",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-aa6c12a25c7cca1eb216dfda",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "5d3e3d13333f572afe8df9cd7079c23b1049802e277d2cabce0221e2eaddc807",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-cd719e2883d4088d88ad4487",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-3826e42a713d543f08dbc854",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "63386b64f7d940f3864917cd9dc6443500ae82f0c717e7a82bec5b7b80361393",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-72969b5e757ebc38e042c55f",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-d448f38ba95fcc24e0551e58",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "6a77c8ea3af1cd0853993af5fa4724dee868e2c9a285eed61f8d0de3753b40ba",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-889925ead937d21dafed23df",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "6d4ae7517a2914b5de787ebe33efc2915d5872f4d0c5839a0f84149adedb306e",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-f2abb1edba6db034635d34b8",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-090deb227d982bce69eb7558",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "78bcd250cc75ff96fd3f96452b04875ebc3e990f0982f8cb2053c2897a3fde4c",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a1ad929cd8369f124a1b7136",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a1bf0757738d497d277cc9b5",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "96d61a66fda99897f47232a1f3d15fe711fee6726c2e976eed42011948d87049",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-2cc7c027176306a1ac96e30b",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "9a392fadea3ef641a75223fba61b5bc5c4d21c231360fe25d12218288d65ef0d",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-6177463e295aebec31601f7e",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "9bb35e2cb32e2507d2294fda6265966fe617d567b20845d53d2667a150b34311",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-d5a1a64a1af86815aac822e8",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "9bf59058c99ed3af3b2568fa61791e9b31ca2f85a1a0b630e78449f3598fae33",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-1111d49e909e404f7cef6c47",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "9ed561402e41c753f32f30917a1b1e50ea12c272f203fae74d1cfee3d091da3a",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-86a7b4e9af936acf0df6c941",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "a22fdaf4fdff6850730248a8c81a482e2c10bf0f1a5cfb5861dc5893442cf279",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-13244221308717c5e3b7c994",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "afa93c8baeaf1c28d1c5646ccdc701c636109bbc765549777a6417fa41fb5d6d",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-8a5af0b7357c1f2e01f97bb9",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "be7a8e1f7fddc3fd63f2540ea7103ba91c47d55c340504f69b286a64823678a0",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-360234478e5cd2950479d06c",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "c1f5379165637b2d8c5dea37642242e5aae279d5e2b4b2a00bc2a1f6463f02de",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-04bd6ab7d6eeee1604545a7d",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "ca5a37a5c3401ffcd1b7c98c3a22a921c013d1121fe33122e94dd81c382bf9b0",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-0bdad433a95139a145fb83a1",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "cc900a14f6b6e17c5299c3f619b98ac2048780932d3b409cc9c5be79db70d15a",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-511050c60b386a45e1513ea2",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "d428b93962535e52f3631fe647be46828868b6a88e2ecb203c706a86919502a0",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-e73ef31389c49b65913211d5",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "dd4da68f83df075213351c713fa2067594e9ff7a402de406d3fe20f0c2a2f47e",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-02759c6ac40a3bfd5dc5f2f4",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://239.255.255.250:1900*",
        "evidence": [
          {
            "frame_number": 5905,
            "display_filter": "frame.number == 5905",
            "timestamp_epoch": "1561247311.213862000"
          },
          {
            "frame_number": 5907,
            "display_filter": "frame.number == 5907",
            "timestamp_epoch": "1561247311.549851000"
          },
          {
            "frame_number": 5989,
            "display_filter": "frame.number == 5989",
            "timestamp_epoch": "1561247314.225235000"
          },
          {
            "frame_number": 6002,
            "display_filter": "frame.number == 6002",
            "timestamp_epoch": "1561247314.553386000"
          },
          {
            "frame_number": 6003,
            "display_filter": "frame.number == 6003",
            "timestamp_epoch": "1561247317.235836000"
          },
          {
            "frame_number": 6004,
            "display_filter": "frame.number == 6004",
            "timestamp_epoch": "1561247317.564933000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-49e095b7aa39d356e03c8ece",
        "last_seen_epoch": "1561247317.564933000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247311.213862000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://37.46.135.170/?MTg0MzEy&UOViokhlz&aposAqGuAYQhGJO=difference&JhdAxqxZHPMIkeK=difference&dsWGIXdorJRe=detonator&qIHWsvSKCKW=referred&zoZXprPP=known&lbepukXxCTe=vest&WQLDTkVC=heartfelt&hziRqmWCrsMaus=constitution&evkJcGbq=referred&ff5sdfds=w3bQMvXcJxjQFYbGMvzDSKNbNknWHViPxomG9MildZeqZGX_k7vDfF-qoVXcCgWRxfQ&sIusXJLxas=community&DFWEKmZUkxxeB=golfer&t4tsdfsg4=ufOADNQToihfRLwJpzo1fUlIUof-ni0nRyxSa0p7Ur0HeYAMU9qKcELk82VzFjLdTJvs&gSlEAaKzG=criticized&sXTxIOfYGsZL=golfer&qSnbemVoJtsl=criticized&UjrvHHTG=blackmail&bpiAMNrElSNjI0OTM5",
        "evidence": [
          {
            "tcp_stream": 201,
            "frame_number": 3842,
            "display_filter": "frame.number == 3842",
            "timestamp_epoch": "1561247287.553767000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-db8bf6c5ad47c85dd3fd961a",
        "last_seen_epoch": "1561247287.553767000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247287.553767000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://37.46.135.170/?MTQwMjg3&ZqHoAiAzR&ff5sdfds=xXjQMvWUbRXQDJ3EKvPcT6NMMVHRFUCL2YedmrHZefjac1WkzrvFTF_7ozKATQSG6_ptdfJ&ZJull=known&ClGaW=known&PETxiFG=community&sMRo=wrapped&HuUMPiKpj=heartfelt&LfBYp=criticized&trlQvmgW=wrapped&t4tsdfsg4=WDQCwhBfTcwJom9xbAw4b8futjEnVzkCb1p6H-hGPYwNDrcSdRuVo31ykxrkkQPshg1TH4GI&QVQi=detonator&scUJaJdNW=golfer&eaqBiV=referred&eunX=heartfelt&lTfNSvPso=wrapped&cuxKdC=constitution&TGbNZdI=known&YAVpMLL=difference&KcBDoegcFMTU1OTU1",
        "evidence": [
          {
            "tcp_stream": 202,
            "frame_number": 3761,
            "display_filter": "frame.number == 3761",
            "timestamp_epoch": "1561247285.237383000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-983661de138221fc4f97164a",
        "last_seen_epoch": "1561247285.237383000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247285.237383000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://37.46.135.170/?MzU4NjA0&kaZDWzI&AkwenzFXp=perpetual&EIDOXmpaHLIMQ=blackmail&PmNkusRzUKjdxi=known&embBMhXHEVqMM=already&nvQgwJI=community&PtVAedNAUU=difference&jDCoPDPCLNkpJ=heartfelt&SJjNZIaGHxK=known&vvHefJ=heartfelt&t4tsdfsg4=PAVMb_q6p3EiEnR6U0pGB_xyNZgITqZucEbg_2lT3ybZGJsJ1kx_R6GcBxewtW10Z6AwalanCH6fAnUctFEsxYQ&IJbAFjBSlWY=heartfelt&hyYviEG=criticized&ff5sdfds=xHjQMrnYbRbFFYTfKPPEUKNEMUjWA0-KwYmZhafVF5mxFDHGpbX1FxXspVSdCFSEmvRvdLUHIwSh1U3ASwNizYk&SfDdcBJQLntZc=everyone&ZwddKCJISaTB=blackmail&IqnFgRnJ=known&WWmEHUqy=vest&niUheyKPRbLYEdyNjEwOTgy",
        "evidence": [
          {
            "tcp_stream": 207,
            "frame_number": 3893,
            "display_filter": "frame.number == 3893",
            "timestamp_epoch": "1561247290.335491000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1409e0f3f2711570d0de1aee",
        "last_seen_epoch": "1561247290.335491000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247290.335491000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://37.46.135.170/?NDk4MTE5&tmCVgJMQbeHjv&znbcjFaUOmZy=vest&aTijcut=blackmail&kBgQawTJSFlOAu=difference&NCThQKrrQh=blackmail&lvQmqFyq=constitution&zCrDVEX=known&wLBVVjhJGAWC=detonator&PLFPhyyqZCa=known&lfJYgkH=perpetual&t4tsdfsg4=YPAVwb_q6p3EaEnRGU0p6B_x2NZgMTqZWcEbk_2lv3ybhGJs11kx_R6GYBxewtUFMT4wMWmKjKHqj58EgwV0sC&nVJnyJYij=vest&eZvTJjAeJ=professional&ISzjHlO=strategy&tAMbBJnq=referred&bwgDFqD=strategy&kdPRkesmuQ=heartfelt&ff5sdfds=xHjQMrbYbRfFFYvfKPzEUKxEMUbWA0GKwYeZhajVF5exFD7Gpbr1FxXspVWdCFWEmvtvdLUHIwuh1UPASwJizY&kxbRJWYrNpZbNlVMzU3NDAz",
        "evidence": [
          {
            "tcp_stream": 210,
            "frame_number": 4417,
            "display_filter": "frame.number == 4417",
            "timestamp_epoch": "1561247296.354584000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5c4734bcad84077f24e53a36",
        "last_seen_epoch": "1561247296.354584000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247296.354584000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://37.46.135.170/favicon.ico",
        "evidence": [
          {
            "tcp_stream": 201,
            "frame_number": 3869,
            "display_filter": "frame.number == 3869",
            "timestamp_epoch": "1561247288.688439000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-eeb6cc2c1a0416336b7bbef5",
        "last_seen_epoch": "1561247288.688439000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247288.688439000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js",
        "evidence": [
          {
            "tcp_stream": 140,
            "frame_number": 1462,
            "display_filter": "frame.number == 1462",
            "timestamp_epoch": "1561247261.361127000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-573169d316752056594092ad",
        "last_seen_epoch": "1561247261.361127000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.361127000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/images/clear.gif",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6600,
            "display_filter": "frame.number == 6600",
            "timestamp_epoch": "1561247392.525706000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c383876d1b808ca934d7569f",
        "last_seen_epoch": "1561247392.525706000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.525706000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/images/options.png",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6520,
            "display_filter": "frame.number == 6520",
            "timestamp_epoch": "1561247392.085467000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-357a2703ce5592eeb2c74c9c",
        "last_seen_epoch": "1561247392.085467000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.085467000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/images/selectbox-sprite.png",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6860,
            "display_filter": "frame.number == 6860",
            "timestamp_epoch": "1561247393.479635000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d80e4b1bf7e34912531718c3",
        "last_seen_epoch": "1561247393.479635000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247393.479635000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/markets",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6268,
            "display_filter": "frame.number == 6268",
            "timestamp_epoch": "1561247390.600547000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e497dc2664ae1091ea6a3857",
        "last_seen_epoch": "1561247390.600547000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247390.600547000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/scripts/amcharts/amcharts.js",
        "evidence": [
          {
            "tcp_stream": 234,
            "frame_number": 6432,
            "display_filter": "frame.number == 6432",
            "timestamp_epoch": "1561247392.034702000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-217aadd3e551f13b87d15444",
        "last_seen_epoch": "1561247392.034702000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.034702000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/scripts/amcharts/serial.js",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6475,
            "display_filter": "frame.number == 6475",
            "timestamp_epoch": "1561247392.064267000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-84d4cd1f1ac7e058a4f7ca79",
        "last_seen_epoch": "1561247392.064267000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.064267000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/scripts/amcharts/themes/light.js",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6497,
            "display_filter": "frame.number == 6497",
            "timestamp_epoch": "1561247392.075452000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8da5f43ac7c3e5a2485abcd6",
        "last_seen_epoch": "1561247392.075452000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.075452000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/scripts/bootstrap.js",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6343,
            "display_filter": "frame.number == 6343",
            "timestamp_epoch": "1561247391.619220000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6960651dd6dc7b3fc5148d67",
        "last_seen_epoch": "1561247391.619220000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247391.619220000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/scripts/jquery-ui/images/ui-bg_flat_75_ffffff_40x100.png",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6862,
            "display_filter": "frame.number == 6862",
            "timestamp_epoch": "1561247393.479843000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-67ad3a8ddb871ae3bc3e3357",
        "last_seen_epoch": "1561247393.479843000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247393.479843000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/scripts/jquery-ui/images/ui-bg_glass_75_e6e6e6_1x400.png",
        "evidence": [
          {
            "tcp_stream": 257,
            "frame_number": 6998,
            "display_filter": "frame.number == 6998",
            "timestamp_epoch": "1561247393.644968000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1482a228b43f6de4e9d42949",
        "last_seen_epoch": "1561247393.644968000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247393.644968000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/scripts/jquery-ui/images/ui-bg_highlight-soft_75_cccccc_1x100.png",
        "evidence": [
          {
            "tcp_stream": 256,
            "frame_number": 6979,
            "display_filter": "frame.number == 6979",
            "timestamp_epoch": "1561247393.631042000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-29e0580ee3ca3b1485eebb1f",
        "last_seen_epoch": "1561247393.631042000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247393.631042000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/scripts/jquery-ui/images/ui-icons_222222_256x240.png",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6996,
            "display_filter": "frame.number == 6996",
            "timestamp_epoch": "1561247393.644758000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6208eab6f2da8b7541d1a40c",
        "last_seen_epoch": "1561247393.644758000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247393.644758000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/scripts/jquery.selectbox-0.2.js",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6367,
            "display_filter": "frame.number == 6367",
            "timestamp_epoch": "1561247391.999359000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-288d789c032c4b9b8ae550e4",
        "last_seen_epoch": "1561247391.999359000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247391.999359000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/story-anatomy-beef-cattle-154-104357",
        "evidence": [
          {
            "tcp_stream": 138,
            "frame_number": 1403,
            "display_filter": "frame.number == 1403",
            "timestamp_epoch": "1561247260.782613000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e9079fee1488638ac8136a00",
        "last_seen_epoch": "1561247260.782613000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247260.782613000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/style/marketsResponsiveNoSidebar.css",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6317,
            "display_filter": "frame.number == 6317",
            "timestamp_epoch": "1561247391.481400000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-11a53e0988bb3ff7d4a3a89f",
        "last_seen_epoch": "1561247391.481400000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247391.481400000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/style/templates/controls/tabbedQuotesResponsive.css?v=2",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6369,
            "display_filter": "frame.number == 6369",
            "timestamp_epoch": "1561247391.999939000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8b6816990e65307d8e9efe6d",
        "last_seen_epoch": "1561247391.999939000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247391.999939000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/style/templates/images/chgDnArrow.png",
        "evidence": [
          {
            "tcp_stream": 234,
            "frame_number": 6852,
            "display_filter": "frame.number == 6852",
            "timestamp_epoch": "1561247393.347532000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e25c1678c664aecfec294d4d",
        "last_seen_epoch": "1561247393.347532000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247393.347532000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/style/templates/images/chgUpArrow.png",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6854,
            "display_filter": "frame.number == 6854",
            "timestamp_epoch": "1561247393.347726000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-27afa5ccc35cae8c771f76c2",
        "last_seen_epoch": "1561247393.347726000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247393.347726000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://beef2live.com/style/templates/page/markets.css?v=1",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6286,
            "display_filter": "frame.number == 6286",
            "timestamp_epoch": "1561247391.280854000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-33cdf2c001a0f5bfb872253f",
        "last_seen_epoch": "1561247391.280854000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247391.280854000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://clients1.google.com/generate_204",
        "evidence": [
          {
            "tcp_stream": 172,
            "frame_number": 2789,
            "display_filter": "frame.number == 2789",
            "timestamp_epoch": "1561247263.972756000"
          },
          {
            "tcp_stream": 254,
            "frame_number": 6941,
            "display_filter": "frame.number == 6941",
            "timestamp_epoch": "1561247393.604635000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5d08f77879c0df4e19fac3ee",
        "last_seen_epoch": "1561247393.604635000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247263.972756000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://connect.facebook.net/en_US/all.js",
        "evidence": [
          {
            "tcp_stream": 156,
            "frame_number": 1836,
            "display_filter": "frame.number == 1836",
            "timestamp_epoch": "1561247262.717994000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-974dd4822ef98f62b2fe94e8",
        "last_seen_epoch": "1561247262.717994000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.717994000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://cse.google.com/adsense/search/async-ads.js",
        "evidence": [
          {
            "tcp_stream": 169,
            "frame_number": 2649,
            "display_filter": "frame.number == 2649",
            "timestamp_epoch": "1561247263.809346000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3a289ca3ab595df981f79701",
        "last_seen_epoch": "1561247263.809346000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247263.809346000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php",
        "evidence": [
          {
            "tcp_stream": 211,
            "frame_number": 4893,
            "display_filter": "frame.number == 4893",
            "timestamp_epoch": "1561247303.076396000"
          },
          {
            "tcp_stream": 212,
            "frame_number": 4907,
            "display_filter": "frame.number == 4907",
            "timestamp_epoch": "1561247307.815439000"
          },
          {
            "tcp_stream": 213,
            "frame_number": 5364,
            "display_filter": "frame.number == 5364",
            "timestamp_epoch": "1561247309.386333000"
          },
          {
            "tcp_stream": 214,
            "frame_number": 5852,
            "display_filter": "frame.number == 5852",
            "timestamp_epoch": "1561247310.208061000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1c0728934890d9780658092e",
        "last_seen_epoch": "1561247310.208061000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247303.076396000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://letsdoitquick.site/",
        "evidence": [
          {
            "tcp_stream": 199,
            "frame_number": 3750,
            "display_filter": "frame.number == 3750",
            "timestamp_epoch": "1561247284.617933000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-90949ef2d3dfdc9cec74cf9e",
        "last_seen_epoch": "1561247284.617933000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247284.617933000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://portal.farmcentric.com/images/arrow-down-large.png",
        "evidence": [
          {
            "tcp_stream": 237,
            "frame_number": 6442,
            "display_filter": "frame.number == 6442",
            "timestamp_epoch": "1561247392.036635000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-72f8bd0c033ae375975acd85",
        "last_seen_epoch": "1561247392.036635000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.036635000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://portal.farmcentric.com/images/pointerup.png",
        "evidence": [
          {
            "tcp_stream": 236,
            "frame_number": 6434,
            "display_filter": "frame.number == 6434",
            "timestamp_epoch": "1561247392.034821000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-057090264e8bf8383855540f",
        "last_seen_epoch": "1561247392.034821000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.034821000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://www.bing.com/favicon.ico",
        "evidence": [
          {
            "tcp_stream": 183,
            "frame_number": 3186,
            "display_filter": "frame.number == 3186",
            "timestamp_epoch": "1561247265.487488000"
          },
          {
            "tcp_stream": 205,
            "frame_number": 3879,
            "display_filter": "frame.number == 3879",
            "timestamp_epoch": "1561247289.412234000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5c9b92ec7f222f412347cdce",
        "last_seen_epoch": "1561247289.412234000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247265.487488000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=3&utmn=2054411788&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853867&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
        "evidence": [
          {
            "tcp_stream": 152,
            "frame_number": 1811,
            "display_filter": "frame.number == 1811",
            "timestamp_epoch": "1561247262.637770000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-756f7336db7442f5d5b8f798",
        "last_seen_epoch": "1561247262.637770000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.637770000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=4&utmn=1186798248&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853872&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
        "evidence": [
          {
            "tcp_stream": 153,
            "frame_number": 1813,
            "display_filter": "frame.number == 1813",
            "timestamp_epoch": "1561247262.641599000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-77ac979d5212fab4ec4201ca",
        "last_seen_epoch": "1561247262.641599000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.641599000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=5&utmn=1173868244&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982849&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
        "evidence": [
          {
            "tcp_stream": 232,
            "frame_number": 6375,
            "display_filter": "frame.number == 6375",
            "timestamp_epoch": "1561247392.006900000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-147875339d7ad9592321ee84",
        "last_seen_epoch": "1561247392.006900000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.006900000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=6&utmn=1716294095&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982853&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
        "evidence": [
          {
            "tcp_stream": 231,
            "frame_number": 6379,
            "display_filter": "frame.number == 6379",
            "timestamp_epoch": "1561247392.007298000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c8b08e01dddc25cbc05861e3",
        "last_seen_epoch": "1561247392.007298000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247392.007298000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://www.google-analytics.com/ga.js",
        "evidence": [
          {
            "tcp_stream": 152,
            "frame_number": 1781,
            "display_filter": "frame.number == 1781",
            "timestamp_epoch": "1561247262.327050000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-92fbf824e9038b291b8ab1ee",
        "last_seen_epoch": "1561247262.327050000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247262.327050000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://www.googleadservices.com/pagead/conversion_async.js",
        "evidence": [
          {
            "tcp_stream": 148,
            "frame_number": 1720,
            "display_filter": "frame.number == 1720",
            "timestamp_epoch": "1561247261.881869000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ce0ea991c72173ff5ccb94c4",
        "last_seen_epoch": "1561247261.881869000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247261.881869000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://www.msftncsi.com/ncsi.txt",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 431,
            "display_filter": "frame.number == 431",
            "timestamp_epoch": "1561247198.038003000"
          },
          {
            "tcp_stream": 80,
            "frame_number": 959,
            "display_filter": "frame.number == 959",
            "timestamp_epoch": "1561247230.191542000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-650861c793c76999a8ff9317",
        "last_seen_epoch": "1561247230.191542000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247198.038003000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Microsoft NCSI",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 431,
            "display_filter": "frame.number == 431",
            "timestamp_epoch": "1561247198.038003000"
          },
          {
            "tcp_stream": 80,
            "frame_number": 959,
            "display_filter": "frame.number == 959",
            "timestamp_epoch": "1561247230.191542000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d688e30a242480422f08ddf1",
        "last_seen_epoch": "1561247230.191542000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247198.038003000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)",
        "evidence": [
          {
            "tcp_stream": 207,
            "frame_number": 3893,
            "display_filter": "frame.number == 3893",
            "timestamp_epoch": "1561247290.335491000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ad8f9cd104fc6e7ae8bbfbac",
        "last_seen_epoch": "1561247290.335491000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247290.335491000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
        "evidence": [
          {
            "tcp_stream": 183,
            "frame_number": 3186,
            "display_filter": "frame.number == 3186",
            "timestamp_epoch": "1561247265.487488000"
          },
          {
            "tcp_stream": 205,
            "frame_number": 3879,
            "display_filter": "frame.number == 3879",
            "timestamp_epoch": "1561247289.412234000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4ccc1e20853f76df25b0fdb9",
        "last_seen_epoch": "1561247289.412234000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247265.487488000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko",
        "evidence": [
          {
            "tcp_stream": 138,
            "frame_number": 1403,
            "display_filter": "frame.number == 1403",
            "timestamp_epoch": "1561247260.782613000"
          },
          {
            "tcp_stream": 140,
            "frame_number": 1462,
            "display_filter": "frame.number == 1462",
            "timestamp_epoch": "1561247261.361127000"
          },
          {
            "tcp_stream": 148,
            "frame_number": 1720,
            "display_filter": "frame.number == 1720",
            "timestamp_epoch": "1561247261.881869000"
          },
          {
            "tcp_stream": 152,
            "frame_number": 1781,
            "display_filter": "frame.number == 1781",
            "timestamp_epoch": "1561247262.327050000"
          },
          {
            "tcp_stream": 152,
            "frame_number": 1811,
            "display_filter": "frame.number == 1811",
            "timestamp_epoch": "1561247262.637770000"
          },
          {
            "tcp_stream": 153,
            "frame_number": 1813,
            "display_filter": "frame.number == 1813",
            "timestamp_epoch": "1561247262.641599000"
          },
          {
            "tcp_stream": 156,
            "frame_number": 1836,
            "display_filter": "frame.number == 1836",
            "timestamp_epoch": "1561247262.717994000"
          },
          {
            "tcp_stream": 169,
            "frame_number": 2649,
            "display_filter": "frame.number == 2649",
            "timestamp_epoch": "1561247263.809346000"
          },
          {
            "tcp_stream": 172,
            "frame_number": 2789,
            "display_filter": "frame.number == 2789",
            "timestamp_epoch": "1561247263.972756000"
          },
          {
            "tcp_stream": 199,
            "frame_number": 3750,
            "display_filter": "frame.number == 3750",
            "timestamp_epoch": "1561247284.617933000"
          },
          {
            "tcp_stream": 202,
            "frame_number": 3761,
            "display_filter": "frame.number == 3761",
            "timestamp_epoch": "1561247285.237383000"
          },
          {
            "tcp_stream": 201,
            "frame_number": 3842,
            "display_filter": "frame.number == 3842",
            "timestamp_epoch": "1561247287.553767000"
          },
          {
            "tcp_stream": 201,
            "frame_number": 3869,
            "display_filter": "frame.number == 3869",
            "timestamp_epoch": "1561247288.688439000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6268,
            "display_filter": "frame.number == 6268",
            "timestamp_epoch": "1561247390.600547000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6286,
            "display_filter": "frame.number == 6286",
            "timestamp_epoch": "1561247391.280854000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6317,
            "display_filter": "frame.number == 6317",
            "timestamp_epoch": "1561247391.481400000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6343,
            "display_filter": "frame.number == 6343",
            "timestamp_epoch": "1561247391.619220000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6367,
            "display_filter": "frame.number == 6367",
            "timestamp_epoch": "1561247391.999359000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6369,
            "display_filter": "frame.number == 6369",
            "timestamp_epoch": "1561247391.999939000"
          },
          {
            "tcp_stream": 232,
            "frame_number": 6375,
            "display_filter": "frame.number == 6375",
            "timestamp_epoch": "1561247392.006900000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-cc83736654f852110636abce",
        "last_seen_epoch": "1561247393.644968000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247260.782613000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "�",
        "evidence": [
          {
            "tcp_stream": 210,
            "frame_number": 4417,
            "display_filter": "frame.number == 4417",
            "timestamp_epoch": "1561247296.354584000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b332206c243f0e58a8a80d33",
        "last_seen_epoch": "1561247296.354584000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1561247296.354584000"
      }
    ],
    "schema_version": "pcap-analysis-v1",
    "semantic_sha256": "a523d37fb652442f09fef8af2215fc4fe4de55bef981e80127078b946b703d19",
    "analyzer_manifest": {
      "limits": {
        "max_flows": 50000,
        "max_endpoints": 20000,
        "max_upload_bytes": 536870912,
        "max_exported_files": 50000,
        "max_events_per_kind": 50000,
        "max_exported_objects": 500,
        "tool_timeout_seconds": 300,
        "max_object_hash_index": 50000,
        "max_tool_output_bytes": 268435456,
        "max_exported_total_bytes": 268435456,
        "max_exported_object_bytes": 52428800
      },
      "profile_id": "tshark-evidence-v6",
      "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465",
      "schema_version": "pcap-analyzer-manifest-v1",
      "tshark_version": "TShark (Wireshark) 4.4.18.",
      "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0",
      "capinfos_version": "Capinfos (Wireshark) 4.4.18.",
      "rulepack_version": "pcap-rules-v5",
      "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c",
      "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3",
      "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994"
    },
    "attack_candidates": [
      {
        "name": "Ingress Tool Transfer",
        "status": "suggested",
        "tactic": "command-and-control",
        "evidence": [
          {
            "tcp_stream": 140,
            "frame_number": 1462,
            "display_filter": "frame.number == 1462",
            "timestamp_epoch": "1561247261.361127000"
          },
          {
            "tcp_stream": 140,
            "frame_number": 1524,
            "display_filter": "frame.number == 1524",
            "timestamp_epoch": "1561247261.424777000"
          },
          {
            "tcp_stream": 148,
            "frame_number": 1720,
            "display_filter": "frame.number == 1720",
            "timestamp_epoch": "1561247261.881869000"
          },
          {
            "tcp_stream": 148,
            "frame_number": 1734,
            "display_filter": "frame.number == 1734",
            "timestamp_epoch": "1561247261.913335000"
          },
          {
            "tcp_stream": 152,
            "frame_number": 1781,
            "display_filter": "frame.number == 1781",
            "timestamp_epoch": "1561247262.327050000"
          },
          {
            "tcp_stream": 152,
            "frame_number": 1809,
            "display_filter": "frame.number == 1809",
            "timestamp_epoch": "1561247262.362620000"
          },
          {
            "tcp_stream": 156,
            "frame_number": 1836,
            "display_filter": "frame.number == 1836",
            "timestamp_epoch": "1561247262.717994000"
          },
          {
            "tcp_stream": 156,
            "frame_number": 1851,
            "display_filter": "frame.number == 1851",
            "timestamp_epoch": "1561247262.733092000"
          },
          {
            "tcp_stream": 169,
            "frame_number": 2649,
            "display_filter": "frame.number == 2649",
            "timestamp_epoch": "1561247263.809346000"
          },
          {
            "tcp_stream": 169,
            "frame_number": 2787,
            "display_filter": "frame.number == 2787",
            "timestamp_epoch": "1561247263.967936000"
          },
          {
            "tcp_stream": 207,
            "frame_number": 3893,
            "display_filter": "frame.number == 3893",
            "timestamp_epoch": "1561247290.335491000"
          },
          {
            "tcp_stream": 207,
            "frame_number": 4397,
            "display_filter": "frame.number == 4397",
            "timestamp_epoch": "1561247294.066676000"
          },
          {
            "tcp_stream": 210,
            "frame_number": 4417,
            "display_filter": "frame.number == 4417",
            "timestamp_epoch": "1561247296.354584000"
          },
          {
            "tcp_stream": 210,
            "frame_number": 4881,
            "display_filter": "frame.number == 4881",
            "timestamp_epoch": "1561247299.346917000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6343,
            "display_filter": "frame.number == 6343",
            "timestamp_epoch": "1561247391.619220000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6367,
            "display_filter": "frame.number == 6367",
            "timestamp_epoch": "1561247391.999359000"
          },
          {
            "tcp_stream": 234,
            "frame_number": 6432,
            "display_filter": "frame.number == 6432",
            "timestamp_epoch": "1561247392.034702000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6470,
            "display_filter": "frame.number == 6470",
            "timestamp_epoch": "1561247392.063687000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6475,
            "display_filter": "frame.number == 6475",
            "timestamp_epoch": "1561247392.064267000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6497,
            "display_filter": "frame.number == 6497",
            "timestamp_epoch": "1561247392.075452000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6514,
            "display_filter": "frame.number == 6514",
            "timestamp_epoch": "1561247392.084851000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6560,
            "display_filter": "frame.number == 6560",
            "timestamp_epoch": "1561247392.522006000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6562,
            "display_filter": "frame.number == 6562",
            "timestamp_epoch": "1561247392.522037000"
          },
          {
            "tcp_stream": 234,
            "frame_number": 6807,
            "display_filter": "frame.number == 6807",
            "timestamp_epoch": "1561247393.120096000"
          }
        ],
        "attack_id": "T1105",
        "confidence": 0.8,
        "finding_ids": [
          "finding-11e10d956e266bb1f17197e1",
          "finding-1ad8745f112f35735cb5a0a8",
          "finding-1fd15c185fe156513055bdf4",
          "finding-2f5b08bb1d3c8868430f4e23",
          "finding-4a116bcfdf925e0d8bfc2ee2",
          "finding-5104a0204f7bd3cc9acfeb99",
          "finding-5f2de1aa6c579add0e950384",
          "finding-73a8cfed784dbaf2b0d04d22",
          "finding-899c3baf9e827da688f77aca",
          "finding-a7642385f3d14ba128b22f34",
          "finding-e6aedd02e0d353476ed20963",
          "finding-e9ee998a0955f3399f03c498"
        ],
        "mapping_basis": "versioned-deterministic-rule"
      }
    ],
    "analysis_key_material": {
      "source_sha256": "6a89013b9e9bc6d443810245b92f49db4df33c1671a43db03a6bbde8f2bc6e63",
      "rulepack_version": "pcap-rules-v5",
      "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0"
    }
  },
  "context": {
    "mode": "local-only",
    "matches": [],
    "coverage": {
      "truncated": false,
      "no_exact_match": 208,
      "observable_limit": 5000,
      "observables_total": 208,
      "matched_observables": 0,
      "observables_checked": 208,
      "prior_cases_checked": 50,
      "prior_case_limit_reached": true
    },
    "created_at": "2026-09-22T16:04:29.263843+00:00",
    "session_id": "e0273fe8-1b24-4097-8d55-e2f1086ac0f2",
    "techniques": [
      {
        "url": "https://attack.mitre.org/techniques/T1105",
        "name": "Ingress Tool Transfer",
        "status": "catalog-context-not-validation-of-behavior",
        "attack_id": "T1105",
        "detection": "",
        "platforms": [
          "ESXi",
          "Linux",
          "macOS",
          "Network Devices",
          "Windows"
        ],
        "data_sources": [
          "WinEventLog:Sysmon",
          "auditd:SYSCALL",
          "iptables:LOG",
          "macos:endpointsecurity",
          "macos:unifiedlog",
          "esxi:hostd",
          "esxi:vmkernel",
          "NSM:Flow",
          "snmp:syslog"
        ],
        "catalog_version_id": 851,
        "detection_strategies": [
          {
            "name": "Detect Ingress Tool Transfers via Behavioral Chain",
            "stix_id": "x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554",
            "attack_id": "DET0060"
          }
        ],
        "detection_links_truncated": false
      }
    ],
    "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.",
    "schema_version": "pcap-context-v1",
    "snapshot_sha256": "8ac0eedd56c6a97172dc8bee623d3a504e6f14b3aea8a9a8245d2b6bc4e641da",
    "source_actor_links": [],
    "external_enrichment": {
      "reason": "Requires explicit provider consent and privacy review",
      "status": "not-requested",
      "requests": 0
    },
    "source_semantic_sha256": "a523d37fb652442f09fef8af2215fc4fe4de55bef981e80127078b946b703d19",
    "cross_case_correlations": [
      {
        "shared_count": 13,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 10,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 35,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 20,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 17,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 9,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 39,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 28,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 2,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 9,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 4,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 7,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 7,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 10,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 6,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 11,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 12,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 8,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 9,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 3,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 3,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 3,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 10,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 15,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 10,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 1,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 11,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      },
      {
        "shared_count": 10,
        "status": "shared-observation-not-common-campaign",
        "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution."
      }
    ]
  },
  "assessment": {
    "policy_version": "pcap-assessment-v3",
    "source_semantic_sha256": "a523d37fb652442f09fef8af2215fc4fe4de55bef981e80127078b946b703d19",
    "items": [
      {
        "observable_id": "observable-c3494f4f4cb500cb66a8c46f",
        "type": "domain",
        "value": "ads-bid.l.doubleclick.net",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 90,
            "frame_number": 3137,
            "display_filter": "frame.number == 3137",
            "timestamp_epoch": "1561247264.725563000"
          }
        ],
        "roles": [
          "dns-cname"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-12ed60e6c9870ec935eebcb9",
        "type": "domain",
        "value": "ajax.googleapis.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.158753+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:10.341533+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.150039+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 66,
            "frame_number": 1453,
            "display_filter": "frame.number == 1453",
            "timestamp_epoch": "1561247261.331542000"
          },
          {
            "udp_stream": 66,
            "frame_number": 1454,
            "display_filter": "frame.number == 1454",
            "timestamp_epoch": "1561247261.347284000"
          },
          {
            "tcp_stream": 140,
            "frame_number": 1462,
            "display_filter": "frame.number == 1462",
            "timestamp_epoch": "1561247261.361127000"
          }
        ],
        "roles": [
          "dns-query",
          "http-host"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.145495+00:00"
      },
      {
        "observable_id": "observable-505f30ee3a72798cf9fc57b8",
        "type": "domain",
        "value": "api.bing.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 83,
            "frame_number": 2991,
            "display_filter": "frame.number == 2991",
            "timestamp_epoch": "1561247264.369133000"
          },
          {
            "udp_stream": 86,
            "frame_number": 2994,
            "display_filter": "frame.number == 2994",
            "timestamp_epoch": "1561247264.375828000"
          },
          {
            "udp_stream": 86,
            "frame_number": 2997,
            "display_filter": "frame.number == 2997",
            "timestamp_epoch": "1561247264.383906000"
          },
          {
            "udp_stream": 83,
            "frame_number": 2998,
            "display_filter": "frame.number == 2998",
            "timestamp_epoch": "1561247264.383975000"
          },
          {
            "udp_stream": 95,
            "frame_number": 3858,
            "display_filter": "frame.number == 3858",
            "timestamp_epoch": "1561247287.950762000"
          },
          {
            "udp_stream": 95,
            "frame_number": 3859,
            "display_filter": "frame.number == 3859",
            "timestamp_epoch": "1561247287.951071000"
          }
        ],
        "roles": [
          "dns-query"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5e2b1acdbc83afde7ba3247a",
        "type": "domain",
        "value": "bangkok-8ac2-pc.phenomenoc.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 59,
            "frame_number": 973,
            "display_filter": "frame.number == 973",
            "timestamp_epoch": "1561247232.559801000"
          },
          {
            "udp_stream": 59,
            "frame_number": 974,
            "display_filter": "frame.number == 974",
            "timestamp_epoch": "1561247232.560080000"
          }
        ],
        "roles": [
          "dns-query"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2ceb202905d8c84afec748bd",
        "type": "domain",
        "value": "beef2live.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.176045+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:52.996365+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:52.992101+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 65,
            "frame_number": 1392,
            "display_filter": "frame.number == 1392",
            "timestamp_epoch": "1561247260.170668000"
          },
          {
            "udp_stream": 65,
            "frame_number": 1393,
            "display_filter": "frame.number == 1393",
            "timestamp_epoch": "1561247260.170954000"
          },
          {
            "tcp_stream": 138,
            "frame_number": 1403,
            "display_filter": "frame.number == 1403",
            "timestamp_epoch": "1561247260.782613000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6268,
            "display_filter": "frame.number == 6268",
            "timestamp_epoch": "1561247390.600547000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6286,
            "display_filter": "frame.number == 6286",
            "timestamp_epoch": "1561247391.280854000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6317,
            "display_filter": "frame.number == 6317",
            "timestamp_epoch": "1561247391.481400000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6343,
            "display_filter": "frame.number == 6343",
            "timestamp_epoch": "1561247391.619220000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6367,
            "display_filter": "frame.number == 6367",
            "timestamp_epoch": "1561247391.999359000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6369,
            "display_filter": "frame.number == 6369",
            "timestamp_epoch": "1561247391.999939000"
          },
          {
            "tcp_stream": 234,
            "frame_number": 6432,
            "display_filter": "frame.number == 6432",
            "timestamp_epoch": "1561247392.034702000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6475,
            "display_filter": "frame.number == 6475",
            "timestamp_epoch": "1561247392.064267000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6497,
            "display_filter": "frame.number == 6497",
            "timestamp_epoch": "1561247392.075452000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6520,
            "display_filter": "frame.number == 6520",
            "timestamp_epoch": "1561247392.085467000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6600,
            "display_filter": "frame.number == 6600",
            "timestamp_epoch": "1561247392.525706000"
          },
          {
            "tcp_stream": 234,
            "frame_number": 6852,
            "display_filter": "frame.number == 6852",
            "timestamp_epoch": "1561247393.347532000"
          },
          {
            "tcp_stream": 227,
            "frame_number": 6854,
            "display_filter": "frame.number == 6854",
            "timestamp_epoch": "1561247393.347726000"
          },
          {
            "tcp_stream": 226,
            "frame_number": 6860,
            "display_filter": "frame.number == 6860",
            "timestamp_epoch": "1561247393.479635000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6862,
            "display_filter": "frame.number == 6862",
            "timestamp_epoch": "1561247393.479843000"
          },
          {
            "tcp_stream": 256,
            "frame_number": 6979,
            "display_filter": "frame.number == 6979",
            "timestamp_epoch": "1561247393.631042000"
          },
          {
            "tcp_stream": 228,
            "frame_number": 6996,
            "display_filter": "frame.number == 6996",
            "timestamp_epoch": "1561247393.644758000"
          }
        ],
        "roles": [
          "dns-query",
          "http-host",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:52.987583+00:00"
      },
      {
        "observable_id": "observable-50914840d6b1bc1796be8afb",
        "type": "domain",
        "value": "bid.g.doubleclick.net",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.167204+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:16.065253+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.162951+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 90,
            "frame_number": 3136,
            "display_filter": "frame.number == 3136",
            "timestamp_epoch": "1561247264.705292000"
          },
          {
            "udp_stream": 90,
            "frame_number": 3137,
            "display_filter": "frame.number == 3137",
            "timestamp_epoch": "1561247264.725563000"
          },
          {
            "tcp_stream": 182,
            "frame_number": 3144,
            "display_filter": "frame.number == 3144",
            "timestamp_epoch": "1561247264.740324000"
          },
          {
            "tcp_stream": 181,
            "frame_number": 3146,
            "display_filter": "frame.number == 3146",
            "timestamp_epoch": "1561247264.740416000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.158849+00:00"
      },
      {
        "observable_id": "observable-c000a650dcfc46195bc77c9d",
        "type": "domain",
        "value": "bristol-c71f-pc.phenomenoc.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 28,
            "frame_number": 420,
            "display_filter": "frame.number == 420",
            "timestamp_epoch": "1561247197.797419000"
          },
          {
            "udp_stream": 28,
            "frame_number": 421,
            "display_filter": "frame.number == 421",
            "timestamp_epoch": "1561247197.797726000"
          }
        ],
        "roles": [
          "dns-query"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0dd77ca23ed494a56d67cde3",
        "type": "domain",
        "value": "clients.l.google.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "roles": [
          "dns-cname"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b4d36cf7392725e3031efc72",
        "type": "domain",
        "value": "clients1.google.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.172500+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:17.998377+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.168863+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 80,
            "frame_number": 2692,
            "display_filter": "frame.number == 2692",
            "timestamp_epoch": "1561247263.856760000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          },
          {
            "tcp_stream": 172,
            "frame_number": 2789,
            "display_filter": "frame.number == 2789",
            "timestamp_epoch": "1561247263.972756000"
          },
          {
            "tcp_stream": 254,
            "frame_number": 6941,
            "display_filter": "frame.number == 6941",
            "timestamp_epoch": "1561247393.604635000"
          }
        ],
        "roles": [
          "dns-query",
          "http-host"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.167228+00:00"
      },
      {
        "observable_id": "observable-dd364fb4a11e13825ed77f3f",
        "type": "domain",
        "value": "connect.facebook.net",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:14.006547+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.330330+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 73,
            "frame_number": 1819,
            "display_filter": "frame.number == 1819",
            "timestamp_epoch": "1561247262.674584000"
          },
          {
            "udp_stream": 73,
            "frame_number": 1820,
            "display_filter": "frame.number == 1820",
            "timestamp_epoch": "1561247262.695760000"
          },
          {
            "tcp_stream": 156,
            "frame_number": 1836,
            "display_filter": "frame.number == 1836",
            "timestamp_epoch": "1561247262.717994000"
          },
          {
            "tcp_stream": 154,
            "frame_number": 1827,
            "display_filter": "frame.number == 1827",
            "timestamp_epoch": "1561247262.707143000"
          },
          {
            "tcp_stream": 155,
            "frame_number": 1832,
            "display_filter": "frame.number == 1832",
            "timestamp_epoch": "1561247262.712948000"
          },
          {
            "tcp_stream": 161,
            "frame_number": 1920,
            "display_filter": "frame.number == 1920",
            "timestamp_epoch": "1561247262.787382000"
          },
          {
            "tcp_stream": 250,
            "frame_number": 6626,
            "display_filter": "frame.number == 6626",
            "timestamp_epoch": "1561247392.535623000"
          },
          {
            "tcp_stream": 251,
            "frame_number": 6628,
            "display_filter": "frame.number == 6628",
            "timestamp_epoch": "1561247392.535837000"
          }
        ],
        "roles": [
          "dns-query",
          "http-host",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.322094+00:00"
      },
      {
        "observable_id": "observable-336cfaab65d7dea44104ce02",
        "type": "domain",
        "value": "cse.google.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:18.506438+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.339358+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1823,
            "display_filter": "frame.number == 1823",
            "timestamp_epoch": "1561247262.703159000"
          },
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "tcp_stream": 169,
            "frame_number": 2649,
            "display_filter": "frame.number == 2649",
            "timestamp_epoch": "1561247263.809346000"
          },
          {
            "tcp_stream": 157,
            "frame_number": 1878,
            "display_filter": "frame.number == 1878",
            "timestamp_epoch": "1561247262.747786000"
          },
          {
            "tcp_stream": 158,
            "frame_number": 1880,
            "display_filter": "frame.number == 1880",
            "timestamp_epoch": "1561247262.747896000"
          },
          {
            "tcp_stream": 244,
            "frame_number": 6476,
            "display_filter": "frame.number == 6476",
            "timestamp_epoch": "1561247392.064329000"
          },
          {
            "tcp_stream": 245,
            "frame_number": 6481,
            "display_filter": "frame.number == 6481",
            "timestamp_epoch": "1561247392.064892000"
          }
        ],
        "roles": [
          "dns-query",
          "http-host",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.335322+00:00"
      },
      {
        "observable_id": "observable-ffcb46a0250fa3bca72c2a13",
        "type": "domain",
        "value": "d3569ngd5kwbnf.cloudfront.net",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 105,
            "frame_number": 6509,
            "display_filter": "frame.number == 6509",
            "timestamp_epoch": "1561247392.082847000"
          }
        ],
        "roles": [
          "dns-cname"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6030d24916c4a3d9b0702da3",
        "type": "domain",
        "value": "dns.msftncsi.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 63,
            "frame_number": 1377,
            "display_filter": "frame.number == 1377",
            "timestamp_epoch": "1561247255.291829000"
          },
          {
            "udp_stream": 63,
            "frame_number": 1378,
            "display_filter": "frame.number == 1378",
            "timestamp_epoch": "1561247255.327697000"
          },
          {
            "udp_stream": 64,
            "frame_number": 1379,
            "display_filter": "frame.number == 1379",
            "timestamp_epoch": "1561247255.328144000"
          },
          {
            "udp_stream": 64,
            "frame_number": 1380,
            "display_filter": "frame.number == 1380",
            "timestamp_epoch": "1561247255.328332000"
          }
        ],
        "roles": [
          "dns-query"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ec14a2b1d76ecd1680d002c9",
        "type": "domain",
        "value": "fghjkmgru34.site",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.746026+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.577985+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.575480+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 102,
            "frame_number": 4886,
            "display_filter": "frame.number == 4886",
            "timestamp_epoch": "1561247302.513902000"
          },
          {
            "udp_stream": 102,
            "frame_number": 4889,
            "display_filter": "frame.number == 4889",
            "timestamp_epoch": "1561247302.953345000"
          },
          {
            "tcp_stream": 211,
            "frame_number": 4893,
            "display_filter": "frame.number == 4893",
            "timestamp_epoch": "1561247303.076396000"
          },
          {
            "tcp_stream": 212,
            "frame_number": 4907,
            "display_filter": "frame.number == 4907",
            "timestamp_epoch": "1561247307.815439000"
          },
          {
            "tcp_stream": 213,
            "frame_number": 5364,
            "display_filter": "frame.number == 5364",
            "timestamp_epoch": "1561247309.386333000"
          },
          {
            "tcp_stream": 214,
            "frame_number": 5852,
            "display_filter": "frame.number == 5852",
            "timestamp_epoch": "1561247310.208061000"
          }
        ],
        "roles": [
          "dns-query",
          "http-host"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:53.571206+00:00"
      },
      {
        "observable_id": "observable-1242d7b6dd2587a54dff78a2",
        "type": "domain",
        "value": "fonts.googleapis.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:19.818148+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.349165+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 106,
            "frame_number": 6350,
            "display_filter": "frame.number == 6350",
            "timestamp_epoch": "1561247391.626791000"
          },
          {
            "udp_stream": 106,
            "frame_number": 6390,
            "display_filter": "frame.number == 6390",
            "timestamp_epoch": "1561247392.017533000"
          },
          {
            "tcp_stream": 243,
            "frame_number": 6408,
            "display_filter": "frame.number == 6408",
            "timestamp_epoch": "1561247392.030188000"
          },
          {
            "tcp_stream": 242,
            "frame_number": 6416,
            "display_filter": "frame.number == 6416",
            "timestamp_epoch": "1561247392.031356000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.344538+00:00"
      },
      {
        "observable_id": "observable-57ffe4ac402911a8768028a2",
        "type": "domain",
        "value": "fonts.gstatic.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:19.985832+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.358315+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 81,
            "frame_number": 2828,
            "display_filter": "frame.number == 2828",
            "timestamp_epoch": "1561247264.057758000"
          },
          {
            "udp_stream": 81,
            "frame_number": 2829,
            "display_filter": "frame.number == 2829",
            "timestamp_epoch": "1561247264.072915000"
          },
          {
            "tcp_stream": 175,
            "frame_number": 2839,
            "display_filter": "frame.number == 2839",
            "timestamp_epoch": "1561247264.090457000"
          },
          {
            "tcp_stream": 176,
            "frame_number": 2841,
            "display_filter": "frame.number == 2841",
            "timestamp_epoch": "1561247264.090692000"
          },
          {
            "tcp_stream": 174,
            "frame_number": 2843,
            "display_filter": "frame.number == 2843",
            "timestamp_epoch": "1561247264.092729000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.353042+00:00"
      },
      {
        "observable_id": "observable-06d3fdaa42a1a49b9d37f8c7",
        "type": "domain",
        "value": "googleadapis.l.google.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 106,
            "frame_number": 6390,
            "display_filter": "frame.number == 6390",
            "timestamp_epoch": "1561247392.017533000"
          }
        ],
        "roles": [
          "dns-cname"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8a9f7c208658d6d4255f5d9a",
        "type": "domain",
        "value": "googleads.g.doubleclick.net",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:42.522371+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.370103+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 71,
            "frame_number": 1737,
            "display_filter": "frame.number == 1737",
            "timestamp_epoch": "1561247262.191255000"
          },
          {
            "udp_stream": 71,
            "frame_number": 1738,
            "display_filter": "frame.number == 1738",
            "timestamp_epoch": "1561247262.208719000"
          },
          {
            "tcp_stream": 150,
            "frame_number": 1743,
            "display_filter": "frame.number == 1743",
            "timestamp_epoch": "1561247262.221483000"
          },
          {
            "tcp_stream": 151,
            "frame_number": 1747,
            "display_filter": "frame.number == 1747",
            "timestamp_epoch": "1561247262.222981000"
          },
          {
            "tcp_stream": 229,
            "frame_number": 6325,
            "display_filter": "frame.number == 6325",
            "timestamp_epoch": "1561247391.533388000"
          },
          {
            "tcp_stream": 230,
            "frame_number": 6327,
            "display_filter": "frame.number == 6327",
            "timestamp_epoch": "1561247391.533584000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.364202+00:00"
      },
      {
        "observable_id": "observable-dda87fe98c7eaf869d2378c0",
        "type": "domain",
        "value": "googleapis.l.google.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 66,
            "frame_number": 1454,
            "display_filter": "frame.number == 1454",
            "timestamp_epoch": "1561247261.347284000"
          },
          {
            "udp_stream": 79,
            "frame_number": 2642,
            "display_filter": "frame.number == 2642",
            "timestamp_epoch": "1561247263.800132000"
          }
        ],
        "roles": [
          "dns-cname"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4fd4e6e5b0ad17bad2ddcf0e",
        "type": "domain",
        "value": "gstaticadssl.l.google.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 81,
            "frame_number": 2829,
            "display_filter": "frame.number == 2829",
            "timestamp_epoch": "1561247264.072915000"
          }
        ],
        "roles": [
          "dns-cname"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e2c6c44c607f1cc20130b094",
        "type": "domain",
        "value": "iecvlist.microsoft.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:00.584505+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.384429+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 101,
            "frame_number": 3895,
            "display_filter": "frame.number == 3895",
            "timestamp_epoch": "1561247290.403822000"
          },
          {
            "udp_stream": 101,
            "frame_number": 3896,
            "display_filter": "frame.number == 3896",
            "timestamp_epoch": "1561247290.404107000"
          },
          {
            "udp_stream": 104,
            "frame_number": 5918,
            "display_filter": "frame.number == 5918",
            "timestamp_epoch": "1561247314.083341000"
          },
          {
            "udp_stream": 104,
            "frame_number": 5919,
            "display_filter": "frame.number == 5919",
            "timestamp_epoch": "1561247314.083666000"
          },
          {
            "tcp_stream": 209,
            "frame_number": 3903,
            "display_filter": "frame.number == 3903",
            "timestamp_epoch": "1561247290.450381000"
          },
          {
            "tcp_stream": 208,
            "frame_number": 3905,
            "display_filter": "frame.number == 3905",
            "timestamp_epoch": "1561247290.450632000"
          },
          {
            "tcp_stream": 216,
            "frame_number": 5926,
            "display_filter": "frame.number == 5926",
            "timestamp_epoch": "1561247314.104889000"
          },
          {
            "tcp_stream": 215,
            "frame_number": 5927,
            "display_filter": "frame.number == 5927",
            "timestamp_epoch": "1561247314.104969000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.378254+00:00"
      },
      {
        "observable_id": "observable-f9ec368af37831f934cdd4da",
        "type": "domain",
        "value": "isatap.localdomain",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 25,
            "frame_number": 291,
            "display_filter": "frame.number == 291",
            "timestamp_epoch": "1561247195.455927000"
          },
          {
            "udp_stream": 25,
            "frame_number": 292,
            "display_filter": "frame.number == 292",
            "timestamp_epoch": "1561247195.456212000"
          },
          {
            "udp_stream": 55,
            "frame_number": 949,
            "display_filter": "frame.number == 949",
            "timestamp_epoch": "1561247229.003302000"
          },
          {
            "udp_stream": 55,
            "frame_number": 950,
            "display_filter": "frame.number == 950",
            "timestamp_epoch": "1561247229.003560000"
          }
        ],
        "roles": [
          "dns-query"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ac4ccf754406e23ad79ba82d",
        "type": "domain",
        "value": "isatap.phenomenoc.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 18,
            "frame_number": 242,
            "display_filter": "frame.number == 242",
            "timestamp_epoch": "1561247193.927451000"
          },
          {
            "udp_stream": 18,
            "frame_number": 244,
            "display_filter": "frame.number == 244",
            "timestamp_epoch": "1561247193.927737000"
          },
          {
            "udp_stream": 53,
            "frame_number": 945,
            "display_filter": "frame.number == 945",
            "timestamp_epoch": "1561247228.852283000"
          },
          {
            "udp_stream": 53,
            "frame_number": 946,
            "display_filter": "frame.number == 946",
            "timestamp_epoch": "1561247228.852537000"
          }
        ],
        "roles": [
          "dns-query"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9bd36e23ee49c9080a9fc85e",
        "type": "domain",
        "value": "letsdoitquick.site",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.403863+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.398094+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 94,
            "frame_number": 3741,
            "display_filter": "frame.number == 3741",
            "timestamp_epoch": "1561247283.724891000"
          },
          {
            "udp_stream": 94,
            "frame_number": 3742,
            "display_filter": "frame.number == 3742",
            "timestamp_epoch": "1561247283.743525000"
          },
          {
            "tcp_stream": 199,
            "frame_number": 3750,
            "display_filter": "frame.number == 3750",
            "timestamp_epoch": "1561247284.617933000"
          }
        ],
        "roles": [
          "dns-query",
          "http-host"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.391097+00:00"
      },
      {
        "observable_id": "observable-684832355e6dc8201fd6b876",
        "type": "domain",
        "value": "pagead.l.doubleclick.net",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 70,
            "frame_number": 1711,
            "display_filter": "frame.number == 1711",
            "timestamp_epoch": "1561247261.871130000"
          }
        ],
        "roles": [
          "dns-cname"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-411f70024c6db02ea41b7e39",
        "type": "domain",
        "value": "pagead46.l.doubleclick.net",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 71,
            "frame_number": 1738,
            "display_filter": "frame.number == 1738",
            "timestamp_epoch": "1561247262.208719000"
          }
        ],
        "roles": [
          "dns-cname"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c7ab7b5aa56a3f3a089af1fd",
        "type": "domain",
        "value": "phenomenoc-dc.phenomenoc.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 2,
            "frame_number": 5,
            "display_filter": "frame.number == 5",
            "timestamp_epoch": "1561247190.433077000"
          },
          {
            "udp_stream": 2,
            "frame_number": 6,
            "display_filter": "frame.number == 6",
            "timestamp_epoch": "1561247190.433338000"
          },
          {
            "udp_stream": 17,
            "frame_number": 239,
            "display_filter": "frame.number == 239",
            "timestamp_epoch": "1561247193.918939000"
          },
          {
            "udp_stream": 17,
            "frame_number": 240,
            "display_filter": "frame.number == 240",
            "timestamp_epoch": "1561247193.919255000"
          },
          {
            "udp_stream": 22,
            "frame_number": 256,
            "display_filter": "frame.number == 256",
            "timestamp_epoch": "1561247195.372409000"
          },
          {
            "udp_stream": 22,
            "frame_number": 257,
            "display_filter": "frame.number == 257",
            "timestamp_epoch": "1561247195.372677000"
          },
          {
            "udp_stream": 36,
            "frame_number": 558,
            "display_filter": "frame.number == 558",
            "timestamp_epoch": "1561247225.116361000"
          },
          {
            "udp_stream": 36,
            "frame_number": 559,
            "display_filter": "frame.number == 559",
            "timestamp_epoch": "1561247225.116693000"
          },
          {
            "udp_stream": 54,
            "frame_number": 947,
            "display_filter": "frame.number == 947",
            "timestamp_epoch": "1561247228.852987000"
          },
          {
            "udp_stream": 54,
            "frame_number": 948,
            "display_filter": "frame.number == 948",
            "timestamp_epoch": "1561247228.853164000"
          }
        ],
        "roles": [
          "dns-query"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8e49d761240c204e6af8703b",
        "type": "domain",
        "value": "phenomenoc.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.927808+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.754749+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.750262+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 29,
            "frame_number": 422,
            "display_filter": "frame.number == 422",
            "timestamp_epoch": "1561247197.798498000"
          },
          {
            "udp_stream": 29,
            "frame_number": 423,
            "display_filter": "frame.number == 423",
            "timestamp_epoch": "1561247197.799092000"
          },
          {
            "udp_stream": 60,
            "frame_number": 975,
            "display_filter": "frame.number == 975",
            "timestamp_epoch": "1561247232.560966000"
          },
          {
            "udp_stream": 60,
            "frame_number": 976,
            "display_filter": "frame.number == 976",
            "timestamp_epoch": "1561247232.561538000"
          }
        ],
        "roles": [
          "dns-query"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:53.746087+00:00"
      },
      {
        "observable_id": "observable-7aaa62709fedf9b1f805f872",
        "type": "domain",
        "value": "platform.twitter.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.591506+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.586152+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 75,
            "frame_number": 1829,
            "display_filter": "frame.number == 1829",
            "timestamp_epoch": "1561247262.710024000"
          },
          {
            "udp_stream": 75,
            "frame_number": 1855,
            "display_filter": "frame.number == 1855",
            "timestamp_epoch": "1561247262.734217000"
          },
          {
            "tcp_stream": 159,
            "frame_number": 1872,
            "display_filter": "frame.number == 1872",
            "timestamp_epoch": "1561247262.746928000"
          },
          {
            "tcp_stream": 160,
            "frame_number": 1875,
            "display_filter": "frame.number == 1875",
            "timestamp_epoch": "1561247262.747182000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.581189+00:00"
      },
      {
        "observable_id": "observable-a1f1511a10bcc4826c1f015d",
        "type": "domain",
        "value": "portal.farmcentric.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.368977+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.184298+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.180206+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 68,
            "frame_number": 1510,
            "display_filter": "frame.number == 1510",
            "timestamp_epoch": "1561247261.417408000"
          },
          {
            "udp_stream": 68,
            "frame_number": 1511,
            "display_filter": "frame.number == 1511",
            "timestamp_epoch": "1561247261.417763000"
          },
          {
            "tcp_stream": 236,
            "frame_number": 6434,
            "display_filter": "frame.number == 6434",
            "timestamp_epoch": "1561247392.034821000"
          },
          {
            "tcp_stream": 237,
            "frame_number": 6442,
            "display_filter": "frame.number == 6442",
            "timestamp_epoch": "1561247392.036635000"
          },
          {
            "tcp_stream": 144,
            "frame_number": 1530,
            "display_filter": "frame.number == 1530",
            "timestamp_epoch": "1561247261.495740000"
          },
          {
            "tcp_stream": 145,
            "frame_number": 1536,
            "display_filter": "frame.number == 1536",
            "timestamp_epoch": "1561247261.496614000"
          },
          {
            "tcp_stream": 238,
            "frame_number": 6422,
            "display_filter": "frame.number == 6422",
            "timestamp_epoch": "1561247392.032145000"
          },
          {
            "tcp_stream": 239,
            "frame_number": 6438,
            "display_filter": "frame.number == 6438",
            "timestamp_epoch": "1561247392.035174000"
          }
        ],
        "roles": [
          "dns-query",
          "http-host",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:53.176108+00:00"
      },
      {
        "observable_id": "observable-08f912818278a2042e9f225b",
        "type": "domain",
        "value": "scontent.xx.fbcdn.net",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 73,
            "frame_number": 1820,
            "display_filter": "frame.number == 1820",
            "timestamp_epoch": "1561247262.695760000"
          },
          {
            "udp_stream": 77,
            "frame_number": 2369,
            "display_filter": "frame.number == 2369",
            "timestamp_epoch": "1561247263.378913000"
          },
          {
            "udp_stream": 93,
            "frame_number": 3309,
            "display_filter": "frame.number == 3309",
            "timestamp_epoch": "1561247270.428911000"
          }
        ],
        "roles": [
          "dns-cname"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-49c3e0b75c93b65d2059a325",
        "type": "domain",
        "value": "ssl.gstatic.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:44.559966+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.771467+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 89,
            "frame_number": 3092,
            "display_filter": "frame.number == 3092",
            "timestamp_epoch": "1561247264.551377000"
          },
          {
            "udp_stream": 89,
            "frame_number": 3099,
            "display_filter": "frame.number == 3099",
            "timestamp_epoch": "1561247264.566187000"
          },
          {
            "tcp_stream": 179,
            "frame_number": 3108,
            "display_filter": "frame.number == 3108",
            "timestamp_epoch": "1561247264.582974000"
          },
          {
            "tcp_stream": 180,
            "frame_number": 3110,
            "display_filter": "frame.number == 3110",
            "timestamp_epoch": "1561247264.583905000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.766798+00:00"
      },
      {
        "observable_id": "observable-fa648015342403ba8ff0a02d",
        "type": "domain",
        "value": "star-mini.c10r.facebook.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 92,
            "frame_number": 3210,
            "display_filter": "frame.number == 3210",
            "timestamp_epoch": "1561247270.199357000"
          }
        ],
        "roles": [
          "dns-cname"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f53cb88e0f287afca2727cbe",
        "type": "domain",
        "value": "static.xx.fbcdn.net",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.784522+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.780023+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 93,
            "frame_number": 3308,
            "display_filter": "frame.number == 3308",
            "timestamp_epoch": "1561247270.428637000"
          },
          {
            "udp_stream": 93,
            "frame_number": 3309,
            "display_filter": "frame.number == 3309",
            "timestamp_epoch": "1561247270.428911000"
          },
          {
            "tcp_stream": 194,
            "frame_number": 3351,
            "display_filter": "frame.number == 3351",
            "timestamp_epoch": "1561247270.468082000"
          },
          {
            "tcp_stream": 197,
            "frame_number": 3712,
            "display_filter": "frame.number == 3712",
            "timestamp_epoch": "1561247273.454412000"
          },
          {
            "tcp_stream": 198,
            "frame_number": 3713,
            "display_filter": "frame.number == 3713",
            "timestamp_epoch": "1561247273.454524000"
          },
          {
            "tcp_stream": 196,
            "frame_number": 3715,
            "display_filter": "frame.number == 3715",
            "timestamp_epoch": "1561247273.454705000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:54.775869+00:00"
      },
      {
        "observable_id": "observable-f1d2c97a7177fd6b7088dae8",
        "type": "domain",
        "value": "staticxx.facebook.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.130563+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.127845+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 77,
            "frame_number": 2368,
            "display_filter": "frame.number == 2368",
            "timestamp_epoch": "1561247263.378660000"
          },
          {
            "udp_stream": 77,
            "frame_number": 2369,
            "display_filter": "frame.number == 2369",
            "timestamp_epoch": "1561247263.378913000"
          },
          {
            "tcp_stream": 167,
            "frame_number": 3049,
            "display_filter": "frame.number == 3049",
            "timestamp_epoch": "1561247264.452287000"
          },
          {
            "tcp_stream": 185,
            "frame_number": 3201,
            "display_filter": "frame.number == 3201",
            "timestamp_epoch": "1561247266.398278000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:55.124117+00:00"
      },
      {
        "observable_id": "observable-a8f99ff977c4f409ba97d115",
        "type": "domain",
        "value": "syndication.twitter.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.321752+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.317515+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 82,
            "frame_number": 2894,
            "display_filter": "frame.number == 2894",
            "timestamp_epoch": "1561247264.157893000"
          },
          {
            "udp_stream": 82,
            "frame_number": 2895,
            "display_filter": "frame.number == 2895",
            "timestamp_epoch": "1561247264.158140000"
          },
          {
            "tcp_stream": 178,
            "frame_number": 2963,
            "display_filter": "frame.number == 2963",
            "timestamp_epoch": "1561247264.272189000"
          },
          {
            "tcp_stream": 177,
            "frame_number": 2965,
            "display_filter": "frame.number == 2965",
            "timestamp_epoch": "1561247264.272415000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:55.312670+00:00"
      },
      {
        "observable_id": "observable-4d0aeb5e2f6db5d9e98fccca",
        "type": "domain",
        "value": "wpad.localdomain",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 21,
            "frame_number": 255,
            "display_filter": "frame.number == 255",
            "timestamp_epoch": "1561247195.371989000"
          },
          {
            "udp_stream": 21,
            "frame_number": 287,
            "display_filter": "frame.number == 287",
            "timestamp_epoch": "1561247195.395072000"
          }
        ],
        "roles": [
          "dns-query"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c8ed365eb82ae8505eb49d08",
        "type": "domain",
        "value": "wpad.phenomenoc.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 15,
            "frame_number": 230,
            "display_filter": "frame.number == 230",
            "timestamp_epoch": "1561247192.798982000"
          },
          {
            "udp_stream": 15,
            "frame_number": 231,
            "display_filter": "frame.number == 231",
            "timestamp_epoch": "1561247192.799167000"
          },
          {
            "udp_stream": 20,
            "frame_number": 251,
            "display_filter": "frame.number == 251",
            "timestamp_epoch": "1561247195.371302000"
          },
          {
            "udp_stream": 20,
            "frame_number": 253,
            "display_filter": "frame.number == 253",
            "timestamp_epoch": "1561247195.371564000"
          },
          {
            "udp_stream": 51,
            "frame_number": 936,
            "display_filter": "frame.number == 936",
            "timestamp_epoch": "1561247227.565048000"
          },
          {
            "udp_stream": 51,
            "frame_number": 937,
            "display_filter": "frame.number == 937",
            "timestamp_epoch": "1561247227.565241000"
          }
        ],
        "roles": [
          "dns-query"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8924766a99421667cea60a8f",
        "type": "domain",
        "value": "www-google-analytics.l.google.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "roles": [
          "dns-cname"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-62b120eae41d9e2bab3bf8b7",
        "type": "domain",
        "value": "www-googletagmanager.l.google.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 69,
            "frame_number": 1578,
            "display_filter": "frame.number == 1578",
            "timestamp_epoch": "1561247261.621737000"
          }
        ],
        "roles": [
          "dns-cname"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-67aeec17c77d6c3acb0a47e3",
        "type": "domain",
        "value": "www.bing.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:28.166581+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.514397+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 84,
            "frame_number": 2992,
            "display_filter": "frame.number == 2992",
            "timestamp_epoch": "1561247264.372990000"
          },
          {
            "udp_stream": 85,
            "frame_number": 2993,
            "display_filter": "frame.number == 2993",
            "timestamp_epoch": "1561247264.374122000"
          },
          {
            "udp_stream": 87,
            "frame_number": 2995,
            "display_filter": "frame.number == 2995",
            "timestamp_epoch": "1561247264.376745000"
          },
          {
            "udp_stream": 88,
            "frame_number": 2996,
            "display_filter": "frame.number == 2996",
            "timestamp_epoch": "1561247264.377965000"
          },
          {
            "udp_stream": 85,
            "frame_number": 3036,
            "display_filter": "frame.number == 3036",
            "timestamp_epoch": "1561247264.439549000"
          },
          {
            "udp_stream": 87,
            "frame_number": 3037,
            "display_filter": "frame.number == 3037",
            "timestamp_epoch": "1561247264.439629000"
          },
          {
            "udp_stream": 88,
            "frame_number": 3038,
            "display_filter": "frame.number == 3038",
            "timestamp_epoch": "1561247264.439693000"
          },
          {
            "udp_stream": 84,
            "frame_number": 3039,
            "display_filter": "frame.number == 3039",
            "timestamp_epoch": "1561247264.439764000"
          },
          {
            "udp_stream": 91,
            "frame_number": 3180,
            "display_filter": "frame.number == 3180",
            "timestamp_epoch": "1561247265.431804000"
          },
          {
            "udp_stream": 91,
            "frame_number": 3181,
            "display_filter": "frame.number == 3181",
            "timestamp_epoch": "1561247265.473452000"
          },
          {
            "udp_stream": 96,
            "frame_number": 3860,
            "display_filter": "frame.number == 3860",
            "timestamp_epoch": "1561247287.954342000"
          },
          {
            "udp_stream": 97,
            "frame_number": 3861,
            "display_filter": "frame.number == 3861",
            "timestamp_epoch": "1561247287.954812000"
          },
          {
            "udp_stream": 98,
            "frame_number": 3862,
            "display_filter": "frame.number == 3862",
            "timestamp_epoch": "1561247287.956352000"
          },
          {
            "udp_stream": 99,
            "frame_number": 3863,
            "display_filter": "frame.number == 3863",
            "timestamp_epoch": "1561247287.957364000"
          },
          {
            "udp_stream": 97,
            "frame_number": 3865,
            "display_filter": "frame.number == 3865",
            "timestamp_epoch": "1561247288.316485000"
          },
          {
            "udp_stream": 98,
            "frame_number": 3866,
            "display_filter": "frame.number == 3866",
            "timestamp_epoch": "1561247288.316682000"
          },
          {
            "udp_stream": 99,
            "frame_number": 3867,
            "display_filter": "frame.number == 3867",
            "timestamp_epoch": "1561247288.316802000"
          },
          {
            "udp_stream": 96,
            "frame_number": 3868,
            "display_filter": "frame.number == 3868",
            "timestamp_epoch": "1561247288.316915000"
          },
          {
            "udp_stream": 100,
            "frame_number": 3871,
            "display_filter": "frame.number == 3871",
            "timestamp_epoch": "1561247289.198960000"
          },
          {
            "udp_stream": 100,
            "frame_number": 3874,
            "display_filter": "frame.number == 3874",
            "timestamp_epoch": "1561247289.399319000"
          }
        ],
        "roles": [
          "dns-query",
          "http-host"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:55.508416+00:00"
      },
      {
        "observable_id": "observable-2685e049a88c8636c938ff9a",
        "type": "domain",
        "value": "www.facebook.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.529465+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.523678+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 78,
            "frame_number": 2473,
            "display_filter": "frame.number == 2473",
            "timestamp_epoch": "1561247263.513314000"
          },
          {
            "udp_stream": 78,
            "frame_number": 3065,
            "display_filter": "frame.number == 3065",
            "timestamp_epoch": "1561247264.503993000"
          },
          {
            "udp_stream": 78,
            "frame_number": 3192,
            "display_filter": "frame.number == 3192",
            "timestamp_epoch": "1561247265.512123000"
          },
          {
            "udp_stream": 78,
            "frame_number": 3207,
            "display_filter": "frame.number == 3207",
            "timestamp_epoch": "1561247267.524486000"
          },
          {
            "udp_stream": 78,
            "frame_number": 3208,
            "display_filter": "frame.number == 3208",
            "timestamp_epoch": "1561247270.164049000"
          },
          {
            "udp_stream": 92,
            "frame_number": 3209,
            "display_filter": "frame.number == 3209",
            "timestamp_epoch": "1561247270.166321000"
          },
          {
            "udp_stream": 92,
            "frame_number": 3210,
            "display_filter": "frame.number == 3210",
            "timestamp_epoch": "1561247270.199357000"
          },
          {
            "tcp_stream": 186,
            "frame_number": 3225,
            "display_filter": "frame.number == 3225",
            "timestamp_epoch": "1561247270.223580000"
          },
          {
            "tcp_stream": 190,
            "frame_number": 3227,
            "display_filter": "frame.number == 3227",
            "timestamp_epoch": "1561247270.223785000"
          },
          {
            "tcp_stream": 188,
            "frame_number": 3230,
            "display_filter": "frame.number == 3230",
            "timestamp_epoch": "1561247270.224180000"
          },
          {
            "tcp_stream": 187,
            "frame_number": 3231,
            "display_filter": "frame.number == 3231",
            "timestamp_epoch": "1561247270.224254000"
          },
          {
            "tcp_stream": 195,
            "frame_number": 3697,
            "display_filter": "frame.number == 3697",
            "timestamp_epoch": "1561247273.219467000"
          },
          {
            "tcp_stream": 259,
            "frame_number": 7010,
            "display_filter": "frame.number == 7010",
            "timestamp_epoch": "1561247393.665953000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 7011,
            "display_filter": "frame.number == 7011",
            "timestamp_epoch": "1561247393.666065000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:55.519058+00:00"
      },
      {
        "observable_id": "observable-e4af5e4947b0823ba1a1c300",
        "type": "domain",
        "value": "www.farmprogress.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.711430+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.706604+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 105,
            "frame_number": 6347,
            "display_filter": "frame.number == 6347",
            "timestamp_epoch": "1561247391.622604000"
          },
          {
            "udp_stream": 105,
            "frame_number": 6509,
            "display_filter": "frame.number == 6509",
            "timestamp_epoch": "1561247392.082847000"
          },
          {
            "tcp_stream": 246,
            "frame_number": 6610,
            "display_filter": "frame.number == 6610",
            "timestamp_epoch": "1561247392.529697000"
          },
          {
            "tcp_stream": 247,
            "frame_number": 6618,
            "display_filter": "frame.number == 6618",
            "timestamp_epoch": "1561247392.533958000"
          },
          {
            "tcp_stream": 248,
            "frame_number": 6622,
            "display_filter": "frame.number == 6622",
            "timestamp_epoch": "1561247392.534881000"
          },
          {
            "tcp_stream": 249,
            "frame_number": 6624,
            "display_filter": "frame.number == 6624",
            "timestamp_epoch": "1561247392.535330000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:55.701667+00:00"
      },
      {
        "observable_id": "observable-285e869b296e4a7d8dc5e798",
        "type": "domain",
        "value": "www.google-analytics.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.888530+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.883564+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1773,
            "display_filter": "frame.number == 1773",
            "timestamp_epoch": "1561247262.297156000"
          },
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          },
          {
            "tcp_stream": 152,
            "frame_number": 1781,
            "display_filter": "frame.number == 1781",
            "timestamp_epoch": "1561247262.327050000"
          },
          {
            "tcp_stream": 152,
            "frame_number": 1811,
            "display_filter": "frame.number == 1811",
            "timestamp_epoch": "1561247262.637770000"
          },
          {
            "tcp_stream": 153,
            "frame_number": 1813,
            "display_filter": "frame.number == 1813",
            "timestamp_epoch": "1561247262.641599000"
          },
          {
            "tcp_stream": 232,
            "frame_number": 6375,
            "display_filter": "frame.number == 6375",
            "timestamp_epoch": "1561247392.006900000"
          },
          {
            "tcp_stream": 231,
            "frame_number": 6379,
            "display_filter": "frame.number == 6379",
            "timestamp_epoch": "1561247392.007298000"
          }
        ],
        "roles": [
          "dns-query",
          "http-host"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:55.878963+00:00"
      },
      {
        "observable_id": "observable-ba49b256dcaf07616bcfa300",
        "type": "domain",
        "value": "www.google.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No direct maliciousness evidence",
            "actors": [],
            "source": "threatfox",
            "status": "ok",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:45.279334+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "meet.google.com-join.us",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://drive.usercontent.google.com/download?id=1RsoI3BAuH3uMNc6wdwwamUtsJhL6hHiB&export=download&confirm=t&uuid=32ec83bf-6d8e-4069-ac04-2cc059ae19e5",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/claudemacos",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/brewpage",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/version-0105",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/hiddenhub",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/xnewbrenow",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/mellerbrew",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/clodemacx",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/xbreshamewmew",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/onemacx",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/clavdenbewvews",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/clau-deskt-ver-24",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/deutchbremac",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/clau-ver-un-24",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/clau-ver-un-v25",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/xbrewmacboe",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/claumacxvsz",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/payforwin",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/xbiernlk",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/newpayservices.com/cdx-biz-ver-un-v27",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/newappclaude.com/clau-ver-un-30",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7T",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/mehrmarkenwerkstattheiligensta/home",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/facturacion2026mx",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              }
            ]
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.061053+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1464,
            "display_filter": "frame.number == 1464",
            "timestamp_epoch": "1561247261.365825000"
          },
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          },
          {
            "tcp_stream": 143,
            "frame_number": 1532,
            "display_filter": "frame.number == 1532",
            "timestamp_epoch": "1561247261.496133000"
          },
          {
            "tcp_stream": 142,
            "frame_number": 1534,
            "display_filter": "frame.number == 1534",
            "timestamp_epoch": "1561247261.496408000"
          },
          {
            "tcp_stream": 165,
            "frame_number": 2344,
            "display_filter": "frame.number == 2344",
            "timestamp_epoch": "1561247263.333716000"
          },
          {
            "tcp_stream": 240,
            "frame_number": 6383,
            "display_filter": "frame.number == 6383",
            "timestamp_epoch": "1561247392.014828000"
          },
          {
            "tcp_stream": 241,
            "frame_number": 6387,
            "display_filter": "frame.number == 6387",
            "timestamp_epoch": "1561247392.015511000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:56.056206+00:00"
      },
      {
        "observable_id": "observable-b0707daf41e5ddb7bf39fa52",
        "type": "domain",
        "value": "www.googleadservices.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.074296+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.069557+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 70,
            "frame_number": 1691,
            "display_filter": "frame.number == 1691",
            "timestamp_epoch": "1561247261.849626000"
          },
          {
            "udp_stream": 70,
            "frame_number": 1711,
            "display_filter": "frame.number == 1711",
            "timestamp_epoch": "1561247261.871130000"
          },
          {
            "tcp_stream": 148,
            "frame_number": 1720,
            "display_filter": "frame.number == 1720",
            "timestamp_epoch": "1561247261.881869000"
          }
        ],
        "roles": [
          "dns-query",
          "http-host"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:56.065597+00:00"
      },
      {
        "observable_id": "observable-81688930e836c77ef0eb146e",
        "type": "domain",
        "value": "www.googleapis.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No direct maliciousness evidence",
            "actors": [],
            "source": "threatfox",
            "status": "ok",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.261656+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [
              {
                "tier": 1,
                "source": "www.googleapis.com",
                "target": "https://storage.googleapis.com/nodedownload/NodeServer-Setup-Full_t1.msi",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.googleapis.com",
                "target": "https://storage.googleapis.com/nodedownload/NodeServer-Setup-Full_t5.msi",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.googleapis.com",
                "target": "https://storage.googleapis.com/nodedownload/NodeServer-Setup-Full_t4.msi",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.googleapis.com",
                "target": "https://storage.googleapis.com/nodedownload/NodeServer-Setup-Full_t3.msi",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.googleapis.com",
                "target": "https://storage.googleapis.com/nodedownload/NodeServer-Setup-Full_t6.msi",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.googleapis.com",
                "target": "https://storage.googleapis.com/mantrams-browser-defender-public/non-login-pages/clickfix_cloudflare_multios.html",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              }
            ]
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.259924+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 79,
            "frame_number": 2641,
            "display_filter": "frame.number == 2641",
            "timestamp_epoch": "1561247263.799834000"
          },
          {
            "udp_stream": 79,
            "frame_number": 2642,
            "display_filter": "frame.number == 2642",
            "timestamp_epoch": "1561247263.800132000"
          },
          {
            "tcp_stream": 170,
            "frame_number": 2653,
            "display_filter": "frame.number == 2653",
            "timestamp_epoch": "1561247263.816326000"
          },
          {
            "tcp_stream": 171,
            "frame_number": 2657,
            "display_filter": "frame.number == 2657",
            "timestamp_epoch": "1561247263.817502000"
          },
          {
            "tcp_stream": 253,
            "frame_number": 6931,
            "display_filter": "frame.number == 6931",
            "timestamp_epoch": "1561247393.601016000"
          },
          {
            "tcp_stream": 252,
            "frame_number": 6935,
            "display_filter": "frame.number == 6935",
            "timestamp_epoch": "1561247393.603282000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:56.257831+00:00"
      },
      {
        "observable_id": "observable-309c90c59f32eb132460fd24",
        "type": "domain",
        "value": "www.googletagmanager.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:38.593969+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.434933+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 69,
            "frame_number": 1569,
            "display_filter": "frame.number == 1569",
            "timestamp_epoch": "1561247261.588306000"
          },
          {
            "udp_stream": 69,
            "frame_number": 1578,
            "display_filter": "frame.number == 1578",
            "timestamp_epoch": "1561247261.621737000"
          },
          {
            "tcp_stream": 147,
            "frame_number": 1583,
            "display_filter": "frame.number == 1583",
            "timestamp_epoch": "1561247261.634636000"
          },
          {
            "tcp_stream": 146,
            "frame_number": 1587,
            "display_filter": "frame.number == 1587",
            "timestamp_epoch": "1561247261.636357000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:56.430733+00:00"
      },
      {
        "observable_id": "observable-b95d340f4665e3ea51ebda09",
        "type": "domain",
        "value": "www.gstatic.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:45.870621+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.605615+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 76,
            "frame_number": 2056,
            "display_filter": "frame.number == 2056",
            "timestamp_epoch": "1561247262.918987000"
          },
          {
            "udp_stream": 76,
            "frame_number": 2105,
            "display_filter": "frame.number == 2105",
            "timestamp_epoch": "1561247263.069502000"
          },
          {
            "tcp_stream": 163,
            "frame_number": 2155,
            "display_filter": "frame.number == 2155",
            "timestamp_epoch": "1561247263.133155000"
          },
          {
            "tcp_stream": 164,
            "frame_number": 2157,
            "display_filter": "frame.number == 2157",
            "timestamp_epoch": "1561247263.133344000"
          }
        ],
        "roles": [
          "dns-query",
          "tls-sni"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:56.601447+00:00"
      },
      {
        "observable_id": "observable-855f170573ea1612af9e27f7",
        "type": "domain",
        "value": "www.msftncsi.com",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:30.477224+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.614902+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 30,
            "frame_number": 424,
            "display_filter": "frame.number == 424",
            "timestamp_epoch": "1561247198.002372000"
          },
          {
            "udp_stream": 30,
            "frame_number": 425,
            "display_filter": "frame.number == 425",
            "timestamp_epoch": "1561247198.020798000"
          },
          {
            "udp_stream": 31,
            "frame_number": 426,
            "display_filter": "frame.number == 426",
            "timestamp_epoch": "1561247198.022340000"
          },
          {
            "udp_stream": 31,
            "frame_number": 427,
            "display_filter": "frame.number == 427",
            "timestamp_epoch": "1561247198.022718000"
          },
          {
            "udp_stream": 56,
            "frame_number": 952,
            "display_filter": "frame.number == 952",
            "timestamp_epoch": "1561247230.144568000"
          },
          {
            "udp_stream": 56,
            "frame_number": 953,
            "display_filter": "frame.number == 953",
            "timestamp_epoch": "1561247230.169089000"
          },
          {
            "udp_stream": 57,
            "frame_number": 954,
            "display_filter": "frame.number == 954",
            "timestamp_epoch": "1561247230.170740000"
          },
          {
            "udp_stream": 57,
            "frame_number": 955,
            "display_filter": "frame.number == 955",
            "timestamp_epoch": "1561247230.171042000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 431,
            "display_filter": "frame.number == 431",
            "timestamp_epoch": "1561247198.038003000"
          },
          {
            "tcp_stream": 80,
            "frame_number": 959,
            "display_filter": "frame.number == 959",
            "timestamp_epoch": "1561247230.191542000"
          }
        ],
        "roles": [
          "dns-query",
          "http-host"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:56.610865+00:00"
      },
      {
        "observable_id": "observable-2f613bd40b97a9cc576b10a4",
        "type": "ipv4",
        "value": "10.0.76.109",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 60,
            "frame_number": 975,
            "display_filter": "frame.number == 975",
            "timestamp_epoch": "1561247232.560966000"
          },
          {
            "udp_stream": 60,
            "frame_number": 976,
            "display_filter": "frame.number == 976",
            "timestamp_epoch": "1561247232.561538000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-250720872b841a4155f09927",
        "type": "ipv4",
        "value": "10.0.76.193",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 29,
            "frame_number": 422,
            "display_filter": "frame.number == 422",
            "timestamp_epoch": "1561247197.798498000"
          },
          {
            "udp_stream": 29,
            "frame_number": 423,
            "display_filter": "frame.number == 423",
            "timestamp_epoch": "1561247197.799092000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-95b80acedf96e7d8faa472c3",
        "type": "ipv4",
        "value": "10.0.76.255",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d4fb199313c937359e623fef",
        "type": "ipv4",
        "value": "10.0.76.6",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 1,
            "frame_number": 4,
            "display_filter": "frame.number == 4",
            "timestamp_epoch": "1561247190.414558000"
          },
          {
            "udp_stream": 2,
            "frame_number": 6,
            "display_filter": "frame.number == 6",
            "timestamp_epoch": "1561247190.433338000"
          },
          {
            "udp_stream": 3,
            "frame_number": 8,
            "display_filter": "frame.number == 8",
            "timestamp_epoch": "1561247190.436697000"
          },
          {
            "udp_stream": 6,
            "frame_number": 36,
            "display_filter": "frame.number == 36",
            "timestamp_epoch": "1561247190.633924000"
          },
          {
            "udp_stream": 8,
            "frame_number": 125,
            "display_filter": "frame.number == 125",
            "timestamp_epoch": "1561247190.691526000"
          },
          {
            "udp_stream": 10,
            "frame_number": 181,
            "display_filter": "frame.number == 181",
            "timestamp_epoch": "1561247190.801337000"
          },
          {
            "udp_stream": 17,
            "frame_number": 240,
            "display_filter": "frame.number == 240",
            "timestamp_epoch": "1561247193.919255000"
          },
          {
            "udp_stream": 22,
            "frame_number": 257,
            "display_filter": "frame.number == 257",
            "timestamp_epoch": "1561247195.372677000"
          },
          {
            "udp_stream": 28,
            "frame_number": 421,
            "display_filter": "frame.number == 421",
            "timestamp_epoch": "1561247197.797726000"
          },
          {
            "udp_stream": 34,
            "frame_number": 555,
            "display_filter": "frame.number == 555",
            "timestamp_epoch": "1561247225.092523000"
          },
          {
            "udp_stream": 35,
            "frame_number": 557,
            "display_filter": "frame.number == 557",
            "timestamp_epoch": "1561247225.100838000"
          },
          {
            "udp_stream": 36,
            "frame_number": 559,
            "display_filter": "frame.number == 559",
            "timestamp_epoch": "1561247225.116693000"
          },
          {
            "udp_stream": 39,
            "frame_number": 632,
            "display_filter": "frame.number == 632",
            "timestamp_epoch": "1561247225.319824000"
          },
          {
            "udp_stream": 41,
            "frame_number": 702,
            "display_filter": "frame.number == 702",
            "timestamp_epoch": "1561247225.429056000"
          },
          {
            "udp_stream": 43,
            "frame_number": 707,
            "display_filter": "frame.number == 707",
            "timestamp_epoch": "1561247225.506478000"
          },
          {
            "udp_stream": 54,
            "frame_number": 948,
            "display_filter": "frame.number == 948",
            "timestamp_epoch": "1561247228.853164000"
          },
          {
            "udp_stream": 59,
            "frame_number": 974,
            "display_filter": "frame.number == 974",
            "timestamp_epoch": "1561247232.560080000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e4edc0d41865f92ad88c4d57",
        "type": "ipv4",
        "value": "104.244.42.136",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 82,
            "frame_number": 2895,
            "display_filter": "frame.number == 2895",
            "timestamp_epoch": "1561247264.158140000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8970ebcb6cb4bc6e6ed5a3cb",
        "type": "ipv4",
        "value": "104.244.42.200",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 82,
            "frame_number": 2895,
            "display_filter": "frame.number == 2895",
            "timestamp_epoch": "1561247264.158140000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9d844231759becb137c2913c",
        "type": "ipv4",
        "value": "104.244.42.72",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 82,
            "frame_number": 2895,
            "display_filter": "frame.number == 2895",
            "timestamp_epoch": "1561247264.158140000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e12331fd71415f4758ad0d7d",
        "type": "ipv4",
        "value": "104.244.42.8",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.627668+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.623380+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 82,
            "frame_number": 2895,
            "display_filter": "frame.number == 2895",
            "timestamp_epoch": "1561247264.158140000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:56.619343+00:00"
      },
      {
        "observable_id": "observable-a1a235aa902ab85d7d66f8c3",
        "type": "ipv4",
        "value": "13.107.21.200",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.847649+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.842514+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 85,
            "frame_number": 3036,
            "display_filter": "frame.number == 3036",
            "timestamp_epoch": "1561247264.439549000"
          },
          {
            "udp_stream": 87,
            "frame_number": 3037,
            "display_filter": "frame.number == 3037",
            "timestamp_epoch": "1561247264.439629000"
          },
          {
            "udp_stream": 88,
            "frame_number": 3038,
            "display_filter": "frame.number == 3038",
            "timestamp_epoch": "1561247264.439693000"
          },
          {
            "udp_stream": 84,
            "frame_number": 3039,
            "display_filter": "frame.number == 3039",
            "timestamp_epoch": "1561247264.439764000"
          },
          {
            "udp_stream": 91,
            "frame_number": 3181,
            "display_filter": "frame.number == 3181",
            "timestamp_epoch": "1561247265.473452000"
          },
          {
            "udp_stream": 97,
            "frame_number": 3865,
            "display_filter": "frame.number == 3865",
            "timestamp_epoch": "1561247288.316485000"
          },
          {
            "udp_stream": 98,
            "frame_number": 3866,
            "display_filter": "frame.number == 3866",
            "timestamp_epoch": "1561247288.316682000"
          },
          {
            "udp_stream": 99,
            "frame_number": 3867,
            "display_filter": "frame.number == 3867",
            "timestamp_epoch": "1561247288.316802000"
          },
          {
            "udp_stream": 96,
            "frame_number": 3868,
            "display_filter": "frame.number == 3868",
            "timestamp_epoch": "1561247288.316915000"
          },
          {
            "udp_stream": 100,
            "frame_number": 3874,
            "display_filter": "frame.number == 3874",
            "timestamp_epoch": "1561247289.399319000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:56.835972+00:00"
      },
      {
        "observable_id": "observable-4ce11a602be6d7c6eebb78af",
        "type": "ipv4",
        "value": "13.107.5.80",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 86,
            "frame_number": 2997,
            "display_filter": "frame.number == 2997",
            "timestamp_epoch": "1561247264.383906000"
          },
          {
            "udp_stream": 83,
            "frame_number": 2998,
            "display_filter": "frame.number == 2998",
            "timestamp_epoch": "1561247264.383975000"
          },
          {
            "udp_stream": 95,
            "frame_number": 3859,
            "display_filter": "frame.number == 3859",
            "timestamp_epoch": "1561247287.951071000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f54ada418582a7bd05c9e922",
        "type": "ipv4",
        "value": "131.107.255.255",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 63,
            "frame_number": 1378,
            "display_filter": "frame.number == 1378",
            "timestamp_epoch": "1561247255.327697000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-02f7a8bf73eabd0d4169654e",
        "type": "ipv4",
        "value": "172.217.0.67",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7bd2554e0e68554d0ae18d9c",
        "type": "ipv4",
        "value": "172.217.0.74",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.048247+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.043969+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 66,
            "frame_number": 1454,
            "display_filter": "frame.number == 1454",
            "timestamp_epoch": "1561247261.347284000"
          },
          {
            "udp_stream": 79,
            "frame_number": 2642,
            "display_filter": "frame.number == 2642",
            "timestamp_epoch": "1561247263.800132000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:57.038560+00:00"
      },
      {
        "observable_id": "observable-e050dffae565135ae7b5164f",
        "type": "ipv4",
        "value": "172.217.12.110",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d285fdd6f44dbc1d4593c433",
        "type": "ipv4",
        "value": "172.217.164.66",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-73e6b1e9de6e4939155395f3",
        "type": "ipv4",
        "value": "172.217.164.74",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.240603+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.236133+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 66,
            "frame_number": 1454,
            "display_filter": "frame.number == 1454",
            "timestamp_epoch": "1561247261.347284000"
          },
          {
            "udp_stream": 79,
            "frame_number": 2642,
            "display_filter": "frame.number == 2642",
            "timestamp_epoch": "1561247263.800132000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:57.231533+00:00"
      },
      {
        "observable_id": "observable-015cff4abbd5d8bac9e3a1b9",
        "type": "ipv4",
        "value": "172.217.2.34",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.448967+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.444447+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 70,
            "frame_number": 1711,
            "display_filter": "frame.number == 1711",
            "timestamp_epoch": "1561247261.871130000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:57.439747+00:00"
      },
      {
        "observable_id": "observable-4947e9e289ddeb373fb67dff",
        "type": "ipv4",
        "value": "172.217.2.35",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.656292+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.653755+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 89,
            "frame_number": 3099,
            "display_filter": "frame.number == 3099",
            "timestamp_epoch": "1561247264.566187000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:57.651509+00:00"
      },
      {
        "observable_id": "observable-ed0652efa5fb107a88f981a8",
        "type": "ipv4",
        "value": "173.194.219.154",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 71,
            "frame_number": 1738,
            "display_filter": "frame.number == 1738",
            "timestamp_epoch": "1561247262.208719000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-97b4231bac08845857f46185",
        "type": "ipv4",
        "value": "173.194.219.155",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 71,
            "frame_number": 1738,
            "display_filter": "frame.number == 1738",
            "timestamp_epoch": "1561247262.208719000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2aff663d8599034d8bcdcfc3",
        "type": "ipv4",
        "value": "173.194.219.156",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.831521+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.829195+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 71,
            "frame_number": 1738,
            "display_filter": "frame.number == 1738",
            "timestamp_epoch": "1561247262.208719000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:57.826514+00:00"
      },
      {
        "observable_id": "observable-6506a14e497b96bdb05a12e0",
        "type": "ipv4",
        "value": "173.194.219.157",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 71,
            "frame_number": 1738,
            "display_filter": "frame.number == 1738",
            "timestamp_epoch": "1561247262.208719000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9e0873f672cab11212a7a9bf",
        "type": "ipv4",
        "value": "173.194.219.94",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3ce740464a71c68839d880b5",
        "type": "ipv4",
        "value": "173.194.219.97",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.024887+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.019739+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 69,
            "frame_number": 1578,
            "display_filter": "frame.number == 1578",
            "timestamp_epoch": "1561247261.621737000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:58.014586+00:00"
      },
      {
        "observable_id": "observable-fc13ad79b08b90c74371fb96",
        "type": "ipv4",
        "value": "185.254.190.200",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2e9b32e266b6eacba6321c91",
        "type": "ipv4",
        "value": "204.79.197.200",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 85,
            "frame_number": 3036,
            "display_filter": "frame.number == 3036",
            "timestamp_epoch": "1561247264.439549000"
          },
          {
            "udp_stream": 87,
            "frame_number": 3037,
            "display_filter": "frame.number == 3037",
            "timestamp_epoch": "1561247264.439629000"
          },
          {
            "udp_stream": 88,
            "frame_number": 3038,
            "display_filter": "frame.number == 3038",
            "timestamp_epoch": "1561247264.439693000"
          },
          {
            "udp_stream": 84,
            "frame_number": 3039,
            "display_filter": "frame.number == 3039",
            "timestamp_epoch": "1561247264.439764000"
          },
          {
            "udp_stream": 91,
            "frame_number": 3181,
            "display_filter": "frame.number == 3181",
            "timestamp_epoch": "1561247265.473452000"
          },
          {
            "udp_stream": 97,
            "frame_number": 3865,
            "display_filter": "frame.number == 3865",
            "timestamp_epoch": "1561247288.316485000"
          },
          {
            "udp_stream": 98,
            "frame_number": 3866,
            "display_filter": "frame.number == 3866",
            "timestamp_epoch": "1561247288.316682000"
          },
          {
            "udp_stream": 99,
            "frame_number": 3867,
            "display_filter": "frame.number == 3867",
            "timestamp_epoch": "1561247288.316802000"
          },
          {
            "udp_stream": 96,
            "frame_number": 3868,
            "display_filter": "frame.number == 3868",
            "timestamp_epoch": "1561247288.316915000"
          },
          {
            "udp_stream": 100,
            "frame_number": 3874,
            "display_filter": "frame.number == 3874",
            "timestamp_epoch": "1561247289.399319000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-14534480428ec180df7714e0",
        "type": "ipv4",
        "value": "216.58.193.163",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.402184+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.395932+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 81,
            "frame_number": 2829,
            "display_filter": "frame.number == 2829",
            "timestamp_epoch": "1561247264.072915000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:58.389366+00:00"
      },
      {
        "observable_id": "observable-cb85a3adf3b11154a83ba691",
        "type": "ipv4",
        "value": "224.0.0.22",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f91778d83b6ecef4d9aebd6e",
        "type": "ipv4",
        "value": "224.0.0.252",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1d67f8156f9fc5460f88ca85",
        "type": "ipv4",
        "value": "23.63.249.144",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.603844+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.600928+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 56,
            "frame_number": 953,
            "display_filter": "frame.number == 953",
            "timestamp_epoch": "1561247230.169089000"
          },
          {
            "udp_stream": 57,
            "frame_number": 955,
            "display_filter": "frame.number == 955",
            "timestamp_epoch": "1561247230.171042000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:58.597559+00:00"
      },
      {
        "observable_id": "observable-929110509317e5717fc802f7",
        "type": "ipv4",
        "value": "23.63.249.186",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.796965+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.794931+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 30,
            "frame_number": 425,
            "display_filter": "frame.number == 425",
            "timestamp_epoch": "1561247198.020798000"
          },
          {
            "udp_stream": 31,
            "frame_number": 427,
            "display_filter": "frame.number == 427",
            "timestamp_epoch": "1561247198.022718000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:58.792612+00:00"
      },
      {
        "observable_id": "observable-2d083180fef914e1dfeb8355",
        "type": "ipv4",
        "value": "23.63.249.194",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 30,
            "frame_number": 425,
            "display_filter": "frame.number == 425",
            "timestamp_epoch": "1561247198.020798000"
          },
          {
            "udp_stream": 31,
            "frame_number": 427,
            "display_filter": "frame.number == 427",
            "timestamp_epoch": "1561247198.022718000"
          },
          {
            "udp_stream": 56,
            "frame_number": 953,
            "display_filter": "frame.number == 953",
            "timestamp_epoch": "1561247230.169089000"
          },
          {
            "udp_stream": 57,
            "frame_number": 955,
            "display_filter": "frame.number == 955",
            "timestamp_epoch": "1561247230.171042000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e01575654632c5ca81b44cb1",
        "type": "ipv4",
        "value": "239.255.255.250",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "frame_number": 5905,
            "display_filter": "frame.number == 5905",
            "timestamp_epoch": "1561247311.213862000"
          },
          {
            "frame_number": 5907,
            "display_filter": "frame.number == 5907",
            "timestamp_epoch": "1561247311.549851000"
          },
          {
            "frame_number": 5989,
            "display_filter": "frame.number == 5989",
            "timestamp_epoch": "1561247314.225235000"
          },
          {
            "frame_number": 6002,
            "display_filter": "frame.number == 6002",
            "timestamp_epoch": "1561247314.553386000"
          },
          {
            "frame_number": 6003,
            "display_filter": "frame.number == 6003",
            "timestamp_epoch": "1561247317.235836000"
          },
          {
            "frame_number": 6004,
            "display_filter": "frame.number == 6004",
            "timestamp_epoch": "1561247317.564933000"
          }
        ],
        "roles": [
          "http-host",
          "network-endpoint"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9b2b5b097f236be762204ba3",
        "type": "ipv4",
        "value": "255.255.255.255",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-357c7aa9f32edaf5e5031a3c",
        "type": "ipv4",
        "value": "31.13.65.36",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.986745+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.982450+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 92,
            "frame_number": 3210,
            "display_filter": "frame.number == 3210",
            "timestamp_epoch": "1561247270.199357000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:58.976896+00:00"
      },
      {
        "observable_id": "observable-c8a684c5f730782f1c750e3d",
        "type": "ipv4",
        "value": "31.13.65.7",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.190200+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.184574+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 73,
            "frame_number": 1820,
            "display_filter": "frame.number == 1820",
            "timestamp_epoch": "1561247262.695760000"
          },
          {
            "udp_stream": 77,
            "frame_number": 2369,
            "display_filter": "frame.number == 2369",
            "timestamp_epoch": "1561247263.378913000"
          },
          {
            "udp_stream": 93,
            "frame_number": 3309,
            "display_filter": "frame.number == 3309",
            "timestamp_epoch": "1561247270.428911000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:59.179876+00:00"
      },
      {
        "observable_id": "observable-c7ae4f5e6f88e259d292bbb7",
        "type": "ipv4",
        "value": "35.226.156.55",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.571142+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.377880+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.373370+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 65,
            "frame_number": 1393,
            "display_filter": "frame.number == 1393",
            "timestamp_epoch": "1561247260.170954000"
          },
          {
            "udp_stream": 68,
            "frame_number": 1511,
            "display_filter": "frame.number == 1511",
            "timestamp_epoch": "1561247261.417763000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:53.369039+00:00"
      },
      {
        "observable_id": "observable-f9caab36b295876e73eaf13c",
        "type": "ipv4",
        "value": "37.46.135.170",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.387845+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.381392+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 202,
            "frame_number": 3761,
            "display_filter": "frame.number == 3761",
            "timestamp_epoch": "1561247285.237383000"
          },
          {
            "tcp_stream": 201,
            "frame_number": 3842,
            "display_filter": "frame.number == 3842",
            "timestamp_epoch": "1561247287.553767000"
          },
          {
            "tcp_stream": 201,
            "frame_number": 3869,
            "display_filter": "frame.number == 3869",
            "timestamp_epoch": "1561247288.688439000"
          },
          {
            "tcp_stream": 207,
            "frame_number": 3893,
            "display_filter": "frame.number == 3893",
            "timestamp_epoch": "1561247290.335491000"
          },
          {
            "tcp_stream": 210,
            "frame_number": 4417,
            "display_filter": "frame.number == 4417",
            "timestamp_epoch": "1561247296.354584000"
          }
        ],
        "roles": [
          "http-host",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:59.376154+00:00"
      },
      {
        "observable_id": "observable-9b2e5973357c70273d26e447",
        "type": "ipv4",
        "value": "54.192.207.126",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.583851+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.581910+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 105,
            "frame_number": 6509,
            "display_filter": "frame.number == 6509",
            "timestamp_epoch": "1561247392.082847000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:59.579553+00:00"
      },
      {
        "observable_id": "observable-05cbbb0947c2d223cf400e31",
        "type": "ipv4",
        "value": "54.192.207.150",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 105,
            "frame_number": 6509,
            "display_filter": "frame.number == 6509",
            "timestamp_epoch": "1561247392.082847000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8fc4f83414bbb3ee28eb3de8",
        "type": "ipv4",
        "value": "54.192.207.51",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 105,
            "frame_number": 6509,
            "display_filter": "frame.number == 6509",
            "timestamp_epoch": "1561247392.082847000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-514e7c4bdab2747e025b69fe",
        "type": "ipv4",
        "value": "54.192.207.79",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 105,
            "frame_number": 6509,
            "display_filter": "frame.number == 6509",
            "timestamp_epoch": "1561247392.082847000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b6f388a7270bd32a1ef7174e",
        "type": "ipv4",
        "value": "64.233.185.101",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6e9c24bdc0d16ed0209b01d5",
        "type": "ipv4",
        "value": "64.233.185.102",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-24e5fffe18dfd0adf6fade62",
        "type": "ipv4",
        "value": "64.233.185.103",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.768086+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.766389+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:59.763955+00:00"
      },
      {
        "observable_id": "observable-874de5290bc693d62407d71c",
        "type": "ipv4",
        "value": "64.233.185.104",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f7f35cc366bf564c1973cedf",
        "type": "ipv4",
        "value": "64.233.185.105",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7ccd6de2536e396b0370fec1",
        "type": "ipv4",
        "value": "64.233.185.106",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a774a510fd7b408de9b28949",
        "type": "ipv4",
        "value": "64.233.185.147",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-875fc8bd2dd02fd1063a0581",
        "type": "ipv4",
        "value": "64.233.185.154",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 90,
            "frame_number": 3137,
            "display_filter": "frame.number == 3137",
            "timestamp_epoch": "1561247264.725563000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1bb20a860ffe5378aaf2f5bc",
        "type": "ipv4",
        "value": "64.233.185.155",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.978733+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.974362+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 90,
            "frame_number": 3137,
            "display_filter": "frame.number == 3137",
            "timestamp_epoch": "1561247264.725563000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:59.968670+00:00"
      },
      {
        "observable_id": "observable-9fe31247d21a48189d37d890",
        "type": "ipv4",
        "value": "64.233.185.156",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 90,
            "frame_number": 3137,
            "display_filter": "frame.number == 3137",
            "timestamp_epoch": "1561247264.725563000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-14ddf5c712e50ec46e5e9202",
        "type": "ipv4",
        "value": "64.233.185.157",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 90,
            "frame_number": 3137,
            "display_filter": "frame.number == 3137",
            "timestamp_epoch": "1561247264.725563000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0359865ac7acecf13a55a911",
        "type": "ipv4",
        "value": "64.233.185.94",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.193231+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.191414+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 76,
            "frame_number": 2105,
            "display_filter": "frame.number == 2105",
            "timestamp_epoch": "1561247263.069502000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:47:00.189094+00:00"
      },
      {
        "observable_id": "observable-b7dc4639fc754303031a0b8a",
        "type": "ipv4",
        "value": "64.233.185.95",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.516438+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.512500+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 66,
            "frame_number": 1454,
            "display_filter": "frame.number == 1454",
            "timestamp_epoch": "1561247261.347284000"
          },
          {
            "udp_stream": 79,
            "frame_number": 2642,
            "display_filter": "frame.number == 2642",
            "timestamp_epoch": "1561247263.800132000"
          },
          {
            "udp_stream": 106,
            "frame_number": 6390,
            "display_filter": "frame.number == 6390",
            "timestamp_epoch": "1561247392.017533000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:47:00.507429+00:00"
      },
      {
        "observable_id": "observable-c4dfbb521eadf6280a511ede",
        "type": "ipv4",
        "value": "64.233.185.99",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 67,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1561247261.392793000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0b9972b1d21f8ccaff80eb6a",
        "type": "ipv4",
        "value": "72.21.81.200",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:35.712902+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.719243+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 101,
            "frame_number": 3896,
            "display_filter": "frame.number == 3896",
            "timestamp_epoch": "1561247290.404107000"
          },
          {
            "udp_stream": 104,
            "frame_number": 5919,
            "display_filter": "frame.number == 5919",
            "timestamp_epoch": "1561247314.083666000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:47:00.714956+00:00"
      },
      {
        "observable_id": "observable-5b1d4d021241dcdb0a15ed4e",
        "type": "ipv4",
        "value": "72.21.91.66",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.732340+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.728510+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 75,
            "frame_number": 1855,
            "display_filter": "frame.number == 1855",
            "timestamp_epoch": "1561247262.734217000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:47:00.724377+00:00"
      },
      {
        "observable_id": "observable-6ce05fe400793115119bb610",
        "type": "ipv4",
        "value": "74.125.136.100",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-23aaa6f3e412eeead34ec3e4",
        "type": "ipv4",
        "value": "74.125.136.101",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.919885+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.917468+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:47:00.915021+00:00"
      },
      {
        "observable_id": "observable-0c2be4245f3922f5c26ece09",
        "type": "ipv4",
        "value": "74.125.136.102",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:01.112297+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:01.107692+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:47:01.101721+00:00"
      },
      {
        "observable_id": "observable-2c8519d2463ddd8099826035",
        "type": "ipv4",
        "value": "74.125.136.106",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a915248bce88b13949d6ab06",
        "type": "ipv4",
        "value": "74.125.136.113",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-cd16de5cf9d73acc68eb4e62",
        "type": "ipv4",
        "value": "74.125.136.138",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-60db58aa193777d7a01d0b62",
        "type": "ipv4",
        "value": "74.125.136.139",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 74,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1561247262.729830000"
          },
          {
            "udp_stream": 80,
            "frame_number": 2747,
            "display_filter": "frame.number == 2747",
            "timestamp_epoch": "1561247263.907326000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7dde82bc35da99adb2b4f2ae",
        "type": "ipv4",
        "value": "74.125.136.95",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-32335094a0eadc0b2d4d3ec7",
        "type": "ipv4",
        "value": "74.125.138.100",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bcb27d635b5b0169b7c7ad59",
        "type": "ipv4",
        "value": "74.125.138.101",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c3beb9d9eb08e786f89fa3c6",
        "type": "ipv4",
        "value": "74.125.138.102",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2a0418fbd782e833d7efc199",
        "type": "ipv4",
        "value": "74.125.138.113",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-94b60df33482de05fc570f75",
        "type": "ipv4",
        "value": "74.125.138.138",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:01.310338+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:01.307621+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:47:01.304145+00:00"
      },
      {
        "observable_id": "observable-370ee327a1ea89fded8a7666",
        "type": "ipv4",
        "value": "74.125.138.139",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 72,
            "frame_number": 1776,
            "display_filter": "frame.number == 1776",
            "timestamp_epoch": "1561247262.316189000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-423b613c0328bdc5bab765aa",
        "type": "ipv4",
        "value": "74.125.138.97",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-87eccc826622783004a9067f",
        "type": "ipv4",
        "value": "74.125.21.95",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 66,
            "frame_number": 1454,
            "display_filter": "frame.number == 1454",
            "timestamp_epoch": "1561247261.347284000"
          },
          {
            "udp_stream": 79,
            "frame_number": 2642,
            "display_filter": "frame.number == 2642",
            "timestamp_epoch": "1561247263.800132000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b4c4fa5f6a16e7c8d87b3740",
        "type": "ipv4",
        "value": "8.209.83.76",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.145430+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.936699+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.932701+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 102,
            "frame_number": 4889,
            "display_filter": "frame.number == 4889",
            "timestamp_epoch": "1561247302.953345000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:53.927881+00:00"
      },
      {
        "observable_id": "observable-6f3b10f19ea885a057e0ec2e",
        "type": "ipv4",
        "value": "91.235.129.60",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:01.494747+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:01.490470+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 94,
            "frame_number": 3742,
            "display_filter": "frame.number == 3742",
            "timestamp_epoch": "1561247283.743525000"
          }
        ],
        "roles": [
          "dns-answer",
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:47:01.485879+00:00"
      },
      {
        "observable_id": "observable-15ba53c73130ee689a4cb606",
        "type": "ipv6",
        "value": "fd3e:4f5a:5b81::1",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "udp_stream": 64,
            "frame_number": 1380,
            "display_filter": "frame.number == 1380",
            "timestamp_epoch": "1561247255.328332000"
          }
        ],
        "roles": [
          "dns-answer"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6abbc94132a7e57e69e2ca48",
        "type": "sha256",
        "value": "09d46019c7a75b96187202c3c8412182f27c413a9c3661857923dc8e94e91b7b",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9a3479853f96c17532699bb8",
        "type": "sha256",
        "value": "1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2c15c5b4134712b14c4e22e5",
        "type": "sha256",
        "value": "13163ed737fd61106e44f7078caebe16df4549bc45b39c8928a956f987690fee",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-664e2a779b2a993a3c9c0a94",
        "type": "sha256",
        "value": "3103a01f90e95eef3300a895ab3411575325e0d2a1a4807e2fb5ae8e6f110f99",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:52.651426+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:52.435658+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:52.431068+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:46:52.425278+00:00"
      },
      {
        "observable_id": "observable-67b23ac28e9b7c8dd9833b23",
        "type": "sha256",
        "value": "39bf8220d772efc49f7a8f0709ac8607af17997d38525eacec1448d5317dcf38",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b1f8f35062a845758bd23cb5",
        "type": "sha256",
        "value": "3b1ac036763d3a59c88578486ae698d22a37dd2d46a553485e1eabb9fe255b3f",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-366e5aaa0d30328279f2cf95",
        "type": "sha256",
        "value": "4bbea1dbbdc058cc976c290bc9c0f506c6d175011da6fed42a499db1d2377af3",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-56d17166ea19e22a3275c97c",
        "type": "sha256",
        "value": "4cfe13f4450dd2250c80995a84e11eff6c3300a17ff3d6518362a2a0696d51da",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fc0e535172760fba14aed47d",
        "type": "sha256",
        "value": "4fe572e7d49282f6bb5dde888b8e5d06e8264add26b8aebd6b706b79f11d0893",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0940d0897a5e182dc883562e",
        "type": "sha256",
        "value": "502de2a45dc07ff1b837e168cbe37ca77056804aff81a5a510cecb199fbde654",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fb56dd78ecc9956b2abcc7b7",
        "type": "sha256",
        "value": "565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-aa6c12a25c7cca1eb216dfda",
        "type": "sha256",
        "value": "5ce99a897720a7b57ff1da615b9d99b4eb5035ffcfd036e1de93536b507d4089",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-cd719e2883d4088d88ad4487",
        "type": "sha256",
        "value": "5d3e3d13333f572afe8df9cd7079c23b1049802e277d2cabce0221e2eaddc807",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3826e42a713d543f08dbc854",
        "type": "sha256",
        "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-72969b5e757ebc38e042c55f",
        "type": "sha256",
        "value": "63386b64f7d940f3864917cd9dc6443500ae82f0c717e7a82bec5b7b80361393",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d448f38ba95fcc24e0551e58",
        "type": "sha256",
        "value": "668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-889925ead937d21dafed23df",
        "type": "sha256",
        "value": "6a77c8ea3af1cd0853993af5fa4724dee868e2c9a285eed61f8d0de3753b40ba",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f2abb1edba6db034635d34b8",
        "type": "sha256",
        "value": "6d4ae7517a2914b5de787ebe33efc2915d5872f4d0c5839a0f84149adedb306e",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-090deb227d982bce69eb7558",
        "type": "sha256",
        "value": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a1ad929cd8369f124a1b7136",
        "type": "sha256",
        "value": "78bcd250cc75ff96fd3f96452b04875ebc3e990f0982f8cb2053c2897a3fde4c",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a1bf0757738d497d277cc9b5",
        "type": "sha256",
        "value": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2cc7c027176306a1ac96e30b",
        "type": "sha256",
        "value": "96d61a66fda99897f47232a1f3d15fe711fee6726c2e976eed42011948d87049",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6177463e295aebec31601f7e",
        "type": "sha256",
        "value": "9a392fadea3ef641a75223fba61b5bc5c4d21c231360fe25d12218288d65ef0d",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d5a1a64a1af86815aac822e8",
        "type": "sha256",
        "value": "9bb35e2cb32e2507d2294fda6265966fe617d567b20845d53d2667a150b34311",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1111d49e909e404f7cef6c47",
        "type": "sha256",
        "value": "9bf59058c99ed3af3b2568fa61791e9b31ca2f85a1a0b630e78449f3598fae33",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-86a7b4e9af936acf0df6c941",
        "type": "sha256",
        "value": "9ed561402e41c753f32f30917a1b1e50ea12c272f203fae74d1cfee3d091da3a",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-13244221308717c5e3b7c994",
        "type": "sha256",
        "value": "a22fdaf4fdff6850730248a8c81a482e2c10bf0f1a5cfb5861dc5893442cf279",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8a5af0b7357c1f2e01f97bb9",
        "type": "sha256",
        "value": "afa93c8baeaf1c28d1c5646ccdc701c636109bbc765549777a6417fa41fb5d6d",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-360234478e5cd2950479d06c",
        "type": "sha256",
        "value": "be7a8e1f7fddc3fd63f2540ea7103ba91c47d55c340504f69b286a64823678a0",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-04bd6ab7d6eeee1604545a7d",
        "type": "sha256",
        "value": "c1f5379165637b2d8c5dea37642242e5aae279d5e2b4b2a00bc2a1f6463f02de",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0bdad433a95139a145fb83a1",
        "type": "sha256",
        "value": "ca5a37a5c3401ffcd1b7c98c3a22a921c013d1121fe33122e94dd81c382bf9b0",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-511050c60b386a45e1513ea2",
        "type": "sha256",
        "value": "cc900a14f6b6e17c5299c3f619b98ac2048780932d3b409cc9c5be79db70d15a",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e73ef31389c49b65913211d5",
        "type": "sha256",
        "value": "d428b93962535e52f3631fe647be46828868b6a88e2ecb203c706a86919502a0",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-02759c6ac40a3bfd5dc5f2f4",
        "type": "sha256",
        "value": "dd4da68f83df075213351c713fa2067594e9ff7a402de406d3fe20f0c2a2f47e",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-49e095b7aa39d356e03c8ece",
        "type": "url",
        "value": "http://239.255.255.250:1900*",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "frame_number": 5905,
            "display_filter": "frame.number == 5905",
            "timestamp_epoch": "1561247311.213862000"
          },
          {
            "frame_number": 5907,
            "display_filter": "frame.number == 5907",
            "timestamp_epoch": "1561247311.549851000"
          },
          {
            "frame_number": 5989,
            "display_filter": "frame.number == 5989",
            "timestamp_epoch": "1561247314.225235000"
          },
          {
            "frame_number": 6002,
            "display_filter": "frame.number == 6002",
            "timestamp_epoch": "1561247314.553386000"
          },
          {
            "frame_number": 6003,
            "display_filter": "frame.number == 6003",
            "timestamp_epoch": "1561247317.235836000"
          },
          {
            "frame_number": 6004,
            "display_filter": "frame.number == 6004",
            "timestamp_epoch": "1561247317.564933000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-db8bf6c5ad47c85dd3fd961a",
        "type": "url",
        "value": "http://37.46.135.170/?MTg0MzEy&UOViokhlz&aposAqGuAYQhGJO=difference&JhdAxqxZHPMIkeK=difference&dsWGIXdorJRe=detonator&qIHWsvSKCKW=referred&zoZXprPP=known&lbepukXxCTe=vest&WQLDTkVC=heartfelt&hziRqmWCrsMaus=constitution&evkJcGbq=referred&ff5sdfds=w3bQMvXcJxjQFYbGMvzDSKNbNknWHViPxomG9MildZeqZGX_k7vDfF-qoVXcCgWRxfQ&sIusXJLxas=community&DFWEKmZUkxxeB=golfer&t4tsdfsg4=ufOADNQToihfRLwJpzo1fUlIUof-ni0nRyxSa0p7Ur0HeYAMU9qKcELk82VzFjLdTJvs&gSlEAaKzG=criticized&sXTxIOfYGsZL=golfer&qSnbemVoJtsl=criticized&UjrvHHTG=blackmail&bpiAMNrElSNjI0OTM5",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 201,
            "frame_number": 3842,
            "display_filter": "frame.number == 3842",
            "timestamp_epoch": "1561247287.553767000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-983661de138221fc4f97164a",
        "type": "url",
        "value": "http://37.46.135.170/?MTQwMjg3&ZqHoAiAzR&ff5sdfds=xXjQMvWUbRXQDJ3EKvPcT6NMMVHRFUCL2YedmrHZefjac1WkzrvFTF_7ozKATQSG6_ptdfJ&ZJull=known&ClGaW=known&PETxiFG=community&sMRo=wrapped&HuUMPiKpj=heartfelt&LfBYp=criticized&trlQvmgW=wrapped&t4tsdfsg4=WDQCwhBfTcwJom9xbAw4b8futjEnVzkCb1p6H-hGPYwNDrcSdRuVo31ykxrkkQPshg1TH4GI&QVQi=detonator&scUJaJdNW=golfer&eaqBiV=referred&eunX=heartfelt&lTfNSvPso=wrapped&cuxKdC=constitution&TGbNZdI=known&YAVpMLL=difference&KcBDoegcFMTU1OTU1",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 202,
            "frame_number": 3761,
            "display_filter": "frame.number == 3761",
            "timestamp_epoch": "1561247285.237383000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1409e0f3f2711570d0de1aee",
        "type": "url",
        "value": "http://37.46.135.170/?MzU4NjA0&kaZDWzI&AkwenzFXp=perpetual&EIDOXmpaHLIMQ=blackmail&PmNkusRzUKjdxi=known&embBMhXHEVqMM=already&nvQgwJI=community&PtVAedNAUU=difference&jDCoPDPCLNkpJ=heartfelt&SJjNZIaGHxK=known&vvHefJ=heartfelt&t4tsdfsg4=PAVMb_q6p3EiEnR6U0pGB_xyNZgITqZucEbg_2lT3ybZGJsJ1kx_R6GcBxewtW10Z6AwalanCH6fAnUctFEsxYQ&IJbAFjBSlWY=heartfelt&hyYviEG=criticized&ff5sdfds=xHjQMrnYbRbFFYTfKPPEUKNEMUjWA0-KwYmZhafVF5mxFDHGpbX1FxXspVSdCFSEmvRvdLUHIwSh1U3ASwNizYk&SfDdcBJQLntZc=everyone&ZwddKCJISaTB=blackmail&IqnFgRnJ=known&WWmEHUqy=vest&niUheyKPRbLYEdyNjEwOTgy",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 207,
            "frame_number": 3893,
            "display_filter": "frame.number == 3893",
            "timestamp_epoch": "1561247290.335491000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5c4734bcad84077f24e53a36",
        "type": "url",
        "value": "http://37.46.135.170/?NDk4MTE5&tmCVgJMQbeHjv&znbcjFaUOmZy=vest&aTijcut=blackmail&kBgQawTJSFlOAu=difference&NCThQKrrQh=blackmail&lvQmqFyq=constitution&zCrDVEX=known&wLBVVjhJGAWC=detonator&PLFPhyyqZCa=known&lfJYgkH=perpetual&t4tsdfsg4=YPAVwb_q6p3EaEnRGU0p6B_x2NZgMTqZWcEbk_2lv3ybhGJs11kx_R6GYBxewtUFMT4wMWmKjKHqj58EgwV0sC&nVJnyJYij=vest&eZvTJjAeJ=professional&ISzjHlO=strategy&tAMbBJnq=referred&bwgDFqD=strategy&kdPRkesmuQ=heartfelt&ff5sdfds=xHjQMrbYbRfFFYvfKPzEUKxEMUbWA0GKwYeZhajVF5exFD7Gpbr1FxXspVWdCFWEmvtvdLUHIwuh1UPASwJizY&kxbRJWYrNpZbNlVMzU3NDAz",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 210,
            "frame_number": 4417,
            "display_filter": "frame.number == 4417",
            "timestamp_epoch": "1561247296.354584000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-eeb6cc2c1a0416336b7bbef5",
        "type": "url",
        "value": "http://37.46.135.170/favicon.ico",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 201,
            "frame_number": 3869,
            "display_filter": "frame.number == 3869",
            "timestamp_epoch": "1561247288.688439000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-573169d316752056594092ad",
        "type": "url",
        "value": "http://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 140,
            "frame_number": 1462,
            "display_filter": "frame.number == 1462",
            "timestamp_epoch": "1561247261.361127000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c383876d1b808ca934d7569f",
        "type": "url",
        "value": "http://beef2live.com/images/clear.gif",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6600,
            "display_filter": "frame.number == 6600",
            "timestamp_epoch": "1561247392.525706000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-357a2703ce5592eeb2c74c9c",
        "type": "url",
        "value": "http://beef2live.com/images/options.png",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6520,
            "display_filter": "frame.number == 6520",
            "timestamp_epoch": "1561247392.085467000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d80e4b1bf7e34912531718c3",
        "type": "url",
        "value": "http://beef2live.com/images/selectbox-sprite.png",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6860,
            "display_filter": "frame.number == 6860",
            "timestamp_epoch": "1561247393.479635000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e497dc2664ae1091ea6a3857",
        "type": "url",
        "value": "http://beef2live.com/markets",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6268,
            "display_filter": "frame.number == 6268",
            "timestamp_epoch": "1561247390.600547000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-217aadd3e551f13b87d15444",
        "type": "url",
        "value": "http://beef2live.com/scripts/amcharts/amcharts.js",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 234,
            "frame_number": 6432,
            "display_filter": "frame.number == 6432",
            "timestamp_epoch": "1561247392.034702000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-84d4cd1f1ac7e058a4f7ca79",
        "type": "url",
        "value": "http://beef2live.com/scripts/amcharts/serial.js",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6475,
            "display_filter": "frame.number == 6475",
            "timestamp_epoch": "1561247392.064267000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8da5f43ac7c3e5a2485abcd6",
        "type": "url",
        "value": "http://beef2live.com/scripts/amcharts/themes/light.js",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6497,
            "display_filter": "frame.number == 6497",
            "timestamp_epoch": "1561247392.075452000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6960651dd6dc7b3fc5148d67",
        "type": "url",
        "value": "http://beef2live.com/scripts/bootstrap.js",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6343,
            "display_filter": "frame.number == 6343",
            "timestamp_epoch": "1561247391.619220000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-67ad3a8ddb871ae3bc3e3357",
        "type": "url",
        "value": "http://beef2live.com/scripts/jquery-ui/images/ui-bg_flat_75_ffffff_40x100.png",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6862,
            "display_filter": "frame.number == 6862",
            "timestamp_epoch": "1561247393.479843000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1482a228b43f6de4e9d42949",
        "type": "url",
        "value": "http://beef2live.com/scripts/jquery-ui/images/ui-bg_glass_75_e6e6e6_1x400.png",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 257,
            "frame_number": 6998,
            "display_filter": "frame.number == 6998",
            "timestamp_epoch": "1561247393.644968000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-29e0580ee3ca3b1485eebb1f",
        "type": "url",
        "value": "http://beef2live.com/scripts/jquery-ui/images/ui-bg_highlight-soft_75_cccccc_1x100.png",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 256,
            "frame_number": 6979,
            "display_filter": "frame.number == 6979",
            "timestamp_epoch": "1561247393.631042000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6208eab6f2da8b7541d1a40c",
        "type": "url",
        "value": "http://beef2live.com/scripts/jquery-ui/images/ui-icons_222222_256x240.png",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6996,
            "display_filter": "frame.number == 6996",
            "timestamp_epoch": "1561247393.644758000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-288d789c032c4b9b8ae550e4",
        "type": "url",
        "value": "http://beef2live.com/scripts/jquery.selectbox-0.2.js",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6367,
            "display_filter": "frame.number == 6367",
            "timestamp_epoch": "1561247391.999359000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e9079fee1488638ac8136a00",
        "type": "url",
        "value": "http://beef2live.com/story-anatomy-beef-cattle-154-104357",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 138,
            "frame_number": 1403,
            "display_filter": "frame.number == 1403",
            "timestamp_epoch": "1561247260.782613000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-11a53e0988bb3ff7d4a3a89f",
        "type": "url",
        "value": "http://beef2live.com/style/marketsResponsiveNoSidebar.css",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6317,
            "display_filter": "frame.number == 6317",
            "timestamp_epoch": "1561247391.481400000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8b6816990e65307d8e9efe6d",
        "type": "url",
        "value": "http://beef2live.com/style/templates/controls/tabbedQuotesResponsive.css?v=2",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 228,
            "frame_number": 6369,
            "display_filter": "frame.number == 6369",
            "timestamp_epoch": "1561247391.999939000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e25c1678c664aecfec294d4d",
        "type": "url",
        "value": "http://beef2live.com/style/templates/images/chgDnArrow.png",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 234,
            "frame_number": 6852,
            "display_filter": "frame.number == 6852",
            "timestamp_epoch": "1561247393.347532000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-27afa5ccc35cae8c771f76c2",
        "type": "url",
        "value": "http://beef2live.com/style/templates/images/chgUpArrow.png",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 227,
            "frame_number": 6854,
            "display_filter": "frame.number == 6854",
            "timestamp_epoch": "1561247393.347726000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-33cdf2c001a0f5bfb872253f",
        "type": "url",
        "value": "http://beef2live.com/style/templates/page/markets.css?v=1",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 226,
            "frame_number": 6286,
            "display_filter": "frame.number == 6286",
            "timestamp_epoch": "1561247391.280854000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5d08f77879c0df4e19fac3ee",
        "type": "url",
        "value": "http://clients1.google.com/generate_204",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 172,
            "frame_number": 2789,
            "display_filter": "frame.number == 2789",
            "timestamp_epoch": "1561247263.972756000"
          },
          {
            "tcp_stream": 254,
            "frame_number": 6941,
            "display_filter": "frame.number == 6941",
            "timestamp_epoch": "1561247393.604635000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-974dd4822ef98f62b2fe94e8",
        "type": "url",
        "value": "http://connect.facebook.net/en_US/all.js",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 156,
            "frame_number": 1836,
            "display_filter": "frame.number == 1836",
            "timestamp_epoch": "1561247262.717994000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3a289ca3ab595df981f79701",
        "type": "url",
        "value": "http://cse.google.com/adsense/search/async-ads.js",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 169,
            "frame_number": 2649,
            "display_filter": "frame.number == 2649",
            "timestamp_epoch": "1561247263.809346000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1c0728934890d9780658092e",
        "type": "url",
        "value": "http://fghjkmgru34.site/gQBljYzDJBnrt4JX/gate.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 211,
            "frame_number": 4893,
            "display_filter": "frame.number == 4893",
            "timestamp_epoch": "1561247303.076396000"
          },
          {
            "tcp_stream": 212,
            "frame_number": 4907,
            "display_filter": "frame.number == 4907",
            "timestamp_epoch": "1561247307.815439000"
          },
          {
            "tcp_stream": 213,
            "frame_number": 5364,
            "display_filter": "frame.number == 5364",
            "timestamp_epoch": "1561247309.386333000"
          },
          {
            "tcp_stream": 214,
            "frame_number": 5852,
            "display_filter": "frame.number == 5852",
            "timestamp_epoch": "1561247310.208061000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-90949ef2d3dfdc9cec74cf9e",
        "type": "url",
        "value": "http://letsdoitquick.site/",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 199,
            "frame_number": 3750,
            "display_filter": "frame.number == 3750",
            "timestamp_epoch": "1561247284.617933000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-72f8bd0c033ae375975acd85",
        "type": "url",
        "value": "http://portal.farmcentric.com/images/arrow-down-large.png",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 237,
            "frame_number": 6442,
            "display_filter": "frame.number == 6442",
            "timestamp_epoch": "1561247392.036635000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-057090264e8bf8383855540f",
        "type": "url",
        "value": "http://portal.farmcentric.com/images/pointerup.png",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 236,
            "frame_number": 6434,
            "display_filter": "frame.number == 6434",
            "timestamp_epoch": "1561247392.034821000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5c9b92ec7f222f412347cdce",
        "type": "url",
        "value": "http://www.bing.com/favicon.ico",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 183,
            "frame_number": 3186,
            "display_filter": "frame.number == 3186",
            "timestamp_epoch": "1561247265.487488000"
          },
          {
            "tcp_stream": 205,
            "frame_number": 3879,
            "display_filter": "frame.number == 3879",
            "timestamp_epoch": "1561247289.412234000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-756f7336db7442f5d5b8f798",
        "type": "url",
        "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=3&utmn=2054411788&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853867&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 152,
            "frame_number": 1811,
            "display_filter": "frame.number == 1811",
            "timestamp_epoch": "1561247262.637770000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-77ac979d5212fab4ec4201ca",
        "type": "url",
        "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=4&utmn=1186798248&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Anatomy%20Of%20Beef%20Cattle%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=1640095073&utmr=-&utmp=%2Fstory-anatomy-beef-cattle-154-104357&utmht=1561246853872&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 153,
            "frame_number": 1813,
            "display_filter": "frame.number == 1813",
            "timestamp_epoch": "1561247262.641599000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-147875339d7ad9592321ee84",
        "type": "url",
        "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=5&utmn=1173868244&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982849&utmac=UA-30967511-2&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 232,
            "frame_number": 6375,
            "display_filter": "frame.number == 6375",
            "timestamp_epoch": "1561247392.006900000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c8b08e01dddc25cbc05861e3",
        "type": "url",
        "value": "http://www.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=6&utmn=1716294095&utmhn=beef2live.com&utmcs=utf-8&utmsr=1280x768&utmvp=784x368&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=28.0%20r0&utmdt=Markets%20-%20Beef2Live%20%7C%20Eat%20Beef%20*%20Live%20Better&utmhid=270011893&utmr=0&utmp=%2Fmarkets&utmht=1561246982853&utmac=UA-53809902-1&utmcc=__utma%3D100166541.469103404.1561246568.1561246568.1561246568.1%3B%2B__utmz%3D100166541.1561246568.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmmt=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 231,
            "frame_number": 6379,
            "display_filter": "frame.number == 6379",
            "timestamp_epoch": "1561247392.007298000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-92fbf824e9038b291b8ab1ee",
        "type": "url",
        "value": "http://www.google-analytics.com/ga.js",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 152,
            "frame_number": 1781,
            "display_filter": "frame.number == 1781",
            "timestamp_epoch": "1561247262.327050000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ce0ea991c72173ff5ccb94c4",
        "type": "url",
        "value": "http://www.googleadservices.com/pagead/conversion_async.js",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 148,
            "frame_number": 1720,
            "display_filter": "frame.number == 1720",
            "timestamp_epoch": "1561247261.881869000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-650861c793c76999a8ff9317",
        "type": "url",
        "value": "http://www.msftncsi.com/ncsi.txt",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 431,
            "display_filter": "frame.number == 431",
            "timestamp_epoch": "1561247198.038003000"
          },
          {
            "tcp_stream": 80,
            "frame_number": 959,
            "display_filter": "frame.number == 959",
            "timestamp_epoch": "1561247230.191542000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      }
    ],
    "counts": {
      "observed": 202
    },
    "ioc_candidate_count": 0,
    "summary": "202 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.",
    "limitations": [
      "No detections, no record, missing credentials and provider errors do not mean benign.",
      "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.",
      "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.",
      "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure."
    ],
    "enrichment_plan": {
      "policy": "evidence-priority-v2",
      "items": [
        {
          "observable_id": "observable-6abbc94132a7e57e69e2ca48",
          "type": "sha256",
          "value": "09d46019c7a75b96187202c3c8412182f27c413a9c3661857923dc8e94e91b7b",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-9a3479853f96c17532699bb8",
          "type": "sha256",
          "value": "1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2c15c5b4134712b14c4e22e5",
          "type": "sha256",
          "value": "13163ed737fd61106e44f7078caebe16df4549bc45b39c8928a956f987690fee",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-67b23ac28e9b7c8dd9833b23",
          "type": "sha256",
          "value": "39bf8220d772efc49f7a8f0709ac8607af17997d38525eacec1448d5317dcf38",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b1f8f35062a845758bd23cb5",
          "type": "sha256",
          "value": "3b1ac036763d3a59c88578486ae698d22a37dd2d46a553485e1eabb9fe255b3f",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-366e5aaa0d30328279f2cf95",
          "type": "sha256",
          "value": "4bbea1dbbdc058cc976c290bc9c0f506c6d175011da6fed42a499db1d2377af3",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-56d17166ea19e22a3275c97c",
          "type": "sha256",
          "value": "4cfe13f4450dd2250c80995a84e11eff6c3300a17ff3d6518362a2a0696d51da",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-fc0e535172760fba14aed47d",
          "type": "sha256",
          "value": "4fe572e7d49282f6bb5dde888b8e5d06e8264add26b8aebd6b706b79f11d0893",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-0940d0897a5e182dc883562e",
          "type": "sha256",
          "value": "502de2a45dc07ff1b837e168cbe37ca77056804aff81a5a510cecb199fbde654",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-fb56dd78ecc9956b2abcc7b7",
          "type": "sha256",
          "value": "565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-aa6c12a25c7cca1eb216dfda",
          "type": "sha256",
          "value": "5ce99a897720a7b57ff1da615b9d99b4eb5035ffcfd036e1de93536b507d4089",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-cd719e2883d4088d88ad4487",
          "type": "sha256",
          "value": "5d3e3d13333f572afe8df9cd7079c23b1049802e277d2cabce0221e2eaddc807",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-3826e42a713d543f08dbc854",
          "type": "sha256",
          "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-72969b5e757ebc38e042c55f",
          "type": "sha256",
          "value": "63386b64f7d940f3864917cd9dc6443500ae82f0c717e7a82bec5b7b80361393",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-d448f38ba95fcc24e0551e58",
          "type": "sha256",
          "value": "668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-889925ead937d21dafed23df",
          "type": "sha256",
          "value": "6a77c8ea3af1cd0853993af5fa4724dee868e2c9a285eed61f8d0de3753b40ba",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f2abb1edba6db034635d34b8",
          "type": "sha256",
          "value": "6d4ae7517a2914b5de787ebe33efc2915d5872f4d0c5839a0f84149adedb306e",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-090deb227d982bce69eb7558",
          "type": "sha256",
          "value": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a1ad929cd8369f124a1b7136",
          "type": "sha256",
          "value": "78bcd250cc75ff96fd3f96452b04875ebc3e990f0982f8cb2053c2897a3fde4c",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a1bf0757738d497d277cc9b5",
          "type": "sha256",
          "value": "8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2cc7c027176306a1ac96e30b",
          "type": "sha256",
          "value": "96d61a66fda99897f47232a1f3d15fe711fee6726c2e976eed42011948d87049",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6177463e295aebec31601f7e",
          "type": "sha256",
          "value": "9a392fadea3ef641a75223fba61b5bc5c4d21c231360fe25d12218288d65ef0d",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-d5a1a64a1af86815aac822e8",
          "type": "sha256",
          "value": "9bb35e2cb32e2507d2294fda6265966fe617d567b20845d53d2667a150b34311",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-1111d49e909e404f7cef6c47",
          "type": "sha256",
          "value": "9bf59058c99ed3af3b2568fa61791e9b31ca2f85a1a0b630e78449f3598fae33",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-86a7b4e9af936acf0df6c941",
          "type": "sha256",
          "value": "9ed561402e41c753f32f30917a1b1e50ea12c272f203fae74d1cfee3d091da3a",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-13244221308717c5e3b7c994",
          "type": "sha256",
          "value": "a22fdaf4fdff6850730248a8c81a482e2c10bf0f1a5cfb5861dc5893442cf279",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-8a5af0b7357c1f2e01f97bb9",
          "type": "sha256",
          "value": "afa93c8baeaf1c28d1c5646ccdc701c636109bbc765549777a6417fa41fb5d6d",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-360234478e5cd2950479d06c",
          "type": "sha256",
          "value": "be7a8e1f7fddc3fd63f2540ea7103ba91c47d55c340504f69b286a64823678a0",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-04bd6ab7d6eeee1604545a7d",
          "type": "sha256",
          "value": "c1f5379165637b2d8c5dea37642242e5aae279d5e2b4b2a00bc2a1f6463f02de",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-0bdad433a95139a145fb83a1",
          "type": "sha256",
          "value": "ca5a37a5c3401ffcd1b7c98c3a22a921c013d1121fe33122e94dd81c382bf9b0",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-511050c60b386a45e1513ea2",
          "type": "sha256",
          "value": "cc900a14f6b6e17c5299c3f619b98ac2048780932d3b409cc9c5be79db70d15a",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-e73ef31389c49b65913211d5",
          "type": "sha256",
          "value": "d428b93962535e52f3631fe647be46828868b6a88e2ecb203c706a86919502a0",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-02759c6ac40a3bfd5dc5f2f4",
          "type": "sha256",
          "value": "dd4da68f83df075213351c713fa2067594e9ff7a402de406d3fe20f0c2a2f47e",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-505f30ee3a72798cf9fc57b8",
          "type": "domain",
          "value": "api.bing.com",
          "priority": 20,
          "reasons": [
            "dns-name-not-resolver-verdict"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-5e2b1acdbc83afde7ba3247a",
          "type": "domain",
          "value": "bangkok-8ac2-pc.phenomenoc.com",
          "priority": 20,
          "reasons": [
            "dns-name-not-resolver-verdict"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c000a650dcfc46195bc77c9d",
          "type": "domain",
          "value": "bristol-c71f-pc.phenomenoc.com",
          "priority": 20,
          "reasons": [
            "dns-name-not-resolver-verdict"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6030d24916c4a3d9b0702da3",
          "type": "domain",
          "value": "dns.msftncsi.com",
          "priority": 20,
          "reasons": [
            "dns-name-not-resolver-verdict"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f9ec368af37831f934cdd4da",
          "type": "domain",
          "value": "isatap.localdomain",
          "priority": 20,
          "reasons": [
            "dns-name-not-resolver-verdict"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-ac4ccf754406e23ad79ba82d",
          "type": "domain",
          "value": "isatap.phenomenoc.com",
          "priority": 20,
          "reasons": [
            "dns-name-not-resolver-verdict"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c7ab7b5aa56a3f3a089af1fd",
          "type": "domain",
          "value": "phenomenoc-dc.phenomenoc.com",
          "priority": 20,
          "reasons": [
            "dns-name-not-resolver-verdict"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-4d0aeb5e2f6db5d9e98fccca",
          "type": "domain",
          "value": "wpad.localdomain",
          "priority": 20,
          "reasons": [
            "dns-name-not-resolver-verdict"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c8ed365eb82ae8505eb49d08",
          "type": "domain",
          "value": "wpad.phenomenoc.com",
          "priority": 20,
          "reasons": [
            "dns-name-not-resolver-verdict"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c3494f4f4cb500cb66a8c46f",
          "type": "domain",
          "value": "ads-bid.l.doubleclick.net",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-0dd77ca23ed494a56d67cde3",
          "type": "domain",
          "value": "clients.l.google.com",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-ffcb46a0250fa3bca72c2a13",
          "type": "domain",
          "value": "d3569ngd5kwbnf.cloudfront.net",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-06d3fdaa42a1a49b9d37f8c7",
          "type": "domain",
          "value": "googleadapis.l.google.com",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-dda87fe98c7eaf869d2378c0",
          "type": "domain",
          "value": "googleapis.l.google.com",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-4fd4e6e5b0ad17bad2ddcf0e",
          "type": "domain",
          "value": "gstaticadssl.l.google.com",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-684832355e6dc8201fd6b876",
          "type": "domain",
          "value": "pagead.l.doubleclick.net",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-411f70024c6db02ea41b7e39",
          "type": "domain",
          "value": "pagead46.l.doubleclick.net",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-08f912818278a2042e9f225b",
          "type": "domain",
          "value": "scontent.xx.fbcdn.net",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-fa648015342403ba8ff0a02d",
          "type": "domain",
          "value": "star-mini.c10r.facebook.com",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-8924766a99421667cea60a8f",
          "type": "domain",
          "value": "www-google-analytics.l.google.com",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-62b120eae41d9e2bab3bf8b7",
          "type": "domain",
          "value": "www-googletagmanager.l.google.com",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-e4edc0d41865f92ad88c4d57",
          "type": "ipv4",
          "value": "104.244.42.136",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-8970ebcb6cb4bc6e6ed5a3cb",
          "type": "ipv4",
          "value": "104.244.42.200",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-9d844231759becb137c2913c",
          "type": "ipv4",
          "value": "104.244.42.72",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-4ce11a602be6d7c6eebb78af",
          "type": "ipv4",
          "value": "13.107.5.80",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f54ada418582a7bd05c9e922",
          "type": "ipv4",
          "value": "131.107.255.255",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-02f7a8bf73eabd0d4169654e",
          "type": "ipv4",
          "value": "172.217.0.67",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-e050dffae565135ae7b5164f",
          "type": "ipv4",
          "value": "172.217.12.110",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-d285fdd6f44dbc1d4593c433",
          "type": "ipv4",
          "value": "172.217.164.66",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-ed0652efa5fb107a88f981a8",
          "type": "ipv4",
          "value": "173.194.219.154",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-97b4231bac08845857f46185",
          "type": "ipv4",
          "value": "173.194.219.155",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6506a14e497b96bdb05a12e0",
          "type": "ipv4",
          "value": "173.194.219.157",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-9e0873f672cab11212a7a9bf",
          "type": "ipv4",
          "value": "173.194.219.94",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-fc13ad79b08b90c74371fb96",
          "type": "ipv4",
          "value": "185.254.190.200",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2e9b32e266b6eacba6321c91",
          "type": "ipv4",
          "value": "204.79.197.200",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2d083180fef914e1dfeb8355",
          "type": "ipv4",
          "value": "23.63.249.194",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-05cbbb0947c2d223cf400e31",
          "type": "ipv4",
          "value": "54.192.207.150",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-8fc4f83414bbb3ee28eb3de8",
          "type": "ipv4",
          "value": "54.192.207.51",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-514e7c4bdab2747e025b69fe",
          "type": "ipv4",
          "value": "54.192.207.79",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b6f388a7270bd32a1ef7174e",
          "type": "ipv4",
          "value": "64.233.185.101",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6e9c24bdc0d16ed0209b01d5",
          "type": "ipv4",
          "value": "64.233.185.102",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-874de5290bc693d62407d71c",
          "type": "ipv4",
          "value": "64.233.185.104",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f7f35cc366bf564c1973cedf",
          "type": "ipv4",
          "value": "64.233.185.105",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-7ccd6de2536e396b0370fec1",
          "type": "ipv4",
          "value": "64.233.185.106",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a774a510fd7b408de9b28949",
          "type": "ipv4",
          "value": "64.233.185.147",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-875fc8bd2dd02fd1063a0581",
          "type": "ipv4",
          "value": "64.233.185.154",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-9fe31247d21a48189d37d890",
          "type": "ipv4",
          "value": "64.233.185.156",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-14ddf5c712e50ec46e5e9202",
          "type": "ipv4",
          "value": "64.233.185.157",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c4dfbb521eadf6280a511ede",
          "type": "ipv4",
          "value": "64.233.185.99",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6ce05fe400793115119bb610",
          "type": "ipv4",
          "value": "74.125.136.100",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2c8519d2463ddd8099826035",
          "type": "ipv4",
          "value": "74.125.136.106",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a915248bce88b13949d6ab06",
          "type": "ipv4",
          "value": "74.125.136.113",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-cd16de5cf9d73acc68eb4e62",
          "type": "ipv4",
          "value": "74.125.136.138",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-60db58aa193777d7a01d0b62",
          "type": "ipv4",
          "value": "74.125.136.139",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-7dde82bc35da99adb2b4f2ae",
          "type": "ipv4",
          "value": "74.125.136.95",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-32335094a0eadc0b2d4d3ec7",
          "type": "ipv4",
          "value": "74.125.138.100",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-bcb27d635b5b0169b7c7ad59",
          "type": "ipv4",
          "value": "74.125.138.101",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c3beb9d9eb08e786f89fa3c6",
          "type": "ipv4",
          "value": "74.125.138.102",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2a0418fbd782e833d7efc199",
          "type": "ipv4",
          "value": "74.125.138.113",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-370ee327a1ea89fded8a7666",
          "type": "ipv4",
          "value": "74.125.138.139",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-423b613c0328bdc5bab765aa",
          "type": "ipv4",
          "value": "74.125.138.97",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-87eccc826622783004a9067f",
          "type": "ipv4",
          "value": "74.125.21.95",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-664e2a779b2a993a3c9c0a94",
          "type": "sha256",
          "value": "3103a01f90e95eef3300a895ab3411575325e0d2a1a4807e2fb5ae8e6f110f99",
          "priority": 95,
          "reasons": [
            "recovered-script-like-text-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [
            "malwarebazaar",
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2ceb202905d8c84afec748bd",
          "type": "domain",
          "value": "beef2live.com",
          "priority": 80,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-http-host",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a1f1511a10bcc4826c1f015d",
          "type": "domain",
          "value": "portal.farmcentric.com",
          "priority": 80,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-http-host",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c7ae4f5e6f88e259d292bbb7",
          "type": "ipv4",
          "value": "35.226.156.55",
          "priority": 80,
          "reasons": [
            "http_request-peer",
            "served-inspectable-file-not-transitive-verdict",
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-ec14a2b1d76ecd1680d002c9",
          "type": "domain",
          "value": "fghjkmgru34.site",
          "priority": 61,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-http-host"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-8e49d761240c204e6af8703b",
          "type": "domain",
          "value": "phenomenoc.com",
          "priority": 60,
          "reasons": [
            "dns-name-not-resolver-verdict"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b4c4fa5f6a16e7c8d87b3740",
          "type": "ipv4",
          "value": "8.209.83.76",
          "priority": 60,
          "reasons": [
            "http_request-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-12ed60e6c9870ec935eebcb9",
          "type": "domain",
          "value": "ajax.googleapis.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-http-host"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-50914840d6b1bc1796be8afb",
          "type": "domain",
          "value": "bid.g.doubleclick.net",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b4d36cf7392725e3031efc72",
          "type": "domain",
          "value": "clients1.google.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-http-host"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-dd364fb4a11e13825ed77f3f",
          "type": "domain",
          "value": "connect.facebook.net",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-http-host",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-336cfaab65d7dea44104ce02",
          "type": "domain",
          "value": "cse.google.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-http-host",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-1242d7b6dd2587a54dff78a2",
          "type": "domain",
          "value": "fonts.googleapis.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-57ffe4ac402911a8768028a2",
          "type": "domain",
          "value": "fonts.gstatic.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-8a9f7c208658d6d4255f5d9a",
          "type": "domain",
          "value": "googleads.g.doubleclick.net",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-e2c6c44c607f1cc20130b094",
          "type": "domain",
          "value": "iecvlist.microsoft.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-9bd36e23ee49c9080a9fc85e",
          "type": "domain",
          "value": "letsdoitquick.site",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-http-host"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-7aaa62709fedf9b1f805f872",
          "type": "domain",
          "value": "platform.twitter.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-49c3e0b75c93b65d2059a325",
          "type": "domain",
          "value": "ssl.gstatic.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f53cb88e0f287afca2727cbe",
          "type": "domain",
          "value": "static.xx.fbcdn.net",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f1d2c97a7177fd6b7088dae8",
          "type": "domain",
          "value": "staticxx.facebook.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a8f99ff977c4f409ba97d115",
          "type": "domain",
          "value": "syndication.twitter.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-67aeec17c77d6c3acb0a47e3",
          "type": "domain",
          "value": "www.bing.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-http-host"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2685e049a88c8636c938ff9a",
          "type": "domain",
          "value": "www.facebook.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-e4af5e4947b0823ba1a1c300",
          "type": "domain",
          "value": "www.farmprogress.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-285e869b296e4a7d8dc5e798",
          "type": "domain",
          "value": "www.google-analytics.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-http-host"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-ba49b256dcaf07616bcfa300",
          "type": "domain",
          "value": "www.google.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b0707daf41e5ddb7bf39fa52",
          "type": "domain",
          "value": "www.googleadservices.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-http-host"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-81688930e836c77ef0eb146e",
          "type": "domain",
          "value": "www.googleapis.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-309c90c59f32eb132460fd24",
          "type": "domain",
          "value": "www.googletagmanager.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b95d340f4665e3ea51ebda09",
          "type": "domain",
          "value": "www.gstatic.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-tls-sni-content-unknown"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-855f170573ea1612af9e27f7",
          "type": "domain",
          "value": "www.msftncsi.com",
          "priority": 46,
          "reasons": [
            "dns-name-not-resolver-verdict",
            "observed-http-host"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-e12331fd71415f4758ad0d7d",
          "type": "ipv4",
          "value": "104.244.42.8",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a1a235aa902ab85d7d66f8c3",
          "type": "ipv4",
          "value": "13.107.21.200",
          "priority": 45,
          "reasons": [
            "http_request-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-7bd2554e0e68554d0ae18d9c",
          "type": "ipv4",
          "value": "172.217.0.74",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-73e6b1e9de6e4939155395f3",
          "type": "ipv4",
          "value": "172.217.164.74",
          "priority": 45,
          "reasons": [
            "http_request-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-015cff4abbd5d8bac9e3a1b9",
          "type": "ipv4",
          "value": "172.217.2.34",
          "priority": 45,
          "reasons": [
            "http_request-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-4947e9e289ddeb373fb67dff",
          "type": "ipv4",
          "value": "172.217.2.35",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2aff663d8599034d8bcdcfc3",
          "type": "ipv4",
          "value": "173.194.219.156",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-3ce740464a71c68839d880b5",
          "type": "ipv4",
          "value": "173.194.219.97",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-14534480428ec180df7714e0",
          "type": "ipv4",
          "value": "216.58.193.163",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-1d67f8156f9fc5460f88ca85",
          "type": "ipv4",
          "value": "23.63.249.144",
          "priority": 45,
          "reasons": [
            "http_request-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-929110509317e5717fc802f7",
          "type": "ipv4",
          "value": "23.63.249.186",
          "priority": 45,
          "reasons": [
            "http_request-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-357c7aa9f32edaf5e5031a3c",
          "type": "ipv4",
          "value": "31.13.65.36",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c8a684c5f730782f1c750e3d",
          "type": "ipv4",
          "value": "31.13.65.7",
          "priority": 45,
          "reasons": [
            "http_request-peer",
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f9caab36b295876e73eaf13c",
          "type": "ipv4",
          "value": "37.46.135.170",
          "priority": 45,
          "reasons": [
            "http_request-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-9b2e5973357c70273d26e447",
          "type": "ipv4",
          "value": "54.192.207.126",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-24e5fffe18dfd0adf6fade62",
          "type": "ipv4",
          "value": "64.233.185.103",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-1bb20a860ffe5378aaf2f5bc",
          "type": "ipv4",
          "value": "64.233.185.155",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-0359865ac7acecf13a55a911",
          "type": "ipv4",
          "value": "64.233.185.94",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b7dc4639fc754303031a0b8a",
          "type": "ipv4",
          "value": "64.233.185.95",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-0b9972b1d21f8ccaff80eb6a",
          "type": "ipv4",
          "value": "72.21.81.200",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-5b1d4d021241dcdb0a15ed4e",
          "type": "ipv4",
          "value": "72.21.91.66",
          "priority": 45,
          "reasons": [
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-23aaa6f3e412eeead34ec3e4",
          "type": "ipv4",
          "value": "74.125.136.101",
          "priority": 45,
          "reasons": [
            "http_request-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-0c2be4245f3922f5c26ece09",
          "type": "ipv4",
          "value": "74.125.136.102",
          "priority": 45,
          "reasons": [
            "http_request-peer",
            "tls_client_hello-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-94b60df33482de05fc570f75",
          "type": "ipv4",
          "value": "74.125.138.138",
          "priority": 45,
          "reasons": [
            "http_request-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6f3b10f19ea885a057e0ec2e",
          "type": "ipv4",
          "value": "91.235.129.60",
          "priority": 45,
          "reasons": [
            "http_request-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": false
        }
      ],
      "eligible_count": 152,
      "next_batch": [
        "observable-6abbc94132a7e57e69e2ca48",
        "observable-9a3479853f96c17532699bb8",
        "observable-2c15c5b4134712b14c4e22e5",
        "observable-67b23ac28e9b7c8dd9833b23",
        "observable-b1f8f35062a845758bd23cb5",
        "observable-366e5aaa0d30328279f2cf95",
        "observable-56d17166ea19e22a3275c97c",
        "observable-fc0e535172760fba14aed47d",
        "observable-0940d0897a5e182dc883562e",
        "observable-fb56dd78ecc9956b2abcc7b7"
      ],
      "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure."
    },
    "assessment_sha256": "10891b5d20b12429ae762387421890bd522cfaa329a0ca623ad0005a225f43a2"
  },
  "enrichment": {
    "items": [
      {
        "type": "ipv4",
        "value": "91.235.129.60",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:01.494747+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:01.490470+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:47:01.485879+00:00",
        "observable_id": "observable-6f3b10f19ea885a057e0ec2e"
      },
      {
        "type": "ipv4",
        "value": "74.125.138.138",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:01.310338+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:01.307621+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:47:01.304145+00:00",
        "observable_id": "observable-94b60df33482de05fc570f75"
      },
      {
        "type": "ipv4",
        "value": "74.125.136.102",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:01.112297+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:01.107692+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:47:01.101721+00:00",
        "observable_id": "observable-0c2be4245f3922f5c26ece09"
      },
      {
        "type": "ipv4",
        "value": "74.125.136.101",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.919885+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.917468+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:47:00.915021+00:00",
        "observable_id": "observable-23aaa6f3e412eeead34ec3e4"
      },
      {
        "type": "ipv4",
        "value": "72.21.91.66",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.732340+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.728510+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:47:00.724377+00:00",
        "observable_id": "observable-5b1d4d021241dcdb0a15ed4e"
      },
      {
        "type": "ipv4",
        "value": "72.21.81.200",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:35.712902+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.719243+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:47:00.714956+00:00",
        "observable_id": "observable-0b9972b1d21f8ccaff80eb6a"
      },
      {
        "type": "ipv4",
        "value": "64.233.185.95",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.516438+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.512500+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:47:00.507429+00:00",
        "observable_id": "observable-b7dc4639fc754303031a0b8a"
      },
      {
        "type": "ipv4",
        "value": "64.233.185.94",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.193231+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:00.191414+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:47:00.189094+00:00",
        "observable_id": "observable-0359865ac7acecf13a55a911"
      },
      {
        "type": "ipv4",
        "value": "64.233.185.155",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.978733+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.974362+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:59.968670+00:00",
        "observable_id": "observable-1bb20a860ffe5378aaf2f5bc"
      },
      {
        "type": "ipv4",
        "value": "64.233.185.103",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.768086+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.766389+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:59.763955+00:00",
        "observable_id": "observable-24e5fffe18dfd0adf6fade62"
      },
      {
        "type": "ipv4",
        "value": "54.192.207.126",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.583851+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.581910+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:59.579553+00:00",
        "observable_id": "observable-9b2e5973357c70273d26e447"
      },
      {
        "type": "ipv4",
        "value": "37.46.135.170",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.387845+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.381392+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:59.376154+00:00",
        "observable_id": "observable-f9caab36b295876e73eaf13c"
      },
      {
        "type": "ipv4",
        "value": "31.13.65.7",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.190200+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:59.184574+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:59.179876+00:00",
        "observable_id": "observable-c8a684c5f730782f1c750e3d"
      },
      {
        "type": "ipv4",
        "value": "31.13.65.36",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.986745+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.982450+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:58.976896+00:00",
        "observable_id": "observable-357c7aa9f32edaf5e5031a3c"
      },
      {
        "type": "ipv4",
        "value": "23.63.249.186",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.796965+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.794931+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:58.792612+00:00",
        "observable_id": "observable-929110509317e5717fc802f7"
      },
      {
        "type": "ipv4",
        "value": "23.63.249.144",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.603844+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.600928+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:58.597559+00:00",
        "observable_id": "observable-1d67f8156f9fc5460f88ca85"
      },
      {
        "type": "ipv4",
        "value": "216.58.193.163",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.402184+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.395932+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:58.389366+00:00",
        "observable_id": "observable-14534480428ec180df7714e0"
      },
      {
        "type": "ipv4",
        "value": "173.194.219.97",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.024887+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:58.019739+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:58.014586+00:00",
        "observable_id": "observable-3ce740464a71c68839d880b5"
      },
      {
        "type": "ipv4",
        "value": "173.194.219.156",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.831521+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.829195+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:57.826514+00:00",
        "observable_id": "observable-2aff663d8599034d8bcdcfc3"
      },
      {
        "type": "ipv4",
        "value": "172.217.2.35",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.656292+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.653755+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:57.651509+00:00",
        "observable_id": "observable-4947e9e289ddeb373fb67dff"
      },
      {
        "type": "ipv4",
        "value": "172.217.2.34",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.448967+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.444447+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:57.439747+00:00",
        "observable_id": "observable-015cff4abbd5d8bac9e3a1b9"
      },
      {
        "type": "ipv4",
        "value": "172.217.164.74",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.240603+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.236133+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:57.231533+00:00",
        "observable_id": "observable-73e6b1e9de6e4939155395f3"
      },
      {
        "type": "ipv4",
        "value": "172.217.0.74",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.048247+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:57.043969+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:57.038560+00:00",
        "observable_id": "observable-7bd2554e0e68554d0ae18d9c"
      },
      {
        "type": "ipv4",
        "value": "13.107.21.200",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.847649+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.842514+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:56.835972+00:00",
        "observable_id": "observable-a1a235aa902ab85d7d66f8c3"
      },
      {
        "type": "ipv4",
        "value": "104.244.42.8",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.627668+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.623380+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:56.619343+00:00",
        "observable_id": "observable-e12331fd71415f4758ad0d7d"
      },
      {
        "type": "domain",
        "value": "www.msftncsi.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:30.477224+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.614902+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:56.610865+00:00",
        "observable_id": "observable-855f170573ea1612af9e27f7"
      },
      {
        "type": "domain",
        "value": "www.gstatic.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:45.870621+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.605615+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:56.601447+00:00",
        "observable_id": "observable-b95d340f4665e3ea51ebda09"
      },
      {
        "type": "domain",
        "value": "www.googletagmanager.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:38.593969+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.434933+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:56.430733+00:00",
        "observable_id": "observable-309c90c59f32eb132460fd24"
      },
      {
        "type": "domain",
        "value": "www.googleapis.com",
        "signals": [
          {
            "basis": "No direct maliciousness evidence",
            "actors": [],
            "source": "threatfox",
            "status": "ok",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.261656+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [
              {
                "tier": 1,
                "source": "www.googleapis.com",
                "target": "https://storage.googleapis.com/nodedownload/NodeServer-Setup-Full_t1.msi",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.googleapis.com",
                "target": "https://storage.googleapis.com/nodedownload/NodeServer-Setup-Full_t5.msi",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.googleapis.com",
                "target": "https://storage.googleapis.com/nodedownload/NodeServer-Setup-Full_t4.msi",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.googleapis.com",
                "target": "https://storage.googleapis.com/nodedownload/NodeServer-Setup-Full_t3.msi",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.googleapis.com",
                "target": "https://storage.googleapis.com/nodedownload/NodeServer-Setup-Full_t6.msi",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.googleapis.com",
                "target": "https://storage.googleapis.com/mantrams-browser-defender-public/non-login-pages/clickfix_cloudflare_multios.html",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              }
            ],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.259924+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:56.257831+00:00",
        "observable_id": "observable-81688930e836c77ef0eb146e"
      },
      {
        "type": "domain",
        "value": "www.googleadservices.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.074296+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.069557+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:56.065597+00:00",
        "observable_id": "observable-b0707daf41e5ddb7bf39fa52"
      },
      {
        "type": "domain",
        "value": "www.google.com",
        "signals": [
          {
            "basis": "No direct maliciousness evidence",
            "actors": [],
            "source": "threatfox",
            "status": "ok",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:45.279334+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "meet.google.com-join.us",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://drive.usercontent.google.com/download?id=1RsoI3BAuH3uMNc6wdwwamUtsJhL6hHiB&export=download&confirm=t&uuid=32ec83bf-6d8e-4069-ac04-2cc059ae19e5",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/claudemacos",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/brewpage",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/version-0105",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/hiddenhub",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/xnewbrenow",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/mellerbrew",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/clodemacx",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/xbreshamewmew",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/onemacx",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/clavdenbewvews",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/clau-deskt-ver-24",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/deutchbremac",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/clau-ver-un-24",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/clau-ver-un-v25",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/xbrewmacboe",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/claumacxvsz",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/payforwin",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/xbiernlk",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/newpayservices.com/cdx-biz-ver-un-v27",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/newappclaude.com/clau-ver-un-30",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7T",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/mehrmarkenwerkstattheiligensta/home",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              },
              {
                "tier": 1,
                "source": "www.google.com",
                "target": "https://sites.google.com/view/facturacion2026mx",
                "evidence": "threatfox field ioc",
                "target_type": "ioc",
                "evidence_source": "threatfox"
              }
            ],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:56.061053+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:56.056206+00:00",
        "observable_id": "observable-ba49b256dcaf07616bcfa300"
      },
      {
        "type": "domain",
        "value": "www.google-analytics.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.888530+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.883564+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:55.878963+00:00",
        "observable_id": "observable-285e869b296e4a7d8dc5e798"
      },
      {
        "type": "domain",
        "value": "www.farmprogress.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.711430+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.706604+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:55.701667+00:00",
        "observable_id": "observable-e4af5e4947b0823ba1a1c300"
      },
      {
        "type": "domain",
        "value": "www.facebook.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.529465+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.523678+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:55.519058+00:00",
        "observable_id": "observable-2685e049a88c8636c938ff9a"
      },
      {
        "type": "domain",
        "value": "www.bing.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:28.166581+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.514397+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:55.508416+00:00",
        "observable_id": "observable-67aeec17c77d6c3acb0a47e3"
      },
      {
        "type": "domain",
        "value": "syndication.twitter.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.321752+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.317515+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:55.312670+00:00",
        "observable_id": "observable-a8f99ff977c4f409ba97d115"
      },
      {
        "type": "domain",
        "value": "staticxx.facebook.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.130563+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:55.127845+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:55.124117+00:00",
        "observable_id": "observable-f1d2c97a7177fd6b7088dae8"
      },
      {
        "type": "domain",
        "value": "static.xx.fbcdn.net",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.784522+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.780023+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.775869+00:00",
        "observable_id": "observable-f53cb88e0f287afca2727cbe"
      },
      {
        "type": "domain",
        "value": "ssl.gstatic.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:44.559966+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.771467+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.766798+00:00",
        "observable_id": "observable-49c3e0b75c93b65d2059a325"
      },
      {
        "type": "domain",
        "value": "platform.twitter.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.591506+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.586152+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.581189+00:00",
        "observable_id": "observable-7aaa62709fedf9b1f805f872"
      },
      {
        "type": "domain",
        "value": "letsdoitquick.site",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.403863+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.398094+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.391097+00:00",
        "observable_id": "observable-9bd36e23ee49c9080a9fc85e"
      },
      {
        "type": "domain",
        "value": "iecvlist.microsoft.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:00.584505+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.384429+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.378254+00:00",
        "observable_id": "observable-e2c6c44c607f1cc20130b094"
      },
      {
        "type": "domain",
        "value": "googleads.g.doubleclick.net",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:42.522371+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.370103+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.364202+00:00",
        "observable_id": "observable-8a9f7c208658d6d4255f5d9a"
      },
      {
        "type": "domain",
        "value": "fonts.gstatic.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:19.985832+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.358315+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.353042+00:00",
        "observable_id": "observable-57ffe4ac402911a8768028a2"
      },
      {
        "type": "domain",
        "value": "fonts.googleapis.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:19.818148+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.349165+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.344538+00:00",
        "observable_id": "observable-1242d7b6dd2587a54dff78a2"
      },
      {
        "type": "domain",
        "value": "cse.google.com",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:18.506438+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.339358+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.335322+00:00",
        "observable_id": "observable-336cfaab65d7dea44104ce02"
      },
      {
        "type": "domain",
        "value": "connect.facebook.net",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:14.006547+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.330330+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.322094+00:00",
        "observable_id": "observable-dd364fb4a11e13825ed77f3f"
      },
      {
        "type": "domain",
        "value": "clients1.google.com",
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.172500+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:17.998377+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.168863+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.167228+00:00",
        "observable_id": "observable-b4d36cf7392725e3031efc72"
      },
      {
        "type": "domain",
        "value": "bid.g.doubleclick.net",
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.167204+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:16.065253+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.162951+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.158849+00:00",
        "observable_id": "observable-50914840d6b1bc1796be8afb"
      },
      {
        "type": "domain",
        "value": "ajax.googleapis.com",
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.158753+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": true,
            "queried_at": "2026-09-22T17:45:10.341533+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.150039+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:54.145495+00:00",
        "observable_id": "observable-12ed60e6c9870ec935eebcb9"
      },
      {
        "type": "ipv4",
        "value": "8.209.83.76",
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:54.145430+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.936699+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.932701+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:53.927881+00:00",
        "observable_id": "observable-b4c4fa5f6a16e7c8d87b3740"
      },
      {
        "type": "domain",
        "value": "phenomenoc.com",
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.927808+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.754749+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.750262+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:53.746087+00:00",
        "observable_id": "observable-8e49d761240c204e6af8703b"
      },
      {
        "type": "domain",
        "value": "fghjkmgru34.site",
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.746026+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.577985+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.575480+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:53.571206+00:00",
        "observable_id": "observable-ec14a2b1d76ecd1680d002c9"
      },
      {
        "type": "ipv4",
        "value": "35.226.156.55",
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.571142+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.377880+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.373370+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:53.369039+00:00",
        "observable_id": "observable-c7ae4f5e6f88e259d292bbb7"
      },
      {
        "type": "domain",
        "value": "portal.farmcentric.com",
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.368977+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.184298+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.180206+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:53.176108+00:00",
        "observable_id": "observable-a1f1511a10bcc4826c1f015d"
      },
      {
        "type": "domain",
        "value": "beef2live.com",
        "signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:53.176045+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:52.996365+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:52.992101+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:52.987583+00:00",
        "observable_id": "observable-2ceb202905d8c84afec748bd"
      },
      {
        "type": "sha256",
        "value": "3103a01f90e95eef3300a895ab3411575325e0d2a1a4807e2fb5ae8e6f110f99",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:52.651426+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:52.435658+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:46:52.431068+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:46:52.425278+00:00",
        "observable_id": "observable-664e2a779b2a993a3c9c0a94"
      }
    ],
    "coverage": {
      "cache_hits": 1,
      "active_scans": 0,
      "batch_results": [
        {
          "status": "deferred-rate-limit",
          "provider": "virustotal",
          "observable_id": "observable-b7dc4639fc754303031a0b8a"
        },
        {
          "status": "not_found",
          "provider": "threatfox",
          "observable_id": "observable-b7dc4639fc754303031a0b8a"
        },
        {
          "status": "deferred-rate-limit",
          "provider": "virustotal",
          "observable_id": "observable-0b9972b1d21f8ccaff80eb6a"
        },
        {
          "status": "not_found",
          "provider": "threatfox",
          "observable_id": "observable-0b9972b1d21f8ccaff80eb6a"
        },
        {
          "status": "deferred-rate-limit",
          "provider": "virustotal",
          "observable_id": "observable-5b1d4d021241dcdb0a15ed4e"
        },
        {
          "status": "not_found",
          "provider": "threatfox",
          "observable_id": "observable-5b1d4d021241dcdb0a15ed4e"
        },
        {
          "status": "deferred-rate-limit",
          "provider": "virustotal",
          "observable_id": "observable-23aaa6f3e412eeead34ec3e4"
        },
        {
          "status": "not_found",
          "provider": "threatfox",
          "observable_id": "observable-23aaa6f3e412eeead34ec3e4"
        },
        {
          "status": "deferred-rate-limit",
          "provider": "virustotal",
          "observable_id": "observable-0c2be4245f3922f5c26ece09"
        },
        {
          "status": "not_found",
          "provider": "threatfox",
          "observable_id": "observable-0c2be4245f3922f5c26ece09"
        },
        {
          "status": "deferred-rate-limit",
          "provider": "virustotal",
          "observable_id": "observable-94b60df33482de05fc570f75"
        },
        {
          "status": "not_found",
          "provider": "threatfox",
          "observable_id": "observable-94b60df33482de05fc570f75"
        },
        {
          "status": "deferred-rate-limit",
          "provider": "virustotal",
          "observable_id": "observable-6f3b10f19ea885a057e0ec2e"
        },
        {
          "status": "not_found",
          "provider": "threatfox",
          "observable_id": "observable-6f3b10f19ea885a057e0ec2e"
        }
      ],
      "batch_targets": 7,
      "payload_uploads": 0,
      "targets_omitted": 0,
      "retained_targets": 57,
      "full_urls_disclosed": 0,
      "provider_lookups_started": 6
    },
    "updated_at": "2026-09-22T17:47:02.178791+00:00",
    "schema_version": "pcap-reputation-v1",
    "snapshot_sha256": "e8debbb454bae644a487596fd1b3e692b62d77105a4af15347a03f61566d97fb",
    "source_semantic_sha256": "a523d37fb652442f09fef8af2215fc4fe4de55bef981e80127078b946b703d19",
    "previous_snapshot_sha256": "342e3cc77e079de715c7073a9bd9cdc3ae93f679a8d6199205d77dbbf005e2aa"
  },
  "artifact_download_available": true,
  "source_tlp": "TLP:CLEAR",
  "techniques": [
    {
      "attack_id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "command-and-control",
      "confidence": 0.8,
      "evidence": "T1105 Ingress Tool Transfer",
      "review_status": "suggested",
      "evidence_start": 13348,
      "evidence_end": 13375,
      "evidence_source": "source-text",
      "llm_verified": true,
      "review_note": null,
      "reviewer": null,
      "reviewed_at": null
    }
  ],
  "apt_matches": [
    {
      "group_attack_id": "G0123",
      "group_name": "Volatile Cedar",
      "similarity": 0.2,
      "shared_count": 1,
      "shared_techniques": [
        "T1105"
      ]
    },
    {
      "group_attack_id": "G0044",
      "group_name": "Winnti Group",
      "similarity": 0.1667,
      "shared_count": 1,
      "shared_techniques": [
        "T1105"
      ]
    },
    {
      "group_attack_id": "G0130",
      "group_name": "Ajax Security Team",
      "similarity": 0.1667,
      "shared_count": 1,
      "shared_techniques": [
        "T1105"
      ]
    },
    {
      "group_attack_id": "G0136",
      "group_name": "IndigoZebra",
      "similarity": 0.1429,
      "shared_count": 1,
      "shared_techniques": [
        "T1105"
      ]
    },
    {
      "group_attack_id": "G0133",
      "group_name": "Nomadic Octopus",
      "similarity": 0.1429,
      "shared_count": 1,
      "shared_techniques": [
        "T1105"
      ]
    },
    {
      "group_attack_id": "G1013",
      "group_name": "Metador",
      "similarity": 0.1111,
      "shared_count": 1,
      "shared_techniques": [
        "T1105"
      ]
    },
    {
      "group_attack_id": "G0107",
      "group_name": "Whitefly",
      "similarity": 0.1111,
      "shared_count": 1,
      "shared_techniques": [
        "T1105"
      ]
    },
    {
      "group_attack_id": "G0066",
      "group_name": "Elderwood",
      "similarity": 0.1111,
      "shared_count": 1,
      "shared_techniques": [
        "T1105"
      ]
    },
    {
      "group_attack_id": "G0075",
      "group_name": "Rancor",
      "similarity": 0.1111,
      "shared_count": 1,
      "shared_techniques": [
        "T1105"
      ]
    },
    {
      "group_attack_id": "G0120",
      "group_name": "Evilnum",
      "similarity": 0.0909,
      "shared_count": 1,
      "shared_techniques": [
        "T1105"
      ]
    }
  ],
  "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative."
}